EMS AUDITING CONCEPTS AND ISO 14000

The Environmental Management System (EMS) audit is based on the generic concept of auditing. Simply put, an audit, any audit, is the comparison of actual conditions to expected conditions, and a determination as to whether one is in conformance or not in conformance. This is the same philosophy used to perform financial, quality, regulatory compliance, and systems audits. It is prudent to first review what the common elements are in order to better understand why audits are different.

There are several definitions of audit components that are common to any type of audit. ISO 14001 defines these terms for EMS audits, but they apply in other cases also. As a matter of fact, the ISO committee decided not to create auditing standards for other types of audits, such as compliance audits, although it was originally considered. The main reason for deleting the work items was because the concepts and processes defined in 14011, originally intended for EMS audits, were generic enough to be applied “as is” to other types of audits.

An audit is fundamentally a comparison of audit evidence to audit criteria to determine findings. The evidence is the objective information collected through interviews, visual reconnaissance, and documentation review. The audit criteria are the expectations or “rules” of how conditions should be. It is the criteria that distinguish one audit from the next. For example, in compliance auditing, the criteria are the regulations. With an EMS audit, the criteria would be the description of the expected system elements. In this case, the EMS criteria would be that described in ISO 14001, the specification standard.

When evidence is compared to criteria, one can determine whether the audited entity does or does not conform. This determination is a finding, and a finding can either be one of conformance, or non-conformance. Therefore, an audit will always produce findings, even if what is being audited is in full conformance with criteria.

Other key definitions to be aware of with auditing are: objectives, scope, auditee, client, and auditor. The audit objective(s) is simply why you are conducting an audit; usually the reason is to demonstrate conformance to stated criteria. The audit scope is what entity is being audited, and can be a company, a site, or unit within a site or company.

In the ISO 14000 realm, there is a clear distinction between the auditee and client. The auditee is the entity being audited. The client is the party commissioning the audit. For example, a client can be the customer, and the auditee a supplier to that customer. In ISO 14000, this distinction is important because the client sets the scope, objectives, and plan for an audit, not the auditee, although it is expected the auditee will be involved and cooperate.

The auditor is the one actually collecting evidence and determining findings. The auditor can be comprised of several individuals on a team. There are requirements in ISO 14001 that state that those performing functions within the EMS, such as the auditors, be qualified in their tasks. This means the auditors must have received training in EMS auditing. However, there may be audit team members who do not have the training, but are on the team because of some unique expertise, such as process, language, or regulatory knowledge.