ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
An ISO 14001 surveillance audit is the shorter, on-site audit your certification body runs in each of the two years between your initial certification and your recertification, and in 2026 it carries something it did not carry a year ago: the transition to ISO 14001:2026. The 2015 edition is withdrawn, the clock runs to 30 April 2029, and Global ACI’s transition requirements say explicitly that the transition audit “may be conducted in conjunction with the certified organisation’s surveillance audit”. For most certified organisations that means the next surveillance visit is where the new edition arrives.
This guide sets out what the rules actually require, how long the visit should take for an environmental management system, the eight areas the auditor has to cover, and what gets you suspended. Every clause number below comes from ISO/IEC 17021-1:2015 or IAF MD 5, both of which are free to read.
Free gap assessment
Are you ready for the 2026 edition of ISO 14001?
Score every clause of the new edition, free, including the aspects, life cycle and compliance evaluation work that carries most of the findings.
Run the free ISO 14001 gap assessment → or View premium report sample
ISO/IEC 17021-1 clause 9.6.2.2 is blunt about the scope: surveillance audits “are on-site audits, but are not necessarily full system audits.” That single sentence resolves most of the confusion. The auditor is not re-auditing every clause of ISO 14001 against every process. They are sampling, and they are sampling against a fixed list.
Two things follow. First, an ISO 14001 surveillance audit cannot be done entirely by desk review: clause 9.6.2.1.2 requires that surveillance activities “shall include on-site auditing.” The certification body may add other surveillance activities around it — enquiries to you about aspects of your certification, a review of your own public statements such as promotional material and your website, requests for documented information, and other monitoring of your performance — but those supplement the site visit, they do not replace it.
Second, because an ISO 14001 surveillance audit is a sample, a clean surveillance report is not a statement that your whole environmental management system conforms. It is a statement that nothing in the sampled areas undermined confidence in the certificate. Organisations that treat surveillance as the only time their system is checked tend to find that out at recertification, when the audit is roughly twice as long.
Clause 9.1.3.2 sets the standard programme for a first certification: a two-stage initial audit, surveillance audits in the first and second years following the certification decision, and a recertification audit in the third year before the certificate expires. The three-year cycle begins with the certification decision — not with the stage 2 audit, not with the date printed on your certificate if those differ. Later cycles begin with the recertification decision.
Two hard dates govern when an ISO 14001 surveillance audit falls due, both in clause 9.1.3.3. Surveillance audits are conducted at least once a calendar year, except in recertification years. And the first ISO 14001 surveillance audit after initial certification “shall not be more than 12 months from the certification decision date.” That second rule is the one that catches people. If your certification decision was made in March, a surveillance visit scheduled for the following April is late, whatever your internal audit calendar says.
| Cycle year | Audit | Rule |
|---|---|---|
| Year 0 | Stage 1 + stage 2 initial audit, then the certification decision | Clause 9.1.3.2 — the cycle starts at the decision |
| Year 1 | First surveillance audit | No later than 12 months from the certification decision date (9.1.3.3) |
| Year 2 | Second surveillance audit | At least once per calendar year (9.1.3.3) |
| Year 3 | Recertification audit | Completed before the certificate expires (9.6.3) |
There is one documented flexibility: the note to clause 9.1.3.3 allows the frequency to accommodate factors such as seasons, or certification of limited duration — a temporary construction site, for example. For an environmental management system that matters more than it does for quality. If your significant aspects are seasonal, say so when the programme is planned rather than arguing about it afterwards.
From the second cycle onward, IAF MD 5 clause 7 lets the certification body design an individualised surveillance and recertification programme instead of the standard pattern. If your certification body proposes one, ask what it changes about the frequency and the time, in writing.
This is where the time allowed for an ISO 14001 surveillance audit diverges sharply from a quality audit, and where most generic advice is wrong.
IAF MD 5 clause 5 gives the proportion: annual surveillance time should be “about 1/3 of the audit time spent on the initial certification audit” — meaning stage 1 and stage 2 combined. The note adds that it is “unlikely that a surveillance audit duration will be less than one (1) audit day.” An audit day is normally eight hours, and travel and breaks do not count toward it.
The initial figure comes from Table EMS 1 in MD 5’s Annex B. Unlike the quality-management table, EMS 1 has four columns, because the days depend on both your effective number of personnel and the complexity of your environmental aspects. Clause 1.11 states that this complexity category applies to EMS only. Table EMS 2 maps business sectors to the categories: mining, oil refining, chemicals and pharmaceuticals, primary metals, coal-based generation, civil construction and demolition, and waste and effluent processing are high; food processing, transport, healthcare, non-coal generation and testing laboratories are medium; hotels and restaurants, wholesale and retail, and electronic equipment assembly are low; head offices, telecommunications, general business services and education are limited.
The table below gives the published initial audit days and the one-third surveillance figure derived from them, adjusted to the nearest half day as clause 2.2.3 requires and floored at one day per the clause 5 note.
| Effective personnel | Initial (high) | Surveillance ≈ | Initial (medium) | Surveillance ≈ | Initial (limited) | Surveillance ≈ |
|---|---|---|---|---|---|---|
| 1–5 | 3 | 1 | 2.5 | 1 | 2.5 | 1 |
| 16–25 | 5.5 | 2 | 4.5 | 1.5 | 3 | 1 |
| 26–45 | 7 | 2.5 | 5.5 | 2 | 3 | 1 |
| 46–65 | 8 | 2.5 | 6 | 2 | 3.5 | 1 |
| 86–125 | 11 | 3.5 | 8 | 2.5 | 4 | 1.5 |
| 126–175 | 12 | 4 | 9 | 3 | 4.5 | 1.5 |
| 176–275 | 13 | 4.5 | 10 | 3.5 | 5 | 1.5 |
Read those surveillance columns as a sanity check, not an entitlement. The published numbers are the initial-audit days; the one-third figure is arithmetic on top of them, and your certification body owns the calculation. What MD 5 does give you is an argument: clause 5 requires the planned surveillance time to be reviewed at every surveillance and recertification audit to take account of changes in the organisation and system maturity, and the evidence of that review, including any adjustment, has to be recorded. If your headcount has halved and your ISO 14001 surveillance audit still costs what it did three years ago, that record is the thing to ask for.
Two traps. Clause 2.2.2 forbids reducing the allocated days by programming longer working days — a two-day audit is not a one-day audit with a late finish. And the note to clause 2.2.4 is worth knowing when a certification body offers a half day with two auditors: MD 5 itself observes that this may not be as effective as one full day with one auditor.
Clause 9.6.2.2 lists eight items that “each surveillance includes review of” — the agenda every ISO 14001 surveillance audit has to cover. This is the closest thing to an agenda you will get, and it is the right basis for your own preparation.
| # | Required review area | What to have ready |
|---|---|---|
| a | Internal audits and management review | A completed internal audit programme covering the period, reports, and minutes of a management review held since the last visit |
| b | Actions taken on nonconformities from the previous audit | Root cause analysis, corrective action, evidence of implementation, and your own effectiveness check |
| c | Complaints handling | The log of external environmental complaints — odour, noise, dust, discharges — and how each was closed |
| d | Effectiveness of the system against your objectives and intended results | Environmental objectives with measured progress, not just targets |
| e | Progress of planned continual improvement activities | The improvement plan and what actually moved |
| f | Continuing operational control | Clause 8.1 controls still running, including for externally provided processes, products and services |
| g | Review of any changes | New processes, sites, substances, permits, legislation or contractors since the last audit |
| h | Use of marks and any other reference to certification | Your website, tender documents and packaging claims |
Item (h) is the one organisations lose points on without ever thinking about it, and a certification body does not have to wait for the site visit to find it — reviewing your public statements and website is a listed surveillance activity under clause 9.6.2.1.2. A certificate covers a management system, not a product, so an ISO 14001 certification mark next to a product claim is a finding.
Item (g) is the one that costs the most time when it is handled badly. If you have added a site, changed a waste contractor, taken on a new permitted discharge or brought a process in-house, raise it before the audit. Unannounced change is what turns a two-day visit into a scope question.
ISO 14001:2026 — the fourth edition — was published on 15 April 2026, and ISO 14001:2015 together with its Amendment 1:2024 climate amendment is withdrawn. Global ACI, which took over the IAF’s multilateral arrangement, published Global ACI-TECH-3-TR 2029-04-30 (M), Transition Requirements for ISO 14001:2026 with an issue date of 4 September 2026 and an implementation date of 14 September 2026. It sets a three-year transition ending 30 April 2029.
| Date | Milestone |
|---|---|
| 15 April 2026 | ISO 14001:2026 published; the 2015 edition and Amd 1:2024 withdrawn |
| 31 October 2026 | Accreditation bodies ready to assess against ISO 14001:2026 |
| 31 January 2027 | Certification bodies submit their transition declaration and supporting documents |
| 30 April 2027 | Accreditation body transition decisions completed |
| 31 October 2027 | New and initial accredited certifications may only be issued to ISO 14001:2026 |
| 30 April 2029 | Transition ends; certifications to the 2015 edition are no longer valid |
Three practical consequences for anyone planning an ISO 14001 surveillance audit in the next two years.
The transition audit can be bundled in. TECH-3-TR states the transition audit “may be conducted in conjunction with the certified organisation’s surveillance audit, recertification audit or through a separate special audit.” It must review, at minimum, the changed requirements of ISO 14001:2026 against the previous version, changes to your context, and whether anything else in your system needs to change. It may be conducted remotely through information and communication technology under IAF MD 4, now published as Global ACI TECH-3-003, if the certification body can demonstrate the objectives were met.
Extra audit time is possible, not automatic. Asked whether more time is likely, the document answers “Possibly”: the certification body must consider the degree of change to your system and whether the transition is bundled into an annual audit or run as a special audit, and must justify any addition under ISO/IEC 17021-1 and MD 5. The note adds that additional time may not be needed for a full system audit. So an invoice that adds days to your ISO 14001 surveillance audit for the transition should come with a justification you can read.
Declining the new edition caps your certificate. Section 6.4 allows a certified organisation to keep being audited against the 2015 edition, but 6.4.1.1 is explicit: where you have declared you will not transition, the certification “may not extend beyond the end of the transition period”, so it may not remain valid for the whole cycle if it currently expires after 30 April 2029. Certification bodies may shorten the printed expiry date to reduce market confusion. Deferring the decision to the last surveillance before 2029 is therefore a decision to lose certificate life.
Our guide to what changed in ISO 14001:2026 covers the content side — the new clause 6.3 on planning of changes, climate change built into the clause 4 context requirements rather than bolted on by amendment, the renamed clause 5.3, more weight on the life cycle perspective, operational control extended to externally provided processes, products and services, and a restructured management review.
The eight areas tell you the headings. In an ISO 14001 surveillance audit the recurring findings sit in five places, all of them environmental rather than administrative.
The aspects and impacts register, maintained rather than written once. Clause 6.1 requires you to determine the environmental aspects of your activities, products and services and the associated impacts, taking a life cycle perspective. A register whose last revision date predates a new process, a new substance or a new site is the single most common finding in an ISO 14001 surveillance audit. The three ISO 14001 registers — aspects, impacts and compliance obligations — are where surveillance starts.
Compliance obligations and evaluated compliance. Keeping a list of applicable legislation is not the requirement; clause 9.1 requires you to evaluate compliance with it and keep records of the result. Permits with expiry dates, consent limits, monitoring returns and licence conditions all need a dated evaluation, not a cell that says “compliant”.
Emergency preparedness and response. Clause 8.2 requires you to establish, implement and maintain processes for potential emergency situations — and to test the planned response periodically. An untested spill or containment plan is a finding on its own.
Objectives with real measurement. Clause 9.6.2.2(d) asks whether the system is effective at achieving your objectives and intended results. Objectives expressed as intentions rather than measurable quantities make that question unanswerable, which the auditor will record.
Control over externally provided processes. The 2026 edition widens operational control here. Waste contractors, hauliers and outsourced maintenance are part of your system’s boundary; evidence of control means contract terms, competence checks and verification, not a copy of a supplier’s own certificate.
Running your own internal audit against these areas before the ISO 14001 surveillance audit is the cheapest way to pass it. Our ISO 14001 internal audit checklist works clause by clause from 4 to 10, and the same evidence supports item (a) on the surveillance agenda.
ISO/IEC 17021-1 does not set a single closure deadline for findings raised at surveillance the way it does for recertification, where clause 9.6.3.2.2 requires major nonconformities to be corrected before the certificate expires. Your certification body’s own procedure sets the surveillance timescales, so the number you have to work to is in your contract — typically a short window for a major finding’s action plan and a longer one for verified closure. Get it in writing rather than assuming.
What the standard does set out precisely is what happens when things go wrong. Clause 9.6.5.2 requires the certification body to suspend certification where, for example, the client failed to meet certification requirements, the client “does not allow surveillance or recertification audits to be conducted at the required frequencies”, or the client has voluntarily asked for a suspension. Note the middle one: repeatedly postponing an ISO 14001 surveillance audit is itself grounds for suspension, independent of how good your system is.
Under suspension, clause 9.6.5.3 makes the certification “temporarily invalid” — you may not present yourself as certified. Clause 9.6.5.4 requires the certification body to restore it once the underlying issue is resolved, and failure to resolve results in withdrawal or a reduction of scope; the note states that in most cases suspension “would not exceed six months”. Clause 9.6.5.5 allows the scope to be cut to exclude the parts that do not meet the requirements, which is how a multi-site certificate loses a site rather than everything.
If you disagree with a finding raised at an ISO 14001 surveillance audit, clause 9.7 requires every certification body to operate a documented appeals process, decided by people other than those who carried out the audit and made the certification decision, with no discriminatory action against you for appealing.
If your documented system is the weak point rather than your practices, the ISO 14001 Toolkit is a 65+ template document set already written to the 2026 edition — registers, the compliance obligations evaluation, emergency preparedness procedures, internal audit and management review packs — which covers most of the evidence the eight review areas ask for. It is $99 and downloads immediately.
Not entirely. An ISO 14001 surveillance audit has an irreducible on-site component: clause 9.6.2.1.2 requires surveillance activities to include on-site auditing. Parts of the work can use information and communication technology under IAF MD 4 (Global ACI TECH-3-003), and the 2026 transition audit specifically may be run remotely if the certification body can demonstrate its objectives were met, but the surveillance audit itself is an on-site audit under clause 9.6.2.2.
Clause 9.6.5.2 lists not allowing surveillance audits at the required frequencies as a ground for suspension, and suspension makes the certification temporarily invalid under 9.6.5.3. If the issue is not resolved, 9.6.5.4 leads to withdrawal or a reduction of scope. Reschedule inside the calendar year rather than letting the date pass.
On audit time, IAF MD 5 clause 5 puts annual surveillance at about one third of the stage 1 plus stage 2 initial audit time, with a practical floor of one audit day. Fees also carry annual certificate maintenance charges and travel, which are not audit days. Our ISO 14001 certification cost breakdown separates the two.
No. Clause 9.6.2.2 states surveillance audits are on-site audits “but are not necessarily full system audits”. They must cover the eight listed review areas; beyond that the certification body samples. Across a full cycle the whole system should be covered, so areas skipped this year are likely to be looked at next year or at recertification.
No, but it is the usual route. TECH-3-TR allows the transition audit to be conducted with your ISO 14001 surveillance audit, with your recertification audit, or as a separate special audit. The deadline is the same either way: certifications to ISO 14001:2015 are no longer valid after 30 April 2029.
Yes. Combining an ISO 14001 surveillance audit with the ISO 9001 one is normal practice and MD 5 covers quality, environmental and occupational health and safety audit time in one document. The audit time is not simply added: MD 5 allows for the overlap, but the environmental complexity category still drives the EMS portion. See our ISO 9001 surveillance audit guide for the quality side, and note that ISO 9001:2026 runs on a separate transition clock ending 30 September 2029.
An ISO 14001 surveillance audit is an on-site, sampled audit in years one and two of the cycle, due within 12 months of the certification decision and at least once a calendar year after that, running at roughly a third of your initial audit time with the environmental complexity of your sector driving the baseline. It must review eight specified areas, and in 2026 and 2027 it is also where most organisations will meet ISO 14001:2026. Decide the transition early, ask for the time calculation in writing, and treat the eight review areas as the agenda rather than waiting to be surprised by them.
For the wider picture, start with our guide to ISO 14001 environmental management.
Primary sources: Global ACI-TECH-3-TR 2029-04-30 (M), Transition Requirements for ISO 14001:2026 and IAF MD 5:2023, Determination of Audit Time.
November 3, 2026
November 2, 2026
November 1, 2026
October 31, 2026
October 31, 2026