ISO 14001 · Step-by-step series · Article 6 of 7

ISO 14001 Clause 9: Monitoring, Internal Audit and Management Review

Clause 9 of ISO 14001:2015 is where an environmental management system proves it actually works. Everything planned in clauses 4 to 8 — environmental aspects, compliance obligations, objectives, operational controls — only has value if the organization measures whether it is delivering the intended environmental performance. Clause 9 groups three closely linked activities: monitoring, measurement, analysis and evaluation of environmental performance (9.1.1); evaluation of compliance with legal and other requirements (9.1.2); the internal audit programme (9.2); and management review (9.3). This guide walks through each requirement with practical detail on how to implement it without turning it into a paperwork exercise.

Structure of clause 9: three pillars of evaluation

Clause 9 is organized into three main subclauses, each answering a different question about how well the EMS is performing:

• 9.1 Monitoring, measurement, analysis and evaluation: is the organization tracking the environmental aspects and indicators that matter, and is it legally compliant?
• 9.2 Internal audit: is the EMS itself conforming to the organization's own requirements and to ISO 14001, and is it effectively implemented and maintained?
• 9.3 Management review: is top management satisfied, based on the evidence gathered above, that the EMS remains suitable, adequate and effective, and what needs to change?

9.1.1 Monitoring and measurement of environmental performance

Clause 9.1.1 requires the organization to determine what needs to be monitored and measured, the methods to be used to ensure valid results, the criteria against which performance will be evaluated and appropriate indicators, when monitoring and measurement will be performed, and when the results will be analysed and evaluated. This is not limited to regulatory parameters — it should cover the significant environmental aspects identified in clause 6.1.2 and progress against the environmental objectives set in clause 6.2.

In practice, the monitoring plan for a manufacturing site typically combines several types of data:

• Resource consumption indicators: electricity, water, natural gas or fuel per unit produced, tracked monthly against a baseline.
• Waste generation indicators: hazardous and non-hazardous waste volumes, recycling rate, waste sent to landfill.
• Emission and discharge measurements: stack emissions, wastewater parameters, noise levels, where these are subject to permit conditions or internal targets.
• Objective-specific indicators: the specific metrics tied to the environmental objectives defined under clause 6.2, such as percentage reduction in single-use plastic packaging or number of suppliers audited on environmental criteria.

Clause 9.1.1 also requires the organization to ensure that calibrated or verified monitoring and measurement equipment is used and maintained, and to retain documented information as evidence of the results. If a flow meter used to report water consumption to a regulator has not been calibrated within its schedule, that is a direct nonconformity, because the validity of the reported data cannot be demonstrated.

9.1.2 Evaluation of compliance: proving you are legally compliant, not just aware of the law

Clause 9.1.2 is the natural continuation of clause 6.1.3, where the organization identified its compliance obligations. Having a register of applicable legal and other requirements is not enough — ISO 14001 requires the organization to establish, implement and maintain a process to evaluate fulfilment of those compliance obligations, at a defined frequency, and to take action if needed when a requirement has not been fulfilled. The organization must also maintain knowledge and understanding of its compliance status and retain documented information as evidence of the evaluation results.

A robust compliance evaluation process usually includes:

• A compliance obligations register cross-referenced to specific permit conditions, licence limits or legal clauses, not just the name of the regulation.
• A defined evaluation frequency for each obligation — some permit conditions require continuous monitoring, others an annual self-declaration.
• A documented evaluation record showing, for each obligation checked, whether it was met, partially met or not met, and who performed the check.
• A defined escalation path for any instance of non-compliance, including whether it must be reported to the relevant authority.

A common misunderstanding is treating the compliance evaluation as identical to the legal register review. They are different activities: the legal register review checks whether the organization has identified all applicable requirements (an input to clause 6.1.3), while the compliance evaluation under 9.1.2 checks whether each identified requirement is actually being met in practice, with supporting evidence such as measured emission values, permit renewal dates, or waste transfer documentation.

9.2 Internal audit: checking the system checks itself

Clause 9.2 requires internal audits at planned intervals to provide information on whether the EMS conforms to the organization's own requirements for its EMS and to the requirements of ISO 14001, and is effectively implemented and maintained. It is split into two parts: 9.2.1 sets the general requirement, and 9.2.2 details what the audit programme must contain.

Under 9.2.2, the organization must establish, implement and maintain one or more audit programmes including the frequency, methods, responsibilities, planning requirements and reporting of its internal audits. The programme must take into consideration the environmental importance of the processes concerned, changes affecting the organization, and the results of previous audits. Auditors must be selected and audits conducted to ensure objectivity and impartiality of the audit process — in practice, this means an auditor should not audit their own area of direct responsibility.

Results of internal audits must be reported to relevant management (9.2.2) and retained as documented information (9.2.2). These audit results are one of the mandatory inputs to management review under clause 9.3, so a poorly documented internal audit undermines the entire evaluation chain that follows.

9.3 Management review: the moment top management owns the results

Clause 9.3 requires top management to review the organization's EMS at planned intervals to ensure its continuing suitability, adequacy and effectiveness. This is not a formality delegated to the environmental manager alone — ISO 14001 explicitly places this responsibility with top management, consistent with the leadership commitment required under clause 5.1.

ISO 14001:2015 lists the inputs that the management review must consider, and a review missing any of these is incomplete:

• The status of actions from previous management reviews.
• Changes in external and internal issues relevant to the EMS, including changes in compliance obligations and changes in the needs and expectations of interested parties.
• The extent to which environmental objectives have been achieved.
• Information on the organization's environmental performance, including trends in nonconformities and corrective actions, monitoring and measurement results, fulfilment of compliance obligations, and audit results.
• Adequacy of resources.
• Relevant communication(s) from interested parties, including complaints.
• Opportunities for continual improvement.

The outputs of the management review must include conclusions on the continuing suitability, adequacy and effectiveness of the EMS, decisions related to continual improvement opportunities, and any need for changes to the EMS, including resources, actions if needed when environmental objectives have not been achieved, and opportunities to improve integration with other business processes. Top management must retain documented information as evidence of the results of management reviews.

How the three subclauses connect in practice

Most common audit findings in clause 9

Across certification and surveillance audits, the recurring weaknesses in clause 9 tend to fall into a small number of patterns:

• 9.1.1 — Indicators not linked to significant aspects: the organization tracks metrics that are easy to collect rather than the ones tied to its own significant environmental aspects register.
• 9.1.2 — Compliance evaluation confused with the legal register: the organization can show a list of applicable regulations but cannot show, per obligation, evidence that it is currently being met.
• 9.1.1 — Uncalibrated monitoring equipment: flow meters, gas analysers or scales used to generate reported environmental data are past their calibration due date.
• 9.2 — Audit programme not risk-based: every process is audited with the same frequency regardless of environmental significance, or the programme does not reflect changes such as a new process line or a new permit condition.
• 9.2 — Lack of auditor independence: an employee audits a process for which they are directly responsible, undermining objectivity.
• 9.3 — Missing mandatory inputs: management review minutes exist, but omit specific required inputs such as the status of previous action items or communications from interested parties, making the review incomplete against the clause.

Frequently asked questions about ISO 14001 clause 9

How often must ISO 14001 internal audits be carried out?

ISO 14001 does not fix a specific frequency; it requires audits at planned intervals that consider the environmental importance of the processes, changes affecting the organization, and results of previous audits. In practice, most certified organizations run a full-scope audit cycle over 12 months, often split into two or three audits covering different areas of the EMS, so the entire scope is audited at least once between each certification or surveillance visit.

What is the difference between evaluation of compliance (9.1.2) and internal audit (9.2)?

Evaluation of compliance under 9.1.2 checks whether the organization is meeting its specific legal and other requirements, such as permit limits or reporting deadlines. Internal audit under 9.2 checks whether the management system itself — its processes, documented information and controls — conforms to the organization's own requirements and to ISO 14001, and is effectively implemented. An internal audit may sample compliance evaluation records as evidence, but the two activities have different objectives and are usually run on different schedules.

Can the environmental manager conduct the management review alone under clause 9.3?

No. Clause 9.3 explicitly assigns the management review to top management. The environmental manager typically prepares the inputs — performance data, audit results, compliance status — but top management must review this information and make the decisions on suitability, adequacy, effectiveness and any changes needed. Auditors will ask for evidence, such as meeting minutes with attendance, that top management was actually present and engaged.

What documented information is mandatory under clause 9?

ISO 14001 explicitly requires retained documented information as evidence of: monitoring, measurement, analysis and evaluation results (9.1.1); compliance evaluation results (9.1.2); implementation of the audit programme and the audit results (9.2.2); and the results of management reviews (9.3). Organizations often also maintain the audit programme itself and individual audit plans as supporting documented information, even though the clause wording focuses on results and implementation evidence.

What happens if a compliance obligation is found not to be met?

Clause 9.1.2 requires the organization to take action if needed when it has not fulfilled its compliance obligations. This links directly to clause 10.2 on nonconformity and corrective action: the immediate gap must be addressed, the cause investigated, and corrective action taken to prevent recurrence. Depending on the nature of the requirement, this may also trigger a legal obligation to notify a regulator, which should be built into the escalation procedure rather than left to case-by-case judgment.

Does clause 9 require external verification of environmental data?

ISO 14001 clause 9 does not itself mandate third-party verification of environmental data; it requires the organization to ensure valid results through calibrated or verified monitoring and measurement equipment and sound methods. However, many sector-specific regulations or voluntary reporting schemes layered on top of ISO 14001 (such as emissions trading schemes or sustainability disclosure frameworks) do require independent verification, so the compliance obligations register under 9.1.2 should flag where this applies.

Expert ISO 14001 · Updated 2026-07-31 · ISO 14001 step-by-step series: Article 1 — Clause 4 · Article 2 — Clause 5 · Article 3 — Clause 6 · Article 4 — Clause 7 · Article 5 — Clause 8 · Article 7 — Clause 10