ISO 14001:2015 Checklist and Gap Analysis, Clauses 4-10

A gap analysis is the cheapest way to find out how far you really are from certification. I have seen organizations spend months writing procedures for things the standard never asked for, while skipping the three or four requirements an auditor will go straight to. This guide walks through ISO 14001:2015 clauses 4 to 10 in order, gives you a checklist for each, and shows how to score what you find so the gap analysis turns into a plan instead of a pile of notes.

If you need the basics first, start with what ISO 14001 is. If you already know the standard and want to get moving, read on.

What Is an ISO 14001 Gap Analysis?

A gap analysis compares what your organization does today against each requirement in ISO 14001:2015 and records the difference. The output is a list of requirements that are met, partly met, or not met, each with evidence and an owner.

Clauses 1 to 3 (scope, normative references, terms and definitions) contain no auditable requirements. The auditable requirements sit in clauses 4 to 10, which follow the high-level structure shared by ISO management system standards, so if you already run ISO 9001 or ISO 45001 you will recognize the layout. That overlap is also why a combined gap analysis is worth considering; see integrated management systems for ISO 14001, 9001 and 45001.

How to Score Each Requirement

I use a simple four-level scale. Keep it simple, because a scale with seven levels just creates arguments.

Anything scored 0 or 1 goes on the action plan. Anything scored 2 needs a decision: close it now, or schedule it. Stage 1 is a readiness review of your documentation and preparedness, not a pass/fail test on scored gaps, but the auditor will expect you to know where your gaps are and have a plan to close them before Stage 2. Treat any open gap as something you may have to explain.

To reuse the scale, copy the table into a spreadsheet and add a row for each checklist item with columns for score, evidence, owner and due date.

Clause 4: Context of the Organization

Clause 4 is where many first-timers write too much and still miss the point. The standard wants you to understand what shapes your environmental management system, not to produce a 40-page strategy document.

Checklist

• 4.1 Understanding the organization and its context. Have you identified external and internal issues relevant to your purpose that affect the intended outcomes of the EMS? The standard explicitly includes environmental conditions capable of affecting, or being affected by, the organization (climate, air quality, water availability, biodiversity).
• 4.2 Needs and expectations of interested parties. Have you identified interested parties (regulators, neighbors, customers, lenders, employees) and decided which of their needs and expectations become compliance obligations?
• 4.3 Scope. Is the scope written down, available to interested parties, and tied to your activities, products and services, boundaries and applicability? You cannot exclude something just to avoid it if it can affect your environmental performance.
• 4.4 Environmental management system. Do you have the processes needed, and their interactions, to establish, implement, maintain and continually improve the EMS?

Common gaps. A scope statement that lists a site address but not the activities. Interested parties listed without any note on which expectations the organization has chosen to adopt. A context register written once and never revisited at management review.

Evidence to show. The written scope, the issues and interested-party register with its review history, and the EMS process map or equivalent.

Clause 5: Leadership

Checklist

• 5.1 Leadership and commitment. Can top management show, not just state, that the policy and objectives fit the strategic direction, that EMS requirements are integrated into business processes, and that resources are available? Top management must also take accountability for EMS effectiveness (the 2015 edition shifted this away from a delegated "management representative").
• 5.2 Environmental policy. Does the policy include commitments to protect the environment (including prevention of pollution), to fulfil compliance obligations, and to continual improvement? Is it documented, communicated within the organization, and available to interested parties?
• 5.3 Roles, responsibilities and authorities. Are they assigned and communicated, including who reports EMS performance to top management?

Common gaps. A policy that was copied from a template and nobody can explain. Responsibilities assigned in a document but not understood by the people named. Leadership evidence that consists of a signature and nothing else.

Evidence to show. The signed and communicated policy, assigned roles, and management review minutes showing resources and accountability decisions.

Tip: the hallway test. The quickest test for clause 5 is to ask the plant manager, in the hallway, what the two or three most significant environmental aspects of the site are. If the answer is a pause, you have found your gap.

Clause 6: Planning

Clause 6 is where the gap analysis usually finds the most work.

6.1.1 to 6.1.4: Actions to Address Risks and Opportunities

Checklist

• 6.1.1 General. Have you determined the risks and opportunities related to your environmental aspects, compliance obligations, and the context issues and interested-party needs from clauses 4.1 and 4.2? Have you planned actions and how to evaluate their effectiveness?
• 6.1.2 Environmental aspects. Do you identify aspects of your activities, products and services that you can control and those you can influence, from a life cycle perspective? Do you have criteria to determine which are significant, and do you consider abnormal operating conditions and reasonably foreseeable emergency situations?
• 6.1.3 Compliance obligations. Have you determined and have access to the legal and other requirements that apply to your aspects, determined how they apply, and taken them into account in the EMS?
• 6.1.4 Planning action. Have you planned actions to address significant aspects, compliance obligations and the risks and opportunities, and decided how to integrate them into EMS processes?

Clause 6.1.2 requires that you communicate significant aspects among the various levels and functions, and that you keep documented information on aspects, criteria and significant aspects. The register is what auditors ask for first. For a build-and-maintain walkthrough, see how to build an environmental aspects register under clause 6.1.2. The life cycle expectation is often misread as a demand for a full life cycle assessment, which it is not.

Common gaps. An aspects register that only covers normal operations and ignores abnormal and emergency conditions. Significance criteria that no one can reproduce, so the "significant" list is really just opinion. Legal requirements tracked in a spreadsheet that has no owner and no review date. Risks and opportunities that appear in a generic SWOT and never connect to the aspects.

Evidence to show. The aspects register with significance criteria, the compliance obligations register with owners and review dates, and records of risks and opportunities linked to actions.

6.2.1 and 6.2.2: Environmental Objectives and Planning to Achieve Them

Checklist

• 6.2.1 Environmental objectives. Are objectives consistent with the policy, measurable if practicable, monitored, communicated and updated as appropriate?
• 6.2.1 Environmental objectives. Do objectives take account of significant aspects, compliance obligations and risks and opportunities?
• 6.2.2 Planning actions to achieve objectives. For each objective, have you determined what will be done, what resources are needed, who is responsible, when it will be completed, and how results will be evaluated, including the indicators for monitoring progress?
• 6.2.2 Planning actions to achieve objectives. Can you show how actions toward objectives could be integrated into business processes?

Common gaps. Objectives such as "reduce waste" with no baseline or indicator. Objectives that duplicate production targets and have no environmental link. No owner or date on the action plan.

Evidence to show. Objectives with indicators, and action plans with owners, resources, dates and progress records.

Clause 7: Support

Checklist

• 7.1 Resources. Have you determined and provided the resources (people, infrastructure, financial, technology) needed for the EMS?
• 7.2 Competence. Have you determined the competence required for people whose work affects environmental performance or compliance obligations, ensured they are competent on the basis of education, training or experience, and kept evidence?
• 7.3 Awareness. Are workers aware of the policy, the significant aspects relevant to their work, their contribution to EMS effectiveness, and the implications of not conforming?
• 7.4 Communication. Do you have processes for internal and external communication, including what, when, with whom and how? Does it take compliance obligations into account, and do you keep evidence of communications as appropriate?
• 7.5 Documented information. Do you have the documented information the standard requires, plus what you decided is necessary for effectiveness? Is it identified, controlled for distribution, access, retrieval, storage, change and retention?

Common gaps. Training records that show attendance but no check of competence. Awareness that stops at the induction slide deck. No documented process for who may speak to regulators or the press. Document control that applies to procedures but not to externally originated documents such as permits.

Evidence to show. Competence and training records, awareness records, a communication procedure or matrix, and a controlled document register.

A practical note on documentation: ISO 14001:2015 does not list mandatory procedures; it requires documented information where individual clauses say so. The list below is partial: scope (4.3), policy (5.2), aspects, criteria and significant aspects (6.1.2), compliance obligations (6.1.3), objectives (6.2.1), evidence of competence (7.2), documented information needed to have confidence processes are carried out as planned (8.1, as needed), monitoring and measurement results (9.1.1), evidence of compliance evaluation (9.1.2), audit programme and results (9.2), management review results (9.3), and nonconformities, actions and results (10.2). Write what you need and stop.

Clause 8: Operation

Checklist

• 8.1 Operational planning and control. Have you established, implemented, controlled and maintained the processes needed to meet EMS requirements and the actions identified in clause 6? That includes:
  • Operating criteria for processes, and control in line with them.
  • Controls or influence over design and development of products and services, considering each life cycle stage.
  • Determining environmental requirements for procurement of products and services, and communicating them to external providers, including contractors.
  • Providing information about potential significant environmental impacts associated with transport, delivery, use, end-of-life treatment and final disposal.
  • Control of planned changes and review of unintended changes.
  • Control of outsourced processes.
• 8.2 Emergency preparedness and response. Have you identified potential emergency situations, planned a response, tested the response where practicable, reviewed and revised the process after tests or actual emergencies, and given relevant training to interested parties?

Common gaps. Operational controls that exist on the shop floor but are not tied to a significant aspect, so they never appear in the audit trail. Contractors who have never been told the site's environmental requirements. Emergency plans that were written but never drilled, or drilled with no record of what was learned. A management of change process that covers safety and quality but not environmental effects.

Evidence to show. Operating criteria and controls tied to significant aspects, contractor requirements issued, change records, and emergency test or incident records.

For more on emergency requirements, see the clause 8.2 requirements checklist, which lists the evidence an auditor will actually ask to see.

Clause 9: Performance Evaluation

Checklist

• 9.1.1 Monitoring, measurement, analysis and evaluation. Have you determined what needs to be monitored and measured, the methods, the criteria and indicators for evaluating performance, and when to monitor and analyze results? Is monitoring equipment calibrated or verified as appropriate, with records?
• 9.1.2 Evaluation of compliance. Have you determined the frequency of compliance evaluation, evaluated compliance, taken action if needed, and kept your knowledge and understanding of compliance status current? Is there documented evidence of results?
• 9.2 Internal audit. Is there an audit programme covering frequency, methods, responsibilities, planning requirements and reporting, taking into account the environmental importance of processes, changes affecting the organization and results of previous audits? Are auditors objective and impartial, and are results reported to relevant management?
• 9.3 Management review. Does top management review the EMS at planned intervals?
  • Inputs: status of actions from earlier reviews.
  • Inputs: changes in external and internal issues, compliance obligations, and risks and opportunities.
  • Inputs: the extent to which objectives are achieved.
  • Inputs: environmental performance information (nonconformities, monitoring results, compliance results, audit results).
  • Inputs: adequacy of resources, relevant communications, and opportunities for improvement.
  • Outputs: conclusions on suitability, adequacy and effectiveness.
  • Outputs: decisions on continual improvement and any need for change.
  • Outputs: resources, actions if objectives are not achieved, and implications for strategic direction.

Common gaps. Monitoring data collected but never compared against an indicator. A compliance evaluation that is really a reading of last year's permit list. An internal audit programme that audits only the documents, and never watches an operator doing the task. A management review that is a standing agenda item in another meeting, with no record of the required inputs and outputs.

Evidence to show. Monitoring records and calibration records, compliance evaluation results, the audit programme and reports, and management review minutes covering each required input and output.

A certification body will ask for your first full internal audit and management review before Stage 2. Use the clause-by-clause internal audit checklist to plan it. Auditors should not audit their own work, which is the usual reason small organizations bring in outside help for this one clause.

Clause 10: Improvement

Checklist

• 10.1 General. Have you determined opportunities for improvement and implemented the necessary actions to achieve the intended outcomes of the EMS?
• 10.2 Nonconformity and corrective action. When a nonconformity occurs, do you:
  • React, control and correct it, and deal with the consequences, including mitigating adverse environmental impacts?
  • Evaluate the need for action to eliminate the cause, and implement that action?
  • Review its effectiveness, and update risks and opportunities or the EMS if necessary?
  • Keep documented evidence of the nature of nonconformities, actions taken and results?
• 10.3 Continual improvement. Do you continually improve the suitability, adequacy and effectiveness of the EMS to enhance environmental performance?

Common gaps. Corrective actions that fix the symptom and close within a week with no root cause. No effectiveness review. A nonconformity log that contains only audit findings, while real incidents (a small spill, a missed permit date, a customer complaint about waste) are handled by email and never recorded.

Evidence to show. A nonconformity and corrective action log with root cause, action taken and effectiveness review for each entry.

Putting the Results Into a Plan

Once every requirement has a score, sort the gaps by what they hold up. Here is how I usually group them.

Then give every gap an owner, a date, and the evidence that will prove it closed. Revisit the scores monthly. A realistic timeline depends on size, complexity and how much already exists, and I would be wary of anyone who quotes a fixed number of months before they have seen your site. For budgeting, see what to budget for ISO 14001 certification.

Before You Call the Certification Body

Run through this final list. If you cannot say yes to each item, the gap analysis is not finished.

• The scope is written and matches what actually happens on site.
• The policy has been read and understood, and is documented, communicated and available (good practice: signed by top management, which the standard does not require).
• Aspects and significance criteria are documented, and significant aspects are linked to objectives and controls.
• Compliance obligations are listed with owners and review dates.
• Objectives have indicators, owners and dates.
• Contractors and suppliers have received environmental requirements.
• Emergency response has been tested where practicable, as 8.2 requires (good practice: drill each scenario at least once and record what was learned).
• Monitoring results are compared against indicators.
• One complete internal audit and one management review are on record.
• At least one nonconformity has been taken through root cause and effectiveness review.

The honest summary of a gap analysis is that the standard is shorter than most people expect, and the real work is showing that what you wrote is what you do. If you want a second pair of eyes on yours, the environmental certification help page explains how Certify Consulting supports organizations at this stage.

Last updated: 2026-10-05

Frequently Asked Questions

What is included in an ISO 14001:2015 gap analysis?

A gap analysis compares your current practices against every auditable requirement in clauses 4 to 10 of ISO 14001:2015 and scores each as not addressed, informal, partly met or met. The output is an action plan with owners, dates and the evidence needed to close each gap.

Which ISO 14001 clauses can be audited?

Clauses 4 through 10 contain the requirements an auditor assesses: context, leadership, planning, support, operation, performance evaluation and improvement. Clauses 1 to 3 cover scope, normative references and terms and definitions, and have no auditable requirements.

Does ISO 14001:2015 require documented procedures?

The standard requires documented information where specific clauses say so, such as scope (4.3), the environmental policy (5.2), aspects and significance criteria (6.1.2), compliance obligations (6.1.3), objectives (6.2.1) and competence evidence (7.2). Beyond that, you document what you decide is needed for the EMS to be effective.

Do I need an internal audit and management review before certification?

Yes, in practice. Clauses 9.2 and 9.3 are requirements of the standard, and certification bodies expect to see at least one complete internal audit cycle and a management review with the required inputs and outputs before the Stage 2 audit.

What is the most common gap in ISO 14001 implementation?

In my experience it is clause 6.1.2 and 6.1.3: significance criteria nobody can reproduce, abnormal and emergency conditions missing from the aspects register, and legal requirements with no owner or review date.