ISO 14001 Clause 8.2: Emergency Preparedness Checklist

Every ISO 14001 audit I've sat through eventually lands on clause 8.2, and it's usually where the wheels come off. Organizations build a solid environmental aspects register under clause 6.1.2, write reasonable objectives under clause 6.2, and then treat emergency preparedness as an afterthought bolted onto the fire evacuation plan HR already had on the wall. Clause 8.2 asks for something more specific: a set of processes, built directly off the emergency situations identified in clause 6.1.1, that get planned, tested, reviewed, and taught to the people who might actually have to use them. This guide breaks the clause down sub-clause by sub-clause and gives you a checklist to run against your own system before an auditor runs it for you.

What ISO 14001:2015 Clause 8.2 Actually Requires

Clause 8.2, "Emergency preparedness and response," sits inside Clause 8, "Operation," right after clause 8.1, "Operational planning and control." The clause opens with a single requirement: establish, implement, and maintain the processes needed to prepare for and respond to the potential emergency situations identified in clause 6.1.1. Everything else in 8.2 breaks that requirement into six specific actions. The organization has to:

• Prepare to respond, by planning actions that prevent or mitigate adverse environmental impacts from emergency situations
• Respond to actual emergency situations when they occur
• Take action to prevent or mitigate the consequences of an emergency, scaled to its magnitude and potential environmental impact
• Periodically test the planned response actions, where practicable
• Periodically review and revise the process and the planned response actions, particularly after a test or after an actual emergency occurs
• Provide relevant information and training on emergency preparedness and response, as appropriate, to relevant interested parties, including persons working under the organization's control

ISO 14001:2015 clause 8.2 does not name a testing interval. It requires that planned response actions be tested periodically, where practicable, and revised after every test or actual emergency, which means the standard leaves the frequency to your judgment while still holding you accountable for having one. Annex A.8.2, the standard's informative guidance section, gives examples of what counts as an emergency situation worth planning for: fire, spillage of hazardous substances, adverse weather events, and situations that could not reasonably have been foreseen. The annex also expects organizations to consider emergencies that could arise during abnormal operating conditions, not just during a normal production day.

Where the Requirement Comes From: The Line Between 6.1.1 and 8.2

Clause 8.2 doesn't operate in isolation. It's the operational answer to the risk work your team already did under clause 6.1.1, "General," part of "6.1 Actions to address risks and opportunities." That clause requires you to determine the risks and opportunities tied to your environmental aspects, your compliance obligations, and the other issues identified under clause 4.1, including potential emergency situations. If your environmental aspects register doesn't flag the tank farm, the paint booth, or the on-site propane storage as a potential emergency source, clause 8.2 has nothing to build from.

I've seen certification bodies write nonconformities against 8.2 that were really nonconformities against 6.1.2, because the aspects register was too thin to surface the scenario in the first place. The fix isn't a better emergency procedure. It's a more thorough aspects register that actually names what could go wrong on site, so 8.2 has real material to respond to. If your register hasn't been revisited since your last surveillance audit, that's the place to start, not the emergency binder.

Clause 8.2 Compared: ISO 14001 vs. ISO 45001 vs. OSHA's Emergency Action Plan Rule

Because so many sites run ISO 14001 alongside ISO 45001 and U.S. OSHA obligations, it helps to see where these three "emergency" requirements actually overlap and where they diverge. They are not the same document wearing three names.

Same clause number, same title, genuinely different subject matter. A site that runs an integrated management system can usually satisfy all three with one coordinated drill program, but only if the environmental consequence angle, soil, water, and air impact, gets written into the procedure explicitly. A plan that was drafted purely for evacuation and injury prevention will walk right past the environmental release it should have flagged.

Building an Emergency Preparedness and Response Procedure: Step by Step

1. Pull every potential emergency scenario out of the aspects register and the 6.1.1 risk assessment. Don't limit the list to what's already covered by an existing safety plan.
2. Rank scenarios by likelihood and potential environmental consequence, not just personnel risk. A slow leak from an underground line can rank higher environmentally than a dramatic but well-contained event.
3. Write a response procedure for each scenario type: fire, chemical or fuel spill, uncontrolled air emission, tank overfill, severe weather, loss of power to pollution control equipment, and a breach at a waste storage area.
4. Name the roles. Who declares the emergency, who calls the fire department or the National Response Center, who notifies the state environmental agency, and who documents what happened.
5. Post current emergency contacts, notification thresholds, and shutdown steps where the people who'd use them can find them during an event, not filed away in the management system binder.
6. Train relevant interested parties, including contractors and temporary staff, the language in clause 8.2(f). If a contractor operates your wastewater pretreatment system, they're a person working under your control whether or not they're on your payroll.
7. Test the plan. Tabletop exercises are reasonable for lower-risk scenarios; higher-risk scenarios, like a chemical release or a major spill, warrant a physical drill.
8. Review and revise after every test and every real event, and document what changed and why the change was made.

What "Periodically" Actually Means in Practice

The standard's refusal to name a testing interval frustrates a lot of clients I work with, but there's a practical workaround: borrow the cadence from the regulations you're already following. The SPCC rule, 40 CFR 112.7(f)(3), requires facility owners to schedule spill prevention briefings for oil-handling personnel at least once a year, and that annual rhythm is a reasonable backbone for an ISO 14001 testing schedule even at sites that aren't SPCC-regulated. Two thresholds matter here, and they're independent of each other. Facilities with more than 1,320 U.S. gallons of aboveground oil storage capacity fall under SPCC by rule (40 CFR 112.1(d)(2)). Separately, facilities holding regulated substances above the thresholds listed in 40 CFR 68.130 fall under the EPA's Risk Management Program, which layers its own emergency response coordination requirements on top under 40 CFR Part 68, Subpart E. If any of those thresholds apply to your site, align your ISO 14001 testing calendar with the regulatory one instead of running two separate schedules.

Common Nonconformities Auditors Write Against Clause 8.2

• No test or drill records for the current certification cycle
• An emergency contact list that references a phone number or a role that no longer exists
• Training records that leave out contractors or night-shift and temporary staff
• A procedure that covers fire and injury response only, lifted wholesale from an existing OSHA plan, with no environmental consequence content: no secondary containment failure, no uncontrolled discharge to a storm drain, no groundwater impact scenario
• No evidence of review after an actual spill, false alarm, or drill, which clause 8.2(e) calls out specifically
• A mismatch between the aspects register and the emergency procedure, where scenarios named in 6.1.2 never made it into 8.2

An emergency plan that only lives in a binder isn't a process. Clause 8.2 is written as a list of verbs: prepare, respond, act, test, review, train. An auditor is going to ask you to show evidence for each one, not just the one page you photocopied from an old OSHA plan.

ISO 14001 Clause 8.2 Compliance Checklist

Prepare (8.2 a)

• Emergency scenarios identified in 6.1.1 and the aspects register are cross-referenced in the emergency procedure
• Response actions are written for each scenario type, focused on preventing or reducing environmental impact
• Roles and responsibilities are assigned by name or position, with backups identified

Respond (8.2 b, c)

• Response steps are scaled to realistic scenario severity, not only the worst case
• Notification thresholds and agency contacts are documented and current
• Secondary containment, spill kits, and shutoff locations match what's described in the procedure

Test (8.2 d)

• At least one drill or tabletop exercise has been conducted since the last review cycle
• Higher-risk scenarios have been physically tested, not just discussed
• Test records are retained as documented information

Review (8.2 e)

• The procedure was reviewed and updated after every drill
• The procedure was reviewed and updated after every actual emergency
• Changes to site operations, a new chemical, a new tank, a new process, trigger a documented review

Train (8.2 f)

• Training records cover employees, contractors, and temporary staff working under the organization's control
• Training content matches the current revision of the procedure
• Relevant interested parties, such as neighboring facilities or the local fire department, are informed where appropriate

Document (supported by clause 8.1)

• Documented information is retained to demonstrate the process is carried out as planned
• Records show who reviewed the emergency procedure, when, and what changed as a result
• Version history ties the current procedure to the test or actual-emergency record that prompted its last revision

For the tactical side of this, how to actually structure a spill response or a fire response procedure so it holds up in the field, our deeper walkthrough on spill response and fire procedures covers the scenario-by-scenario detail this article doesn't have room for.

Frequently Asked Questions

Does ISO 14001 require a written emergency response plan? Clause 8.2 doesn't use the words "written plan" and doesn't mandate a specific format. It requires documented information "to the extent necessary to have confidence that the process is carried out as planned," under the operational planning and control requirements in clause 8.1. In practice, that means most organizations keep a written procedure, because it's hard to demonstrate a consistent process to an auditor any other way.

How often does ISO 14001 clause 8.2 require emergency drills? The standard says response actions must be tested "periodically, where practicable" without naming an interval. Many organizations align testing with a regulatory cycle they already run, such as the annual spill prevention briefing required for oil-handling personnel under 40 CFR 112.7(f)(3), and layer environmental scenarios onto that existing schedule.

What's the difference between ISO 14001 clause 8.2 and ISO 45001 clause 8.2? Same clause number, same title, "Emergency preparedness and response," different subject. ISO 14001's version scopes emergencies to adverse environmental impact and draws its scenario list from clause 6.1.1. ISO 45001's version scopes emergencies to worker health and safety and draws its scenario list from hazard identification under that standard's clause 6.1.2. Organizations running both usually build one integrated procedure and tag which requirement each drill satisfies.

Who counts as a "person working under the organization's control" for clause 8.2 training? The phrase covers anyone doing work that affects the organization's environmental performance under its direction, whether or not they're a direct employee. Contractors operating wastewater treatment equipment, temporary staff handling chemicals, and on-site vendors typically qualify, and auditors look for their names in the training records, not just full-time staff.

What do auditors look for during a clause 8.2 audit? Evidence for each of the six actions in the clause: a documented process that identifies emergency scenarios, defined response actions, at least one completed test or drill, a review conducted after a test or a real event, and training records for the people who would carry out the response, contractors included.

If your clause 8.2 procedure hasn't been stress-tested since it was written, that's worth fixing before your next surveillance audit rather than after a finding forces the issue. Our team walks through exactly this kind of gap analysis on the environmental certification help page, if you want a second set of eyes on where your emergency plan and your aspects register don't yet line up.

Last updated: 2026-09-21