< All blogs

How to implement ISO14001

Posted on January 6th, 2025 | Written by Ken Holmes.

The focus is shifting on how we conduct business in a cleaner and more environmentally friendly way, whilst still delivering high quality products and services. ISO14001:2015 Environmental Management System (EMS) was written to help guide businesses to become more environmentally aware, to understand their responsibilities and reduce their impact.

ISO14001 is written with the same structure (Annex SL) as many of the other ISO business management systems, so if you are familiar with 9001 Quality, 27001 Information Security or 45001 Occupational Health and Safety, then many of the steps for implementation are very similar.

Here we look at the 15 key steps for how to implement ISO14001 – an environmental management system into an organisation.

 

1. Management buy-in

Let’s get started.  First and foremost, it is important to get senior management buy-in. Without this, when you start asking for resources, such as time from other duties, they may be declined or deferred. Without it, the project can’t go ahead.

2. Gap assessment

With management buy-in sorted, it is time to find out exactly where you are environmentally with regards to the requirements of the ISO standard. So, you need a copy of the standard. You can purchase this directly from the ISO website, or CertiKit’s Enhanced Gap Assessment is another good alternative.  Once you have it, you can review the mandatory and recommended requirements of the standard. 

Now you know what you have to have in place for a successful certification, you need to see what you have, but more importantly, what you haven’t got.  This is done by conducting a Gap Assessment against the requirements of the standard.

This is an important step, as it will allow you to develop a project plan that you will follow to ensure all requirements are in place prior to certification.

3. Interested parties

One of the first things to establish is who are your ‘Interested Parties’.  These are entities, i.e. people, organisations, regulatory bodies, your staff, etc.  But the main thing is they can have an influence upon your EMS, or have a requirement that you must adhere to for environmental purposes.  You need to identify them, their requirements and what you are going to do to meet those requirements.  This list of interested parties will be required when we come to clause 6 of the standard as there is a very close link to it.

4. Scope of your EMS

Here you will identify the areas of the business that will be covered by the EMS. This will depend upon what you actually do, if you are a manufacturer, you may be looking just at your factory, if you a consultancy you may be looking at office practices, where you get your office supplies from, use of lights etc.

5. Roles and responsibilities

You will need to identify roles, and the responsibilities and authority invested within those roles. These could be new roles, or additional duties on existing staff. If you are going to use existing staff, then you will have to identify their competency for the role and maybe identify additional training courses to prepare them for their part in the EMS.

6. EMS Policy and Objectives

During this period, an Environmental Policy should be developed along with Environmental Objectives and potential Environmental Programmes. As the EMS develops, these will need to be revisited and tweaked until senior management have signed them off. This needs to be done before certification.

7. Mapping processes and procedures

Now comes the backbone of the EMS, defining the processes and procedures associated with it. There are a number of mandatory requirements by the standard, however you should also look at your own business to define or refine existing processes and procedures that would be beneficial to your EMS.

8. Documented Information

There is a requirement that all documented information, this includes forms, minutes of meetings etc., are properly referenced. So there is a need for a clear document control procedure, along with a guide to the reference numbering protocol.

This is going to take some time, as each process or procedure is documented, it is worth at this stage checking that they work. It will save time later prior to doing internal audits. You could use our ISO14001 Document Toolkit to ensure you have all the documents you need.

9. Staff awareness program

During this period, it is good to begin a series of awareness presentations to all staff. This is important for a number of reasons. Most people don’t like change so if they know what is going on it will make change easier. Another reason is they need to know what their contribution is going to be to the EMS. This is a great way to getting their support and ideas!

10. Risks and opportunities

We mentioned earlier about Interested Parties and said we would be seeing them again. There is requirement to have a process or processes, to meet the requirements as identified with your interested parties, as well as any other issues identified in the business and with implementing the scope of the EMS.  These should address both risks and opportunities associated with those needs.  Some of those needs may not have opportunities, but you can be sure there is a risk associated with each one.  Remember these are environmentally orientated risks and opportunities.

11. Evidence for certification

To be successful in your certification you must provide evidence that you are doing what you say you are doing in your policies, processes, procedures and meeting outcomes etc.  So records must be kept.  These can be documents stored electronically as long as they meet the requirements of your documentation procedure.

12. Internal Audits

The next stage of the implementation is to run and monitor the EMS.  To effectively monitor it you need to do regular checks, and this is done by Internal Audits.  You can complete this either by having at least two of your staff trained as internal auditors or you can an outsource to a professional internal auditor. 

There are pros and cons to both, as a business you need to decide which is the most cost efficient to you.  The initial audits should look to cover all aspects of the EMS prior to the certification audit.  This will help to iron out any teething problems and put in place action plans to correct them.  Once these are done the next thing to do is a Management Review Meeting (MRM).

13. Management Review Meeting

This is where the senior management review the EMS as a whole. It is an important event and a requirement of the standard. The first Management Review Meeting may be a bit lengthy as there is a lot to cover, but over time, the format will develop and could be part of your annual business review.

14. Pre-certification preparation

When you are happy with your EMS it is time to look for a Registered Certification Body (RCB). There are a lot around, so do some research. Some may specialise in your business sector, so maybe look at those. Prices may vary as well so get quotes from a number of them.

15. Certification

Then when you have decided on your RCB contact them and they will explain the process of the two-stage certification audit, the relevance of the two stages and the estimated amount of time to conduct the audit. The time will vary per organisations as it’s dependent on a number of factors, such as size, scope and sites.

It can be at times a frustrating journey, but one that returns your investment in your hard work and tenacity.  Implementing an Environmental Management System not only benefits your business often with reduced costs and streamlined processes, but it’s rewarding knowing you’re having a positive impact on the planet too.

Written by

Ken Holmes

Ken Holmes

Managing Director

CertiKit’s Managing Director and Lead Toolkit Creator. Ken is a CISSP-qualified security and data protection specialist who also holds the internationally-recognised Certified Information Privacy Professional – Europe (CIPP/E).

Tags:

we can help

How can CertiKit help with your compliance?

CertiKit provides a variety of solutions, including Compliance Toolkits, ISO services, and a Cyber Awareness Training Platform, designed to help you meet your compliance requirements with ease.

Our toolkits feature a comprehensive collection of expertly created, user-friendly templates and guides, along with a perpetual license that includes ongoing updates and expert support—ensuring you have assistance whenever you need it.

More updates & news

View all news