How to Audit Risks and Opportunities Under ISO 14001:2026

Why Risks and Opportunities Matter in an Environmental Audit

Auditing risks and opportunities under ISO 14001:2026 is one of the more demanding tasks an environmental auditor faces. The requirement sits across multiple clauses, the evidence is often scattered, and organisations frequently treat it as a documentation exercise rather than genuine planning. Your job is to find out whether the organisation actually uses its risk and opportunity assessment to drive decisions, or whether it exists purely to satisfy a certification requirement.

ISO 14001:2026 introduced a dedicated subclause for risks and opportunities at Clause 6.1.4, separating it from the general planning requirements that previously bundled everything together. This structural change matters for auditors because it creates a clearer audit trail. You can now follow the logic from context and interested parties, through aspects and impacts, compliance obligations, and emergency preparedness, to a coherent set of planned actions. If that thread breaks anywhere, you have a finding.

This article walks through how to audit risks and opportunities in a practical, evidence based way. It covers what the standard actually requires, where organisations commonly fall short, what questions to ask, and how to grade what you find.

Understanding What ISO 14001:2026 Actually Requires

Before you can audit something effectively, you need to understand what the requirement says. Clause 6.1.1 sets the general planning obligation: the organisation must determine the risks and opportunities that need to be addressed, taking into account the context established under Clause 4.1 and the needs and expectations of interested parties under Clause 4.2. The purpose is to ensure the EMS can achieve its intended outcomes, prevent or reduce undesired effects, and achieve continual improvement.

Clause 6.1.4, which is new in the 2026 edition, requires the organisation to determine risks and opportunities related to its environmental aspects, compliance obligations, and other issues and requirements. It also requires the organisation to plan actions to address those risks and opportunities, integrate those actions into the EMS processes, and evaluate the effectiveness of those actions.

The key word throughout is determine. The organisation must actively work through a process, not simply list generic risks from a template. As an auditor, your task is to verify that the determination was genuine, that the inputs were appropriate, and that the outputs actually influenced planning and operations.

For a deeper look at how the 2026 revision restructured the planning clauses, the article on ISO 14001:2026 transition requirements provides useful background before you start building your audit checklist.

Mapping Your Audit Approach Before You Start

A risks and opportunities audit is not a single clause audit. It touches Clause 4.1, Clause 4.2, Clause 6.1.1, Clause 6.1.2 (aspects and impacts), Clause 6.1.3 (compliance obligations), Clause 6.1.4, Clause 6.1.5 (planning actions), and Clause 9.1 (monitoring and measurement). You need to plan for this scope from the outset.

Start with document review before you go on site. Request the following:

• The context analysis and interested party register
• The environmental aspects and impacts register
• The risks and opportunities register or equivalent documented information
• The environmental objectives and plans to achieve them
• The compliance obligations register
• Any documented criteria for determining significance
• Evidence that actions have been integrated into operational processes
• Records of management review discussions about risks and opportunities

Review these documents before the on site phase. You are looking for logical consistency, not just completeness. Does the risk register reference the same context factors identified in Clause 4.1? Do the significant aspects feed into the risk assessment? Are compliance obligations treated as a source of risk? If the documents do not connect, that tells you something before you even arrive on site.

Auditing the Foundation: Context and Interested Parties

You cannot audit risks and opportunities in isolation. The standard is explicit that the determination must account for the context of the organisation and the needs and expectations of interested parties. So your first audit task is to verify that the foundation is solid.

Ask to see the context analysis. Probe whether it was developed thoughtfully or copied from a generic template. A manufacturing plant in regional Queensland should have a different context analysis to a logistics company operating across multiple states. If the document looks identical to what you have seen at a dozen other organisations, ask how it was developed and when it was last reviewed.

Then look at the interested party register. Under ISO 14001:2026, the identification of interested parties and their relevant needs and expectations feeds directly into the risk and opportunity determination. Check whether the register includes regulators, local communities, customers with environmental requirements, and workers. Ask how the organisation determines which needs and expectations are relevant to the EMS.

Common weakness at this stage: organisations list interested parties but do not connect their needs to any risk or opportunity. The register exists in isolation. That is an observation at minimum, and depending on severity, potentially a nonconformity under Clause 6.1.1.

Auditing the Risks and Opportunities Register

Once you have reviewed the foundation, move to the risks and opportunities register itself. This is where most of the audit time should be spent.

Is the Determination Methodology Documented?

The standard does not require a specific methodology, but the organisation must be able to demonstrate that a systematic process was used. Ask how risks and opportunities were identified. Was it a workshop? A review of the aspects register? A management review discussion? If nobody can explain the process, the determination is unlikely to be genuine.

Are the Inputs Appropriate?

Check that the register draws from the right sources. Risks and opportunities in an EMS context should consider:

• Significant environmental aspects and their potential impacts
• Legal and compliance obligations, including changes in legislation
• Climate related risks (which the 2026 edition explicitly flags as a consideration)
• Technology changes that could affect environmental performance
• Stakeholder expectations, particularly from regulators and customers
• Emergency scenarios identified under Clause 8.2
• Results of previous audits and incidents

If the register only lists generic operational risks and ignores environmental aspects or compliance obligations, that is a significant gap. The standard requires the determination to be grounded in environmental management, not general business risk management.

Are Opportunities Genuinely Identified?

This is where organisations most commonly fall short. Risks tend to get attention. Opportunities are often an afterthought, listed as a single generic entry such as opportunity to improve environmental performance through training. That is not a genuine opportunity assessment.

Opportunities under ISO 14001:2026 should include things like switching to renewable energy sources, redesigning a process to reduce waste at source, engaging with a supplier to improve the environmental performance of purchased materials, or taking advantage of new technology to reduce emissions. Ask the environmental manager to walk you through two or three opportunities and explain how they were identified and what action was taken. If they cannot, the opportunity assessment is cosmetic.

Auditing Clause 6.1.4: The New Subclause

Clause 6.1.4 is the structural change that distinguishes ISO 14001:2026 from the 2015 edition. It requires the organisation to determine risks and opportunities specifically related to environmental aspects, compliance obligations, and other issues and requirements identified in Clauses 4.1 and 4.2.

For auditors, this means you now have a specific clause to cite when the risk and opportunity assessment does not adequately address environmental aspects. Previously, the linkage was implied. Now it is explicit.

Check that the register specifically addresses risks arising from significant environmental aspects. For example, if the organisation has identified fuel combustion as a significant aspect, what are the associated risks? Regulatory non compliance if emissions exceed licensed limits? Reputational risk if a community complaint is raised? Increased costs if fuel prices rise and consumption is not managed? These should appear somewhere in the risk assessment.

Also check compliance obligations as a risk source. Changes in environmental legislation are a classic risk that organisations often fail to capture until after the fact. Ask how the organisation monitors for changes in legal requirements and how those changes feed into the risk assessment. If the answer is we check when we remember, that is a finding.

For context on how the 2026 edition restructured the planning clauses, including the new Clause 6.1.4, the article on Clause 6.1.4 risks and opportunities provides a detailed walkthrough of what changed and why.

Auditing the Link Between Risks and Planned Actions

Identifying risks and opportunities is only half the job. The standard requires the organisation to plan actions to address them and integrate those actions into EMS processes. This is where the audit gets interesting, because this is where paper based systems fall apart.

Pull out three or four significant risks from the register. For each one, ask:

1. What action was planned to address this risk?
2. Who is responsible for that action?
3. Has the action been implemented?
4. How is the effectiveness of the action evaluated?

Then go and verify. If the risk register says a particular risk is addressed by a specific operational control, go and check whether that control exists and is operating. If the action was to train workers on a specific environmental procedure, check the training records. If the action was to revise a work instruction, check whether the revision was done and whether workers are following it.

This triangulation between the risk register, planned actions, and operational evidence is the core of a competent risks and opportunities audit. Without it, you are just reviewing documents.

Common Nonconformities and What to Do With Them

After conducting dozens of ISO 14001 audits, here are the findings that come up most often in this area:

• Risk register not updated after a significant change. The organisation acquired a new facility or changed a process, but the risk assessment was not revisited. This is a failure of the planning process, not just a documentation gap.
• No evidence of opportunity assessment. The register lists risks but opportunities are absent or generic. Cite Clause 6.1.4 and ask for evidence of how opportunities were determined.
• Actions not integrated into EMS processes. The risk register says a risk is controlled by a procedure, but the procedure does not exist or has not been communicated to the relevant workers. This is often a major nonconformity because it means the planned action is not actually implemented.
• No evaluation of effectiveness. The organisation planned actions but has no mechanism to determine whether those actions worked. Check whether monitoring and measurement under Clause 9.1 captures data relevant to risk and opportunity actions.
• Climate change not considered. ISO 14001:2026 explicitly references climate change as a consideration. If the organisation has not considered climate related risks in any form, that is a gap that needs to be raised.

Grade your findings carefully. A risk register that exists but has minor gaps in opportunity identification is likely an observation or minor nonconformity. A risk register that was never connected to operational controls, or that has not been reviewed in three years, is more likely a major nonconformity because it undermines the integrity of the planning process.

Interview Questions That Get Useful Answers

Document review will only take you so far. The real test of whether the risk and opportunity process is genuine comes from conversations with people. Here are questions that tend to surface useful information:

• How did you identify the risks in this register? Walk me through the process.
• What opportunities have you identified in the last 12 months and what did you do with them?
• If environmental legislation changed tomorrow, how would you know and how would that feed into your risk assessment?
• Can you show me where this risk is controlled in your operational processes?
• When was the risk assessment last reviewed and what triggered that review?
• How do you know whether the actions you planned are actually working?

Ask these questions of both the environmental manager and operational personnel. The environmental manager should be able to explain the process. Operational workers should be aware of the controls that apply to their work. If the two accounts do not align, that gap is your finding.

Reporting Your Findings

When you write up your findings from this area, be specific about which clause is not met and what evidence supports your conclusion. Vague findings like risk assessment needs improvement are not useful. A well written finding identifies the clause, describes the objective evidence, and explains why it constitutes a nonconformity or observation.

For example: The risks and opportunities register, reviewed on site, does not include risks arising from the organisation's significant environmental aspects as required by Clause 6.1.4. The aspects and impacts register identifies fuel combustion and chemical storage as significant, but neither appears in the risk assessment. No evidence was provided that planned actions address these aspects from a risk perspective.

That finding is specific, evidence based, and actionable. The auditee knows exactly what needs to be addressed.

If you want to sharpen your skills in this area, Audit Workshop offers ISO 14001 internal auditor and lead auditor training that covers the 2026 edition requirements in detail, including practical exercises on auditing Clause 6 planning requirements. The courses are built around real audit scenarios, not just clause reading. You can explore the options at ISO 14001 internal auditor training.