Introduction

ISO 14001 is the most popular environmental management system standard in the world. There are over 1.2 million facilities certified to this globally recognized standard. Many other organizations are using ISO 14001 as a model for their EMS but have not yet sought certification. The revision of ISO 14001 in April of 2026 offers an opportunity for organizations. Older legacy EMS should be to reviewed and updated periodically to better manage risk.

The ISO 14001:2026 update made no material changes to the basic requirements of the standard. The revision did, however, clarify some important requirements, especially in Clause 6 on Planning. The restructuring of this section helps organizations improve processes for environmental risk management. The restructuring also helps certification body and other auditors better understand what ISO intends for this clause of the standard.

Clause 6 is important because it determines what the environmental management system is going to manage (environmental aspects). Results of planning help everyone using the EMS understand what environmental risks are important to the organization. Planning also helps users of the EMS understand what actions the organization is taking to control environmental aspects and impacts.

Better Understanding of Environmental Aspect and Risk

Environmental aspects cause risk or environmental impact. Reducing risk of environmental impact is the primary outcome that an ISO 14001 EMS should achieve. Clause 6 on planning has been ambiguous about the relationship between risk(s), opportunities, aspects, impacts. This leavins it up to the organizations to interpret the requirements when planning the EMS.

This ambiguity has led to a wide variety of approaches to identifying environmental aspects and determining which are significant. Although these approaches technically meet the requirements of ISO 14001 they are marginally effective in controlling risk from aspects. The ISO 14001:2026 revision helps users gain a better understanding of environmental aspects, impacts, risks and opportunities.

ISO 14001 requires that organizations identify significant environmental aspects and to address risk and opportunity associated with these environmental aspects. However, the standard provides little guidance on why organizations need to identify some environmental aspects as significant. The standard is also unclear about what to do differently with significant aspects than with those that are not significant. This approach allows organizations flexibility to meet the requirement of this part of the ISO 14001 standard. However, this flexibility has led to a wide range of approaches to identifying significant environmental aspects, impacts, risks, and opportunities.

Clause 6 From an Auditors Perspective

Some conformant legacy EMS process identify only a few environmental aspects and only 1 that is significant. Others are complex Failure Mode Effects Analysis (FMEA) type methods. Some with 7 or more factors used to calculate a Risk Priority Number (RPN). Often the FMEA has an arbitrary RPN cutoff value that limits the number of significant aspects.

Although these approaches met the basic requirements of ISO 14001, they often did not help organizations identify what was important. If the planning part of the EMS is weak the rest of the management system suffers. This is because the rest of the EMS relies heavily on the output of clause 6 planning.

ISO 14001:2026 revisions in clause 6 used a three bucket concept. The standard reordered the sequent of clauses to focuses on environmental aspects as a priority (Bucket-1). Bucket 2 are compliance obligations and Bucket 3 are risk and opportunities. See Figure 1.

Figure 1 – Three Bucket Concept

The following example of cheese making illustrates one approach to identify environmental aspects, impacts, determine which are significant. The case study describes how organizations can determine actions needed to address environmental risk and opportunities. It also provides information on how the ISO 14001:2026 EMS planning supports other parts of the EMS including auditing.

Process Flow Diagrams Aid Aspect Identification

Most organizations have systematic processes that add value and help organizations generate revenue. Often these processes have environmental aspects and impacts. Mapping the process flow is the first step in identifying environmental aspects. In manufacturing, businesses use inputs, like raw materials and energy in a sequence of processes that change these raw materials into something with more value that the organization can sell to customers.

Developing a process flow diagram of the manufacturing process is a critical step in aspect identification. Figure 2 is an example of a cheese making process flow diagram.   Raw milk is one of the inputs into the process. The cheese making process changes milk into cheese through a sequence of steps. The result of the process in cheese ready for sale to customers.

Figure 2 – Cheese Manufacturing – Whey Environmental Aspect

Waste whey is an output of the curdling and molding processes. If mismanaged it can have a significant water pollution environmental impact. To avoid fines and damage to the company’s brand risk of noncompliance from mismanagement of waste whey should be addressed by the company

The cheese making process has many other environmental aspects that may be significant like the use of cleaning chemicals and potential emissions of pollutants into the air. The first step in the Clause 6 planning process is to create an inventory of environmental aspects.

Use a process flow diagram like the one in figure 1 to identify environmental aspects.   Include someone with knowledge of environmental impacts are for the cheese making process. Once you have an inventory you can begin to evaluate them for importance using risk assessment techniques.

Deciding What Is Important

ISO 14001 requires organization’s determine what environmental aspects are important (significant) and thereby need to be addressed.

“The organization shall determine those aspects that have or can have a significant environmental impact (i.e. significant environmental aspects) by using established criteria.”

Risk assessment should be used to determine which environmental aspects are important and need to be controlled or improved. However, risk assessment can be subjective and imprecise. There are many approaches to performing risk assessment. The key is to not make it overly complicated. Keep it simple.

Figure 3 is an example of a simple risk matrix you can use to estimate relative risk based on likelihood and severity.

Figure 3 – 5×5 Risk Analysis Matrix – CorrectTrack.com

Across the top of the matrix are values for the likelihood that an aspect will have an impact on the environment.  The likelihood values in the top row increase from left to right, not likely (Value of 1) to Very likely with a (value of 5).  The Severity values along the left side of the matrix are similar with Low (1) at the bottom and Very High (5) at the top.

Use the matrix to estimate risk. Start by assuming that there are no existing controls to manage the risk of environmental impact even if you do have exiting controls in place. Pick a value along the Severity axis that you think is reasonable (1-5). Then pick a value along the Likelihood axis that you think is reasonable using the 1-5 scale. Multiply these 2 values together to give the estimated risk value. A group is often better at estimating these values than one individual alone. Also include an environmental professional with some risk assessment experience to guide the risk assessment process.

Significant Environmental Aspects

When making cheese, enzymes are added to the milk to help the milk coagulate into cheeses curds.  The enzymes come in returnable containers, and the likelihood is low and severity of an impact from adding enzyme is low. The risk score is calculated by multiplying the likelihood times the severity which gives a risk value of 1 which is low and represented by the color green on the matrix.

The generation of waste whey from the milk curdling process is highly likely (5) on the matrix because it happens every day that cheese is being made. The impact of improper disposal of waste whey is either high (4) or very high also (5). The combined estimated risk is calculated to be either 15 or 25 (high or very high) color red. This uncontrolled risk score helps in prioritizing environmental aspects for risk control   Figure 4 is an example of a prioritized aspect list.

Figure 4 – Prioritized Aspect List for Cheese Making

Good Planning Equals Good Audits

Skillful planning helps ensure good audits. Good audits provide critical information to leadership and others about the performance of the EMS and its ability to control risk to the organization. A well-planned EMS links environmental risk to the controls established to address the risk. This linkage is like a breadcrumb auditors can follow to check that the environmental risk is being addressed and the control is effective.

Breadcrumbs for Audits

A good example is Used Oil Management. Some of the equipment in the cheese factory is lubricated with petroleum oil. This oil needs to be changed by the maintenance department from time to time to protect the equipment moving parts from excessive wear. Without adequate controls used oil can be mismanaged and dumped on the ground, in sewers and storm drains causing significant environmental impact.

The likelihood and severity of environmental impact is high if used oil is mismanaged. Used oil is also regulated by government agencies and organizations and its leadership risk fines and even criminal penalties if waste oil is mismanaged.

To ensure that risk from the aspect of used oil is minimized organizations can establish several controls including Spill Prevention Control and Countermeasures Plans, secondary containment of used oil drums and tanks, and documented work instructions. By connecting the environmental aspect of used oil to these controls the auditor can quickly confirm what controls need to be in place and if those controls are effective. Audits would check that the SPCC Plan and the used oil work instructions are being followed.

Hierarchy of Control (HOC)

EMS Planning includes consideration of what actions can control environmental risk. Risk controls take several different forms, and not all are equally effective.  One method for determining the effectiveness of risk control is the Hierarchy of Controls (HOC).  HOC is based on the concept that some types of control are more effective at reducing risk than others. In the HOC “Elimination” is one of the methods to control risk.

If a cheese factory is able to eliminate the process that generates the whey waste the risk of that aspect is also eliminated and the risk score goes from 25 to 0. Figure 5 is a version of the HOC used to calculate the effectiveness of a particular type of operational control Engineering controls reduce risk by 60% and administrative controls by 40% and so on.

Figure 5 – Hierarchy of Risk Control – CorrectTrack

Layers of Protection (LOP)

Another important concept of risk control is Layers of Protection. If we apply several different controls to the aspect of Waste Whey we can reduce risk from this aspect significantly.The calculated uncontrolled risk score for waste whey at 25 (Very High). We can use an engineering control (treat the wastewater before discharge). This will reduce that risk score by 60% down from 20 to 8 (20 x .4=8). This reduced value is the residual or remaining risk before any additional control.

A risk value of 8 for the aspect is still high (orange). Another layer of protection is desirable to reduce the risk further. The organization needs to be maintain the wastewater treatment process. Leadership should confirm that treatment plant operators are competent to ensure the treatment is done properly. Training and competence are a form of administrative operational control in the Hierarchy of Control (See Figure 3).

Appetite for Risk

This additional layer of protection reduces the risidual risk to 4.8. Depending on the organization’s appetites for risk, this value may be low enough. Leadership should review and confirm risk to the organization is managed adequately. Repeating this process for all other environmental aspects ensures that risk is assessed and addressed to an acceptable level.

Tying It Altogether

The ISO 14001:2026 revision emphasized the importance of clause 6 and good planning. The intent is to encourage organizations to review their planning process. Organizations with a legacy EMS will benefit from reviewing the planning parts of their EMS. Important questions to ask during this review are:

• Was a process flow diagram or something similar consulted during the aspect identification process?
• Are risk assessment processes used based on likelihood and severity of impact?
• Were aspects with higher risk values prioritized for action?
• Does the risk assessment process consider the hierarchy of controls when deciding if risk had been adequately addressed?
• Has linkage between the environmental aspects and the actions taken to control risk been documented?

Answering yes means the planning part meets the requirements of ISO 14001:2026 and is addressing environmental risk. If not maybe now is a good time to make some changes to the planning process.

About the Author:

Kevin Lehner is a senior member of the ANSI US technical Advisory Groups for ISO 14001, 45001 and ANSI Z10.  He is leading the international group establishing a new guidance standard in the ISO 14002 series on using ISO 14001 to address environmental topic areas.  He is a certified ISO management systems lead auditor performing frequent ISO audits for ECSI audit clients.  He also is a frequent instructor for ISO 14001, 9001 and 45001, auditor and lead auditor Exemplar Global certified courses.