A guide to ISO 14001 certification: your environmental controls

It’s time for the next instalment in our new blog series; Your Guide to ISO 140001 Certification. In the last post, we covered how to identify your environmental risks. After going through this processes your business should now have a list of environmental risks that your environmental system can now be establish controls around.

One key thing/consideration a lot of people tend to get wrong is to consider your environmental issues without controls in place. It is common for a client in their initial audits or interactions with ISO 14001 to say but we don’t have any environmental issues – often this is because they are already managing them

For example: If you run a cleaning business with a warehouse full of cleaning products and chemicals. You may initially say there are no environmental risks, but this is because they are already securely stored with drainage and stormwater runoff managed within the warehouse.


To create an EMS you need to analyse this risk without the pre-existing controls in place.

This can be a difficult process for some clients to go through as often these practices are common knowledge and almost second nature or may be so integrated into the business or industry that they are often difficult to identify as risks.


If you take the controls away does the risk increase?

Some clients can also take the other approach, they already have adequate controls in place but may think they aren’t doing enough or put extras controls or procedures in place in order to gain ISO 14001 certification. This is where risk-based thinking comes in,  if that risk is already being managed, then creating extra procedures to manage it will only waste your businesses time and resources. As we’ve said in previous posts don’t create procedures because you think ISO certification requires them. All procedures need to make sense within the context of your business.

When creating controls around your environmental outputs you must go back to first steps and ask the question is this risk significant to my business. Often clients/businesses will put in place controls around their environmental outputs they have determined are an insignificant risk.

ISO 14001 only requires businesses to put controls around risks that are significant to the business. If you determine and justify why an environmental aspect is not a significant risk then you don’t have to out controls around that risks to satisfy the requirements of ISO 14001 environmental certification.


So to recap when working towards ISO 14001 certification you need to come up with your environmental outputs, consider if they are a significant risk to your business and then place adequate controls around the risks you have considered significant.