An environmental risk assessment under ISO 14001 is the process of identifying how an organisation’s activities, products and services interact with the environment, deciding which of those environmental aspects are significant, and planning action on them alongside legal obligations and wider risks and opportunities. ISO 14001 sets these requirements in clause 6.1 but leaves the method to the organisation.
What is an environmental risk assessment under ISO 14001?
What is the purpose of an environmental risk assessment?
An environmental risk assessment identifies, evaluates and reduces the ways an organisation’s operations could harm the environment, and spots where it could do better. It lets organisations manage their environmental aspects before problems occur, rather than reacting after an incident, and gives the rest of the environmental management system a clear list of priorities.
Does ISO 14001 define environmental risk assessment?
No. ISO 14001:2015 does not use the term “environmental risk assessment”. Instead, clause 6.1 asks you to work through three linked things:
- Environmental aspects (clause 6.1.2): the parts of your activities, products and services that interact with the environment, and which of them are significant.
- Compliance obligations (clause 6.1.3): the legal requirements and other requirements you must or choose to meet.
- Risks and opportunities (clause 6.1.1): possible harmful effects (threats) and possible beneficial effects (opportunities), as defined in clause 3.2.11.
The guidance in Annex A (A.6.1.1) makes clear that you do not need a formal risk management system or a written risk management procedure: the choice of method is yours. Most organisations call the combined exercise an environmental risk assessment. It sits in the “Plan” stage of the Plan-Do-Check-Act model that the standard is built on (introduction, 0.4). For how this fits the wider picture, see our guide to ISO 14001 risks and opportunities.
What are the key parts of an environmental risk assessment?
- Identifying environmental aspects: recognising the parts of activities, products or services that interact with the environment (clause 6.1.2).
- Evaluating significance: applying your own criteria to decide which aspects have, or could have, a significant environmental impact (clause 6.1.2).
- Compliance obligations: linking legal and voluntary commitments to each aspect (clause 6.1.3).
- Planning action: deciding how to address significant aspects, compliance obligations and risks and opportunities (clause 6.1.4).
- Monitoring and review: checking whether the actions work and adjusting them (clause 9.1).
Why does environmental risk assessment matter for ISO 14001?
The assessment is the starting point for most of the ISO 14001 environmental management system. Significant aspects and compliance obligations feed into environmental objectives, operational controls, emergency planning and monitoring. Getting the assessment right helps you meet legal requirements, improve environmental performance and support continual improvement, a core principle of ISO 14001.
Introducing ISMS.online and How it Helps with ERA
ISMS.online offers a comprehensive platform to streamline ERA processes. Our features include:
- Risk Management Tools: Identify, assess, and mitigate environmental risks effectively.
- Compliance Tracking: Ensure adherence to legal requirements and voluntary commitments.
- Automated Documentation: Maintain accurate records of risk assessments and mitigation actions.
- Performance Monitoring: Track the effectiveness of mitigation measures and support continual improvement.
By integrating these tools, ISMS.online simplifies ERA, ensuring your organisation meets ISO 14001 requirements efficiently.
Book a demoHow do you identify environmental aspects and impacts?
How do you identify environmental aspects in your organisation?
Start by listing every activity, product and service within the scope of your environmental management system, including the ones you can only influence, such as outsourced processes and the use and disposal of the products you sell (clause 6.1.2). Walk through operational processes from raw material buying through production to waste disposal. Cross-functional teams help, because different departments see different aspects. Process flow diagrams and site checklists make the review systematic.
ISO 14001 asks you to consider normal operations, planned changes and new or modified activities, plus abnormal conditions and reasonably foreseeable emergencies such as spills or fires (clause 6.1.2).
What methods are used to evaluate environmental impacts?
Evaluating environmental impacts uses both qualitative and quantitative methods. Qualitative assessments rely on expert judgement, while quantitative methods use measures such as emission levels, resource consumption and waste generated. ISO 14001 asks for a life cycle perspective when you determine aspects (clause 6.1.2), but the Annex A guidance (A.6.1.2) confirms that a full Life Cycle Assessment is not needed; careful thought about the stages of the life cycle you can control or influence is sufficient.
What criteria decide whether an environmental aspect is significant?
You set your own criteria for significance and apply them to decide which aspects are significant (clause 6.1.2). The Annex A guidance (A.6.1.2) says there is no single method, that the method and criteria should give consistent results, that environmental criteria are the primary and minimum criteria, and that criteria can relate to the aspect (such as type, size or frequency) or to the impact (such as scale or severity). Many organisations also weigh compliance obligations and the concerns of interested parties. A simple scoring system ranks aspects, and those above a set threshold are treated as significant. You must keep documented information on your aspects and impacts, your criteria and your significant aspects (clause 6.1.2).
What are examples of environmental aspects and impacts?
The Annex A guidance (A.6.1.2) lists aspects you can consider, including emissions to air, releases to water and land, use of raw materials, natural resources and energy, energy emitted (such as heat, noise or light), and waste. Corresponding impacts might be air and water pollution, soil contamination, resource depletion and habitat damage. For instance, a manufacturing process may have aspects such as chemical use and waste discharge, leading to impacts such as soil contamination and water pollution.
What does an aspects and impacts register look like?
The table below is an illustrative register for a small UK manufacturing site. It scores likelihood and severity from 1 to 5, multiplies them, and treats an aspect as significant if the score is 12 or more, or if it is linked to a compliance obligation. The scores, threshold and controls are examples only: set your own criteria and record them.
| Activity | Aspect | Impact | Likelihood (1-5) | Severity (1-5) | Score | Linked to a compliance obligation? | Significant? | Example control |
|---|---|---|---|---|---|---|---|---|
| Solvent parts cleaning | Solvent vapour released to air | Air pollution | 3 | 3 | 9 | Yes | Yes | Lidded tanks, switch to water-based cleaner, usage log |
| Diesel storage (abnormal or emergency) | Spill to land or surface drains | Soil and water contamination | 2 | 5 | 10 | Yes | Yes | Bunded tank, spill kits, drain covers, emergency drill |
| Wash-down of production lines | Wastewater released to sewer | Water pollution | 3 | 4 | 12 | Yes | Yes | Interceptor, regular sampling, operator training |
| Office and site lighting | Electricity use | Resource depletion and greenhouse gas emissions | 5 | 2 | 10 | No | No (monitor) | Meter readings, LED replacement plan |
| Incoming goods | Packaging waste | Resource loss and landfill use | 4 | 2 | 8 | No | No (monitor) | Segregated recycling, supplier take-back |
Review the register when activities, products or services change, after incidents and at planned intervals, and keep each version as documented information.
An 81% Headstart from day one
We’ve done the hard work for you, giving you an 81% Headstart from the moment you log on. All you have to do is fill in the blanks.
What compliance obligations does an environmental risk assessment cover?
What are compliance obligations under ISO 14001?
Compliance obligations are the legal requirements an organisation must meet and the other requirements it chooses to adopt, such as customer contracts or voluntary initiatives. Under clause 6.1.3 you must identify and have access to the obligations related to your environmental aspects, work out how they apply, take them into account in your environmental management system, and keep documented information of them.
How do you identify relevant legal requirements?
Review the local, national and international environmental laws that apply to your operations. Legal registers, trade bodies and specialist advisers can help, and you need a way to keep track of changes. In the UK, the rules and the regulator depend on where you operate. In England and Wales, many site activities need a permit under the Environmental Permitting (England and Wales) Regulations 2016. In England, the Environment Agency issues most of these permits, with local councils handling some installations. Natural Resources Wales covers Wales, and SEPA (the Scottish Environment Protection Agency) covers Scotland under its own regime. For more detail, see our guide to legal and regulatory compliance with ISO 14001.
How do you bring compliance obligations into the EMS?
Integrating compliance obligations into the Environmental Management System (EMS) involves several steps:
- Identification: List all applicable legal requirements and voluntary commitments.
- Assessment: Work out how each obligation applies to your operations and environmental aspects.
- Integration: Build the requirements into policies, procedures and operational controls.
- Evaluation of compliance: Check periodically whether each obligation is being met, keep evidence of the results, and act on any shortfall (clause 9.1.2).
ISMS.online supports this process by offering tools for regulatory tracking, automated documentation, and compliance monitoring, ensuring seamless integration of obligations into the EMS.
What happens if you fail to meet compliance obligations?
Two different things can go wrong, and they have different consequences:
- Breaking environmental law: fines, enforcement action and other penalties come from the law itself and the authority that enforces it (for example, the Environmental Permitting (England and Wales) Regulations 2016), not from ISO 14001. The Annex A guidance (A.9.1.2) says that where an evaluation shows a legal requirement is not met, the organisation needs to decide on and carry out the actions needed to comply.
- Falling short of ISO 14001: ISO 14001 is a voluntary standard, so it carries no legal penalties. Whether a certificate is issued, kept or withdrawn is decided by the accredited certification body that issued it.
Either way, environmental harm and reputational damage can follow, which is why compliance obligations are a core input to the risk assessment.
Which methods can you use for an environmental risk assessment?
What are the common methods?
Because ISO 14001 does not prescribe a method, many organisations borrow the general risk assessment process from ISO 31000:2018, which describes risk assessment as risk identification, risk analysis and risk evaluation (clause 6.4). Specific techniques such as Failure Mode and Effects Analysis (FMEA), Hazard and Operability Study (HAZOP) and Bow-Tie Analysis can then be used to identify failure points, assess their impacts and plan controls.
How do you choose the right method?
Choosing a method depends on the complexity of your operations, your compliance obligations and your goals. The table below compares the three techniques described on this page.
| Method | Best for | Information needed | Example use |
|---|---|---|---|
| FMEA | Detailed analysis of specific processes or equipment | Process steps, ways each step can fail, and the environmental effect of each failure | Manufacturing: finding production failures that could cause releases or waste |
| HAZOP | Finding hazards in complex systems | Process design drawings and operating conditions, reviewed step by step by a team | Chemical plants: analysing hazards in operational processes |
| Bow-Tie Analysis | Showing risk pathways and the controls on each side of an event | The event, its causes, its consequences and the barriers in place | Oil and gas: showing how a spill could happen and which controls stop or limit it |
A simple likelihood and severity matrix, like the register above, is often enough for lower-risk sites.
What are the steps in an environmental risk assessment?
- Identify environmental aspects: Find the activities, products or services that interact with the environment (clause 6.1.2).
- Evaluate impacts: Assess the possible environmental effects of each aspect.
- Determine significance: Apply your criteria, such as scale, severity, compliance obligations and stakeholder concerns, to rank aspects (clause 6.1.2).
- Identify risks and opportunities: Decide which risks and opportunities linked to your aspects, obligations and context need to be addressed (clause 6.1.1).
- Plan mitigation measures: Plan actions to reduce significant risks (clause 6.1.4).
- Monitor and review: Check whether the measures work and adjust as needed (clause 9.1).
ISMS.online supports these methodologies by offering tools for risk identification, assessment, and mitigation, ensuring compliance with ISO 14001 requirements efficiently.
How do you evaluate and prioritise environmental risks?
How do you evaluate the significance of identified risks?
Evaluating the significance of identified environmental risks involves assessing the possible impact and likelihood of each risk. This process typically includes:
- Impact assessment: Determining the severity of possible environmental harm.
- Likelihood evaluation: Estimating the probability of occurrence.
- Contextual factors: Considering compliance obligations, stakeholder concerns and organisational priorities.
Which criteria decide priority?
Prioritising environmental risks requires a consistent approach. Key criteria include:
- Severity of impact: Higher priority goes to risks with more severe environmental consequences.
- Probability of occurrence: Risks with higher likelihoods are prioritised.
- Compliance obligations: Risks linked to a legal requirement usually come first.
- Stakeholder concerns: Issues that matter to interested parties affect trust and may become obligations (clause 4.2).
How should you record and share the results?
Clear records and communication of the results support transparency and accountability. This involves:
- Detailed records: Keeping documented information on your aspects, criteria, significant aspects, compliance obligations and planned actions (clauses 6.1.2, 6.1.3 and 7.5).
- Clear communication: Sharing significant environmental aspects across the relevant levels and functions of the organisation (clause 6.1.2), through reports, meetings and digital platforms.
- Regular updates: Updating records to reflect new findings and changes in risk status (clause 7.5).
How does stakeholder input affect risk priorities?
Stakeholder input plays an important role in prioritising environmental risks. Engaging stakeholders ensures:
- Relevance: The most pressing risks are addressed from the perspective of those affected.
- Transparency: Trust grows through open communication and involvement.
- Compliance: Needs and expectations of interested parties that you adopt become compliance obligations (clause 4.2).
ISMS.online facilitates this process with tools for risk assessment, documentation, and stakeholder engagement, enhancing overall environmental performance.
Manage all your compliance, all in one place
ISMS.online supports over 100 standards and regulations, giving you a single platform for all your compliance needs.
How do you control and reduce significant environmental risks?
What are the best practices for planning mitigation measures?
Developing effective mitigation measures starts from the significant aspects, compliance obligations and risks and opportunities identified in your assessment. Engage cross-functional teams to suggest possible measures, so you get different perspectives. Prioritise measures based on their feasibility, cost and likely effect. Document each measure clearly, with the steps, responsible people and timelines.
How do you put control measures in place?
Implementing control measures requires careful planning. Build the measures into your Environmental Management System (EMS) procedures and operational controls. Assign clear responsibilities and provide training so staff understand their roles. Utilise ISMS.online’s tools for task management and progress tracking to streamline implementation. Control planned changes, review the effects of unintended ones, and update controls as conditions change (clause 8.1). For abnormal conditions and foreseeable emergencies, plan your response in advance (clause 8.2).
How do you monitor whether mitigation measures work?
Monitoring the effectiveness of mitigation measures is central to continual improvement. Set key performance indicators (KPIs) for each measure and decide what to monitor, how and when (clause 9.1). Review performance against these KPIs through internal audits and management reviews. Use ISMS.online’s monitoring tools to track data in real-time and generate reports. Share results with stakeholders and ask for feedback to refine your measures.
What are examples of mitigation measures?
Mitigation measures vary across industries. For instance, a manufacturing company might install energy-efficient equipment to cut energy use and emissions. A chemical plant could add filtration systems to reduce water pollution and help it meet the limits set by its permits. ISMS.online’s platform supports these efforts by providing templates and guidance for developing and implementing effective mitigation measures, enhancing overall environmental performance.
How does a life cycle perspective change the assessment?
What is the life cycle perspective in environmental risk assessment?
The life cycle perspective looks at the whole life of a product or service, from raw material acquisition to end-of-life treatment. ISO 14001 asks you to consider it when determining environmental aspects (clause 6.1.2) and when setting operational controls, for example on design, purchasing, transport, use and disposal (clause 8.1). It helps stop environmental impacts being shifted from one life cycle stage to another unnoticed.
How do you build life cycle thinking into a risk assessment?
Incorporating life cycle thinking into risk assessment involves several steps:
- Map the life cycle stages: Identify all stages of the product or service life cycle, including raw material extraction, production, distribution, use and disposal.
- Identify environmental aspects: Determine the environmental aspects of each stage you can control or influence.
- Evaluate impacts: Assess the possible environmental impacts using qualitative and quantitative methods.
- Prioritise risks: Rank the identified risks based on their significance and likelihood.
- Develop mitigation measures: Plan controls for significant risks at each stage (clause 8.1).
What are the benefits of a life cycle perspective?
Using a life cycle perspective offers several benefits:
- Fuller risk management: Impacts outside your own site, such as in your supply chain or at end of life, are considered.
- Stronger compliance: It helps you meet requirements that apply at different stages, such as packaging or product disposal rules.
- Sustainability: It reveals opportunities for resource efficiency and waste reduction.
- Stakeholder trust: It shows interested parties a commitment to managing environmental impacts across the whole life cycle.
What are the challenges of a life cycle perspective?
Implementing a life cycle perspective can be challenging due to:
- Complexity: Mapping and assessing every stage can take time and resources.
- Data availability: Accurate data for stages outside your control can be hard to obtain.
- Integration: Building life cycle thinking into existing processes and systems takes effort.
- Keeping it current: It needs ongoing monitoring and updating as products, suppliers and risks change (clause 10.3).
Why choose ISMS.online for environmental risk assessment?
ISMS.online gives you one centralised platform to manage every part of your environmental risk assessment, from finding risks to keeping the records.
- Risk management tools: identify, assess and mitigate environmental risks.
- Compliance tracking: keep track of legal requirements and voluntary commitments.
- Automated documentation: keep records of risk assessments and mitigation actions.
- Controlled records: centralised storage, version control and access control.
- Task management: track progress as you put control measures in place.
- Performance monitoring: track whether mitigation measures work, with real-time data and reports.
- Multiple standards: unified risk management, compliance tracking and documentation across more than one standard.
Book a demo to see how ISMS.online supports your environmental risk assessment.
FAQs
How must assessment records be controlled under ISO 14001?
ISO 14001 requires documented information on your risks and opportunities, environmental aspects and impacts, significance criteria, significant aspects and compliance obligations (clauses 6.1.1 to 6.1.3), and evidence of monitoring and compliance evaluation results (clause 9.1). Documented information must be controlled so it is available where needed, suitably protected and kept up to date, with version control and access rules (clause 7.5.3). Standard templates, staff training and a regular check of records help keep them accurate. ISMS.online provides centralised storage, version control and access control for these records.
Which measures show how your environmental performance is changing?
Monitoring tracks whether your risk controls work, using measures such as emission levels, energy and water use, waste generated and recycled, and compliance evaluation results (clause 9.1). Internal audits (clause 9.2) and management reviews (clause 9.3) then look at performance as a whole and decide what needs to change. For a step-by-step view of the full requirements, see our ISO 14001 compliance guide.
Where do ideas for improving the risk assessment come from?
ISO 14001 requires ongoing improvement in how suitable, adequate and effective your environmental management system is, with the aim of better environmental performance (clause 10.3). Opportunities for improvement come from monitoring results, internal audits and management review (clause 10.1), as well as stakeholder feedback. Feed what you learn back into the aspects register and risk assessment, so each cycle of Plan-Do-Check-Act starts from an up-to-date picture.
Can you run one risk assessment across ISO 14001 and other ISO standards?
ISO 14001 follows ISO’s high level structure for management system standards, with identical core text and common terms, which is designed to help organisations that run several standards together (introduction, 0.5). Organisations that also use ISO 9001 (quality), ISO 27001 (information security) or ISO 45001 (occupational health and safety) can map shared clauses such as leadership, risks and opportunities, and performance evaluation, and use one risk method across environmental, quality, security and safety risks. An integrated management system can reduce duplicated documents and audits.
