In early 2024, ISO issued Amendment 1:2024, a short but significant update to several widely used management system standards including ISO 9001, AS9100, ISO 14001, ISO 27001, and ISO 45001. The amendment modifies Clauses 4.1 and 4.2 to require organizations to determine whether climate change is a relevant issue in the context of their management system and their interested parties. The wording is simple—but the implications for auditors and organizations are more nuanced. This article outlines when nonconformities (NCs) and opportunities for improvement (OFIs) should, and should not, be raised during internal audits, supplier audits, and certification audits conducted against ISO standards to which the amendment applies.
When to Write a Nonconformity
A nonconformity should be cited under the following conditions:
- The organization is unaware of the requirement. If personnel responsible for the management system (e.g., Quality, EHS, Compliance) are unaware that ISO now requires climate change to be considered, this is a clear minor nonconformity. It demonstrates a gap in awareness and QMS upkeep.
- The organization has not considered climate change at all. If there is no evidence of a process or discussion around climate change relevance—neither in risk assessments, strategic planning, management review, nor QMS documentation—then the basic requirement of Clause 4.1 and/or 4.2 is unmet.
- A regulatory or customer requirement related to climate change exists but is not addressed. If there are external requirements tied to climate change—such as emissions tracking, environmental disclosures, or sustainability clauses in customer contracts—and the QMS fails to account for them, then this is a valid nonconformity.
These would almost always be minor NCs. A major nonconformity should only be issued if the failure to consider climate change has contributed to a larger breakdown of the QMS, or has had a significant and direct adverse impact on a product, service, or regulatory obligation.
When to Write an OFI (Opportunity for Improvement)
An OFI or risk-based Observation may be more appropriate when:
- The organization has considered climate change, but the rationale is vague, undocumented, or hard to trace in the audit trail.
- The conclusion that climate change is “not relevant” seems plausible but lacks supporting justification.
- Climate-related risks are addressed in broader corporate programs (e.g., ESG, CSR) but not reflected within the ISO QMS structure.
While the standard does not explicitly require documentation, internal auditors should write an OFI when the organization’s determination is not well-documented. Ideally, this determination should be recorded in the Quality Manual (if applicable), or other maintained document addressing organizational context, as management review records are often retained for only a few cycles, and may not be available to future auditors. Including this analysis in the Quality Manual “audit-proofs” the QMS and makes future audits more efficient.
When No Finding Is Needed
A finding is not needed when:
- The organization has clearly and reasonably considered climate change and determined whether it is relevant.
- This consideration is documented and traceable—such as in the context analysis, risk register, management review, or Quality Manual.
- There is no regulatory or customer requirement, and the nature of the organization’s activities reasonably justifies the determination that climate change is not a relevant issue.
In these cases, auditors should document the objective evidence reviewed, but there is no need to raise an NC or OFI.
Documenting Objective Evidence in Audit Reports
Regardless of whether a nonconformity or OFI is cited, auditors should clearly document objective evidence to demonstrate that the climate change amendment was assessed during the audit. This supports transparency and helps ensure the audit adds value.
- Where and how the requirement was addressed (e.g., “Climate change considered as part of SWOT analysis in Section 4.1 of the Quality Manual, Rev 3.”).
- Who was interviewed and what was discussed (e.g., “Operations Manager confirmed climate change risks were discussed in the September 2024 management review.”).
- Any supporting records or rationale (e.g., “Management Review minutes referenced external stakeholder expectations and climate impact on logistics routes.”).
If the organization has not documented its determination well, auditors should note that gap and consider raising an OFI—even if the verbal explanation during the audit was reasonable. This applies more so to internal auditors; third party auditors should be careful not to provide consultation recommendations..
