Step 4 - Update scope with control, influence and lifecycle
Your scope must consider the organisation’s authority and ability to exercise control and influence over lifecycle elements of activities, products and services.
Outcome: Reviewing your organisation’s scope will then lead to you:
- Having reviewed where lifecycle thinking applies (procurement, packaging, transport, product use/disposal) and avoided causes and adverse impacts being shifted elsewhere.
- Having documented your decision on how you interpret “control” and “influence” in your context and made changes proportionate to your business
Step 5 - New clause 6.3 - Management of Environmental Change.
Clause 6.3 is a new requirement introduced in ISO 14001:2026 that establishes a formal management of change process within the Environmental Management System (EMS). Unlike ISO 14001:2015, which contained no dedicated change management requirement. This new clause requires organisations to systematically identify, assess, plan, control, and manage any changes that may affect the EMS.
Outcome: Formal processes to ensure that environmental performance, compliance obligations, and the intended outcomes of the EMS are maintained throughout periods of organisational, operational, or external change.
- Introduce an “environmental change” method integrated into aspects, risks / opportunities, controls and objectives which addresses:
- Compliance obligations
- Operations / processes
- Materials / suppliers
- Supply chain disruption / business continuity scenarios
Step 6 - Strengthen operational control language and supplier/contractor controls.
Terminology in the EMS is updated to ‘Externally provided processes, products and services’, and reinforces the need to establish the level of control or influence.
Outcome: Reviewing and strengthening your supplier and contractor controls by:
- Reviewing your procurement and contractor controls considering supplier expectations.
- Reviewing contractor induction/controls/monitoring (where environmental risk exists) and evidenced that your controls reflect the risk and context identified.