What supplier chemical records does an ISO 14001 audit need?

This answer covers plants certified to, or working toward, ISO 14001 or ISO 45001. It does not replace the legal SDS and chemical inventory duties of a jurisdiction, such as US OSHA 29 CFR 1910.1200 or EU REACH, or sector schemes that set their own document lists.

What do ISO 14001 and ISO 45001 require for chemical management records?

ISO 14001 and ISO 45001 require the plant to decide which documented information its management system needs, to control it, and to control documents that come from outside, which is where supplier SDSs and reports fall. ISO describes ISO 14001:2026 as aligned with "the harmonized structure used across all ISO management system standards" (ISO, 2026). ISO 45001:2018 sets its documented information requirements in clause 7.5 (EnviroData Solutions, n.d.).

The Harmonized Structure clause 7.5.1 requires documented information "determined by the organization as being necessary for the effectiveness" of the management system (ISO/IEC Harmonized Structure, 2025). Clause 7.5.3 then states: "Documented information of external origin determined by the organization to be necessary for the planning and operation of the XXX management system shall be identified as appropriate, and controlled." (ISO/IEC Harmonized Structure, 2025). XXX stands for the discipline, environment or occupational health and safety here.

Two points follow for chemical records. The shared clauses name no chemical document, so the plant's own procedures and legal obligations decide which supplier records it needs. And once the plant decides it needs a supplier document, that document must be identified and controlled like any internal record, which in practice means a known current version, a place it is kept and a way to replace it.

Which supplier documents do auditors ask to see for chemicals?

For chemicals, auditors of ISO 14001 and ISO 45001 systems test what the plant itself decided it needs and what the law requires of it, so the supplier documents they ask for are the ones the plant's procedures name. In practice that usually means a current SDS for each product on site, evidence of how revised SDSs reach the plant, and the supplier's service or site reports where the supplier runs part of a chemical process.

The 2026 edition makes the supplier side more visible. ISO says that in ISO 14001:2026 "The shift from 'outsourcing' to 'externally provided processes, products and services' reinforces accountability beyond organizational boundaries" (ISO, 2026). The Harmonized Structure clause 8.1 requires the organization to ensure that externally provided processes, products or services relevant to the management system "are controlled" (ISO/IEC Harmonized Structure, 2025).

A supplier who doses a cooling tower, manages a coolant system or collects waste is providing an external process, and its visit and test reports are the plant's evidence that the process was controlled. A supplier's own ISO 14001 certificate, by contrast, shows the supplier's system, not the plant's control of the products, so it does not replace the plant's records.

Which chemical records does the plant keep, and which does the supplier provide?

For an ISO 14001 or ISO 45001 audit, the plant keeps every chemical record, but several of them can only come from the supplier. The table below decides which records to hold and which to request.

The row most plants get wrong is the second: an SDS file is only as current as the last revision the supplier sent. Under EU REACH, suppliers must update the SDS "without delay" when new hazard information becomes available (Regulation (EC) No 1907/2006, Article 31(9)), so the plant needs a way to receive and file each revision.

The product list is the record that ties the others together. Each product on it should point to one current SDS, to the area where it is used and to the waste route for its residues and containers. An auditor who samples one product and finds a different name on the list, the SDS and the waste record will treat the gap as a weakness in the plant's control of documented information, whoever supplied the papers.

How do you check that supplier SDSs are current before an ISO 14001 audit?

To check that supplier SDSs are current before an ISO 14001 audit, compare the plant's product list with the SDS file, then confirm each SDS revision with its supplier. The rules on revisions are jurisdiction specific. In the EU, the new, dated version is "identified as 'Revision: (date)'" (Regulation (EC) No 1907/2006, Article 31(9)). In the US, a manufacturer or importer that becomes newly aware of significant hazard information must add it to the SDS within three months (29 CFR 1910.1200(g)(5)).

1. Export the list of chemical products in use and mark each one with the SDS revision date on file.

2. Flag products with no SDS, an SDS for a different product name, or an SDS not in a language the site's workers can use.

3. Send each supplier the list of its products and revision dates and ask which are superseded.

4. Replace superseded SDSs, keep the old version as retained documented information, and record the date of the check.

5. Confirm that workers can reach the SDSs during each shift; in the US, "readily accessible during each work shift" is the legal test (29 CFR 1910.1200(g)(8)).

How the revisions reach the plant matters as much as the check. For a comparison of the two common routes, see Is an SDS portal better than email for SDS and service reports?.

What changed for chemical records in ISO 14001:2026?

ISO 14001:2026 adds no chemical-specific record, but it changes how supplier records are framed and audited. ISO lists three main areas of change: a broader view of environmental context in clauses 4.1 and 4.2, stronger leadership accountability, and a clearer focus on outcomes (ISO, 2026). At the operational level, ISO names a new clause 6.1.4 on risks and opportunities, formal planning of changes in clause 6.3, the shift to "externally provided processes, products and services", and documented internal audit programmes (ISO, 2026).

For chemical records, the change in supplier language is the one to act on. A plant that listed chemical suppliers only under purchasing should now show where it controls or influences each supplier's product or service. A change of product, supplier or SDS hazard classification is also a change the plant may need to plan under clause 6.3.

The transition is time limited. DQS reports that the transition period of 36 months approved by the IAF started on 15 April 2026 and that ISO 14001:2015 certificates lose validity on 30 April 2029 (DQS, 2026). ISO 45001 is on a later track: ISO lists ISO 45001:2018 as "Expected to be replaced by ISO/DIS 45001 within the coming months" (ISO, 2026), so its clause wording should be rechecked when the new edition appears.

When should you bring in an ISO 14001 consultant on chemical records?

Bring in an ISO 14001 consultant on chemical records when the plant cannot show, product by product, which SDS revision is current and who sent it, or when an audit has already raised a finding on chemical control. Other triggers are a first certification, a site that buys chemicals under more than one jurisdiction's SDS rules, and the move to ISO 14001:2026, which DQS reports must be completed by 30 April 2029 (DQS, 2026).

A consultant is also worth the cost when the chemical inventory, the SDS file and the waste records are kept by different departments and do not agree. In that case the gap is a process gap, not a missing document, and auditors will find it by sampling one product across all three records.

Much of the routine work stays with the plant and its suppliers. The supplier can make the records easier to keep by sending each revision with a date and by keeping service reports in one place the customer can reach. On the supplier side, Lubinpla's Field Care lets a supplier share Dataroom SDSs and service reports with a customer's contact item by item and revoke that access when needed.