Does ISO 14001 Meet Victoria's General Environmental Duty?

By Automated Environmental · Last reviewed July 2026. General information for Victorian businesses — not legal advice.

Does ISO 14001 satisfy the General Environmental Duty?

No. ISO 14001 certification does not satisfy or discharge the General Environmental Duty (GED). The GED — section 25 of the Environment Protection Act 2017 — requires every Victorian business to eliminate or otherwise reduce risks of harm to human health and the environment from pollution and waste, so far as reasonably practicable, and it applies at all times, certified or not. EPA Victoria regulates against the duty, not the certificate. A genuinely working environmental management system (EMS) is strong evidence that you manage risk systematically — but it is evidence towards the duty, never a substitute for it.

Why the two get confused

The assumption is understandable, because both frameworks are about the same thing: managing environmental risk systematically rather than reactively. ISO 14001 is the international standard for an EMS — the organisation-wide machinery of policy, objectives, competence, operational controls, monitoring, internal audit and management review, certified by a third-party certification body. The GED is a legal duty owed to the Victorian community, and it is not optional. Many Victorian businesses certify for commercial reasons — major customers, tenders and supply-chain prequalification increasingly require it — and that is a good reason. But the two answer to different judges: the auditor tests your system against the standard; EPA tests your site against the duty.

What does the General Environmental Duty actually require?

Section 25 applies to anyone whose activities create a risk of harm to human health or the environment from pollution or waste — in practice, every operating business in Victoria, with or without an EPA permission or a certificate. There are significant penalties for businesses that do not meet it.

The working test is "so far as reasonably practicable". EPA's guidance on the phrase (Publication 1856) weighs:

the likelihood of harm occurring;
the degree of harm that could result, including impacts that add up over time;
your state of knowledge — what you know, or ought reasonably to know, about the risks and about ways of eliminating or reducing them;
the availability and suitability of controls; and
the cost of controls against the risk reduction they deliver.

Notice what that test rewards: knowing your risks, keeping that knowledge current, and running proportionate controls chosen through the hierarchy of controls. You are judged on what you actually know and on what a business in your circumstances ought reasonably to know — EPA expects you to regularly seek up-to-date knowledge of your risks and controls.

Where does ISO 14001 genuinely help?

Here is the honest positive: a working EMS institutionalises exactly the discipline the reasonably-practicable test rewards.

Identifying environmental aspects, impacts and risks (clause 6.1) builds and maintains your state of knowledge.
Competence and awareness (clause 7) put that knowledge in the heads of the people who operate the controls.
Operational planning and control (clause 8.1) is where documented, site-level controls are meant to live.
Monitoring and evaluation (clause 9.1), internal audit (clause 9.2) and management review (clause 9.3) keep the system current rather than letting it age in a drawer.

So certification is far from irrelevant. A living EMS is strong evidence of systematic risk management — evidence that matters if EPA ever asks how your business manages its risks. Certification helps you meet the duty and show that you meet it. It just cannot stand in for it.

Where does the gap bite?

The trouble starts when a system-level certificate sits on top of thin site-level substance. Any environmental consultant who reviews certified sites sees the same patterns:

an aspects and impacts register that is generic — near-identical across sites, silent on this site's drains, waste streams, storage areas and neighbours;
controls that are not site-specific — corporate procedures that never quite reach the bund, the stormwater pit or the chemical store;
monitoring that does not match the actual risks — measuring what is convenient rather than what the site's risk profile demands.

EPA does not audit your certificate; its officers attend your site, and what they find there is what counts. Improvement notices commonly direct a business to develop and implement a site-specific Environmental Management Plan (EMP), prepared by a suitably qualified person, by a hard date. And when EPA formally demands environmental documents, the list typically begins with an EMP, environmental risk assessment and control procedures, and a spill response plan — not a certificate. If a notice like that lands, see The EPA told you to get an EMP.

The mirror image: an EMP alone is not an EMS either

The honest answer cuts both ways. A site EMP on its own does not give you what an auditor certifies: the policy, organisation-wide objectives, internal audit program and management review that make a management system. If certification is the goal, the EMP is the core, not the whole. The full disambiguation is in EMP vs EMS: what's the difference?

Can one EMP do both jobs?

Yes — and this is the practical resolution. A well-built, site-specific EMP carries the environmental substance both frameworks need: the site-level documentation core of the EMS, and the evidence of GED compliance EPA expects. The overlap is close to one-for-one:

aspects and impacts identification (clause 6.1) — the EMP's conceptual site model and environmental risk assessment;
compliance obligations (also within clause 6.1) — the EMP's legislative context, starting with the GED itself;
operational planning and control (clause 8.1) — the EMP's operational controls, chosen through the hierarchy of controls and the reasonably-practicable test;
monitoring, measurement, analysis and evaluation (clause 9.1) — the EMP's risk-based monitoring program and performance evaluation;
emergency preparedness and response (clause 8.2 in the 2015 edition) — the EMP's incident response and emergency management section;
competence and awareness (clause 7) — the EMP's training section.

One document, two regulators of truth: the certification auditor and the EPA officer. The clause-by-clause detail is in How an EMP fits your ISO 14001 EMS. Who writes it matters less than what is in it — a competent internal team can build one, and so can any environmental consultant who works within the Victorian framework. Either way, the risks, controls and monitoring must be genuinely this site's, not a template's.

Certified across multiple sites? What to check

Certification often covers an organisation or a group of sites; the duty operates at each site, risk by risk. That mismatch is where gaps hide. A worthwhile internal check for a certified — or certifying — multi-site organisation:

Does every site behind the certificate have a current, site-specific EMP?
Is each aspects register genuinely local — this site's activities, this site's stormwater, this site's neighbours?
Does each site's monitoring reflect its actual risk profile, not a corporate default?
When was each EMP last reviewed, and does it still describe what the site does today?

If the answer anywhere is "not sure", that is where you are most exposed — under the duty first, at your next audit second. For consistent, site-specific EMPs across a portfolio, see multi-site EMP programs.

If you would like a second pair of eyes on the gap between your certificate and your sites, Automated Environmental offers a free initial EMP consultation — a no-pressure way to work out what your sites actually need before you brief a certification body. Start at Environmental Management Plans or contact us.

Frequently asked questions

Does ISO 14001 certification mean we comply with the General Environmental Duty?

No. The General Environmental Duty applies to every Victorian business at all times, certified or not, and EPA regulates against the duty rather than the certificate. A working environmental management system is strong evidence of systematic risk management, but compliance is judged on whether risks of harm at your site are actually minimised so far as reasonably practicable.

Do we still need a site-specific EMP if we are ISO 14001 certified?

In practice, yes. The certificate attests to your management system; EPA looks for site-level substance — a current, site-specific Environmental Management Plan whose risk assessment, controls and monitoring match the site. EPA notices that require a plan commonly demand a site-specific EMP prepared by a suitably qualified person, and a certificate does not answer that demand.

Does the General Environmental Duty apply if we are not ISO 14001 certified?

Yes. The duty under section 25 of the Environment Protection Act 2017 applies to anyone whose activities create a risk of harm to human health or the environment from pollution or waste. Certification is voluntary; the duty is not, and there are significant penalties for businesses that do not meet it.

Can one document work for both ISO 14001 and the General Environmental Duty?

Largely, yes. A well-built, site-specific EMP forms the site-level documentation core of an ISO 14001 environmental management system and is also the evidence of systematic risk management EPA expects under the duty. The wider EMS — policy, audits, management review — still needs to exist around it for certification, and the controls still need to genuinely operate on site for the duty.

This article is general information, not legal advice. Notices carry hard deadlines — if you've received one, get advice specific to your situation promptly.