By Automated Environmental · Last reviewed July 2026. General information for Victorian businesses — not legal advice.
No. ISO 14001 certification does not satisfy or discharge the General Environmental Duty (GED). The GED — section 25 of the Environment Protection Act 2017 — requires every Victorian business to eliminate or otherwise reduce risks of harm to human health and the environment from pollution and waste, so far as reasonably practicable, and it applies at all times, certified or not. EPA Victoria regulates against the duty, not the certificate. A genuinely working environmental management system (EMS) is strong evidence that you manage risk systematically — but it is evidence towards the duty, never a substitute for it.
The assumption is understandable, because both frameworks are about the same thing: managing environmental risk systematically rather than reactively. ISO 14001 is the international standard for an EMS — the organisation-wide machinery of policy, objectives, competence, operational controls, monitoring, internal audit and management review, certified by a third-party certification body. The GED is a legal duty owed to the Victorian community, and it is not optional. Many Victorian businesses certify for commercial reasons — major customers, tenders and supply-chain prequalification increasingly require it — and that is a good reason. But the two answer to different judges: the auditor tests your system against the standard; EPA tests your site against the duty.
Section 25 applies to anyone whose activities create a risk of harm to human health or the environment from pollution or waste — in practice, every operating business in Victoria, with or without an EPA permission or a certificate. There are significant penalties for businesses that do not meet it.
The working test is "so far as reasonably practicable". EPA's guidance on the phrase (Publication 1856) weighs:
Notice what that test rewards: knowing your risks, keeping that knowledge current, and running proportionate controls chosen through the hierarchy of controls. You are judged on what you actually know and on what a business in your circumstances ought reasonably to know — EPA expects you to regularly seek up-to-date knowledge of your risks and controls.
Here is the honest positive: a working EMS institutionalises exactly the discipline the reasonably-practicable test rewards.
So certification is far from irrelevant. A living EMS is strong evidence of systematic risk management — evidence that matters if EPA ever asks how your business manages its risks. Certification helps you meet the duty and show that you meet it. It just cannot stand in for it.
The trouble starts when a system-level certificate sits on top of thin site-level substance. Any environmental consultant who reviews certified sites sees the same patterns:
EPA does not audit your certificate; its officers attend your site, and what they find there is what counts. Improvement notices commonly direct a business to develop and implement a site-specific Environmental Management Plan (EMP), prepared by a suitably qualified person, by a hard date. And when EPA formally demands environmental documents, the list typically begins with an EMP, environmental risk assessment and control procedures, and a spill response plan — not a certificate. If a notice like that lands, see The EPA told you to get an EMP.
The honest answer cuts both ways. A site EMP on its own does not give you what an auditor certifies: the policy, organisation-wide objectives, internal audit program and management review that make a management system. If certification is the goal, the EMP is the core, not the whole. The full disambiguation is in EMP vs EMS: what's the difference?
Yes — and this is the practical resolution. A well-built, site-specific EMP carries the environmental substance both frameworks need: the site-level documentation core of the EMS, and the evidence of GED compliance EPA expects. The overlap is close to one-for-one:
One document, two regulators of truth: the certification auditor and the EPA officer. The clause-by-clause detail is in How an EMP fits your ISO 14001 EMS. Who writes it matters less than what is in it — a competent internal team can build one, and so can any environmental consultant who works within the Victorian framework. Either way, the risks, controls and monitoring must be genuinely this site's, not a template's.
Certification often covers an organisation or a group of sites; the duty operates at each site, risk by risk. That mismatch is where gaps hide. A worthwhile internal check for a certified — or certifying — multi-site organisation:
If the answer anywhere is "not sure", that is where you are most exposed — under the duty first, at your next audit second. For consistent, site-specific EMPs across a portfolio, see multi-site EMP programs.
If you would like a second pair of eyes on the gap between your certificate and your sites, Automated Environmental offers a free initial EMP consultation — a no-pressure way to work out what your sites actually need before you brief a certification body. Start at Environmental Management Plans or contact us.
No. The General Environmental Duty applies to every Victorian business at all times, certified or not, and EPA regulates against the duty rather than the certificate. A working environmental management system is strong evidence of systematic risk management, but compliance is judged on whether risks of harm at your site are actually minimised so far as reasonably practicable.
In practice, yes. The certificate attests to your management system; EPA looks for site-level substance — a current, site-specific Environmental Management Plan whose risk assessment, controls and monitoring match the site. EPA notices that require a plan commonly demand a site-specific EMP prepared by a suitably qualified person, and a certificate does not answer that demand.
Yes. The duty under section 25 of the Environment Protection Act 2017 applies to anyone whose activities create a risk of harm to human health or the environment from pollution or waste. Certification is voluntary; the duty is not, and there are significant penalties for businesses that do not meet it.
Largely, yes. A well-built, site-specific EMP forms the site-level documentation core of an ISO 14001 environmental management system and is also the evidence of systematic risk management EPA expects under the duty. The wider EMS — policy, audits, management review — still needs to exist around it for certification, and the controls still need to genuinely operate on site for the duty.
Related reading: How an EMP fits your ISO 14001 EMS · EMP vs EMS: what's the difference? · Do I need an EMP? · The EPA told you to get an EMP
This article is general information, not legal advice. Notices carry hard deadlines — if you've received one, get advice specific to your situation promptly.