ISO/UNDP 53001 clause 6: what the auditor checks
ISO 53001 clause 6 deals with planning. The auditor checks that risks and opportunities linked to the SDG contribution have been determined, that measurable objectives follow from them with actions, resources and deadlines, and that changes to the management system are carried out in a controlled way rather than improvised.
Updated: · edition covered: ISO/UNDP 53001:2026
Reading ISO 53001 clause 6 through the auditor's eyes
ISO 53001 clause 6 does not set any numerical target to reach: the organisation defines its own objectives. What the harmonized structure asks is that it determine the risks and opportunities to address so that the system delivers its intended effects, plan the corresponding actions, set measurable objectives consistent with the policy, specify for each one the resources, the person responsible, the deadline and how results will be evaluated, and finally carry out changes to the system in a planned manner.
Two faces of risk: for the organisation and for the goals
In an SDG standard, the notion of risk cuts two ways. There are the risks that threaten the system's ability to function, as in any management standard, and there are the adverse effects of the organisation's activity on people and the planet, which can hold back progress on a goal. Whatever the reading, the common core of the harmonized structure applies to the objectives that result: consistent with the policy, measurable where practicable, monitored, communicated and updated as needed. The auditor checks that both kinds of risk have actually fed into them.
SDG 13 on climate action offers a telling example. An emissions reduction objective only makes sense to the auditor if it is tied to an identified risk or opportunity and comes with an indicator and a named owner. The same expectations apply to an objective connected to responsible consumption and production (SDG 12), such as a cut in waste sent to landfill: without a baseline, a target value and a method of calculation, there is nothing the auditor can follow over time.
Assessment methods by subclause
| Subclause | What the auditor wants to establish | What is examined or observed |
|---|---|---|
| 6.1 Actions to address risks and opportunities | Risks and opportunities stem from the context analysis and from the expectations of interested parties; proportionate actions are planned and their effectiveness will be evaluated | Risk register or risk analysis; a sample of two or three risks followed through to the actions decided; interview with the system manager |
| 6.2 Objectives and planning to achieve them | Each priority SDG is broken down into measurable objectives that are monitored, communicated and updated, stating what, who, when, with which resources and how results are evaluated | Table of objectives and indicators; cross-check against the policy and the results; questions to the owners of actions |
| 6.3 Planning of changes | A change to the system, such as a new site, a reorganisation or an additional SDG, is anticipated, its consequences analysed and resources reallocated | Record of a recent change and its analysis; interview with top management on the changes ahead |
Levels of finding on planning
- Conformity when the chain is unbroken: issue, risk or opportunity, objective, action, indicator, result.
- Minor nonconformity when one link is missing on a limited point: an objective without a deadline, an indicator whose calculation method is undefined, a completed action whose effectiveness has never been evaluated.
- Major nonconformity when planning is absent or disconnected: no objective at all for a priority SDG, objectives that cannot be measured as a whole, or identified risks none of which leads to any action.
- From minor to major when the same weakness recurs across every objective, which reveals the absence of a method rather than a one-off oversight.
Frequent gaps in management systems
With no audit history yet available for this standard, these gaps reflect what is usually found on the planning clause of standards built on the harmonized structure.
- Objectives phrased as intentions (improve, strengthen) with neither a starting value nor a target.
- A risk analysis confined to financial risks, leaving out the effects of the activity on the SDGs.
- An action plan not updated over several management reviews.
- Indicators chosen because the data is easy to collect rather than because they reflect the objective.
- A reorganisation carried out without assessing its effects on the system.
What happens to a planning nonconformity
ISO/IEC 17021-1 draws a clear line between the two levels. A major nonconformity must be corrected, and its corrective action verified, before the certification body can reach a favourable decision. On planning, correction is not a matter of adding figures to a spreadsheet: the auditor checks that the revised objectives derive from the risk analysis and that they are genuinely being tracked.
For a minor nonconformity, a corrective action plan is submitted and accepted, and its completion is checked at the surveillance audit. The first surveillance audit takes place within 12 months of the certification decision, which leaves time to look at early results. The certification rules set out the applicable timeframes.
Planning carries on into clause 7 on support, which looks at the resources allocated to the objectives.
Frequently asked questions
Does the auditor judge whether SDG objectives are ambitious enough?
No. The auditor does not take the organisation's place in setting its level of ambition. What is checked is that objectives are consistent with the policy and the context, measurable, backed by actions and resources, and monitored. A modest objective that is tracked conforms; an ambitious one with no indicator or owner does not. According to BSI, publisher of the British edition (BS ISO/UNDP 53001:2026), the standard is generic and leaves the level of ambition to the organisation.
Is a missed objective a nonconformity?
Not in itself. A management system requires objectives to be set, monitored and acted upon when they drift. The auditor checks that the organisation noticed the shortfall, analysed its cause and decided what to do next. A finding arises from the lack of any response to a missed objective, not from the result alone.
Is a formal risk register required?
The harmonized structure does not prescribe a format for analysing risks and opportunities. The auditor checks that risks and opportunities are determined, that actions are planned and that their effectiveness is evaluated. The organisation is free to choose the form, as long as the auditor can follow the reasoning and the documented information the standard requires exists.