Skip to main content

Understanding management systems in ISO 14001

ISO 14001 is the international standard for Environmental Management Systems (EMS). Beyond measuring emissions, it requires organizations to actively manage environmental risks, track nonconformities, define improvement objectives, and close corrective actions — creating a continuous improvement loop. Dcycle’s Management Systems module maps directly to the ISO 14001 Plan-Do-Check-Act (PDCA) cycle:
All management system resources are scoped to a Project.Every endpoint uses /management-systems/projects/{project_id}/.... A project represents an ISO 14001 certification scope (e.g., a facility, a business unit, or the entire organization). Retrieve your project_id from the Projects API before proceeding.

Prerequisites

Before starting, ensure you have:
  • Dcycle API credentials (get them here)
  • A valid project_id for the ISO 14001 scope you are managing
  • Your organization_id (returned alongside the project)
Using the Dcycle App?You can manage risks, nonconformities, and objectives directly in the app at app.dcycle.io under Management Systems. The API is the integration layer — use it to sync from your own systems or automate workflows.

Data map: management system resources overview

Workflow overview

1

Identify risks and opportunities

Register environmental risks and opportunities for your project. Dcycle auto-assigns a sequential code (e.g., R-001, O-001) and computes a risk level from probability × impact.
2

Log nonconformities and incidents

Record deviations, incidents, or observations detected during audits or operations. Attach evidence files as needed.
3

Define environmental objectives

Set measurable targets linked to the project scope (e.g., “Reduce water consumption by 15%”). Track progress with current_value vs. target_value.
4

Create and assign actions

Link corrective, preventive, or improvement actions to a risk, opportunity, or nonconformity. Assign responsible users and deadlines.
5

Monitor via dashboard

Pull aggregated KPIs — open risks by level, nonconformity severity distribution, overdue actions — for management review.

Step 1: Risks and opportunities

Emission sources covered

Risk scoring

Dcycle uses a three-phase scoring model for risks: inherent, mitigation, and residual.

Inherent risk

Mitigation coefficients (risks only)

Optionally provide mitigation_probability and mitigation_impact — decimal coefficients between 0.00 and 1.00 representing how much each dimension is reduced by controls in place. Both must be provided together.

Residual risk (computed)

When both mitigation coefficients are provided, Dcycle computes:
The dashboard and list filters use residual risk level when available, falling back to inherent risk level when no mitigation is set.
Where to get this data:
  • project_id: Projects API → GET /v1/projects
  • owner_user_id: Members API → GET /v1/members
  • facility_id: Facilities API → GET /v1/facilities

List and filter risks

Transversal vs. facility-scoped risksUse is_transversal: true for organization-wide risks (e.g., a regulatory change affecting all sites). Use facility_id to scope a risk to a single facility. Both are mutually exclusive: if is_transversal is true, facility_id should be null.

Step 2: Nonconformities, incidents, and observations

Dcycle uses a single endpoint for all three types of deviation records. The type field distinguishes them:

Attach evidence files

Nonconformities support file attachments (audit reports, photos, etc.) via a two-step presigned URL flow:
File names must not contain path separators.The API rejects file names with /, \, or .. to prevent path traversal. Use flat names like audit-report-2026.pdf.

Step 3: Environmental objectives

Objectives let you define measurable environmental targets and track progress over time. Dcycle auto-assigns codes like OBJ-001.

Update progress

Use PATCH to update current_value as measurements come in:

Step 4: Actions

Actions are the operational core of the management system. Every action must be linked to a source: a risk, an opportunity, or a nonconformity.

Close and verify effectiveness

When the action is completed, mark it as done and record effectiveness verification — required by ISO 14001 Clause 10.2:
Actions are linked to their source automatically.When you retrieve a nonconformity or risk via the GET /{id} endpoint, the response includes a nested actions array — no separate join needed.

Step 5: Monitor via dashboard

Pull a real-time summary of the project’s management system health:

Dashboard response schema

Auto-generated codes

Every resource gets a sequential, human-readable code automatically: Sequences are per-organization for risks/opportunities/objectives, and per-project for nonconformities.
Use code in audit reports and external documents — it stays stable even if the UUID is not convenient for human readers. Filter by code using the list endpoints’ search params.

Projects API

Retrieve your project IDs and organization scope

Facilities API

Scope risks and nonconformities to specific facilities

Authentication guide

Set up API keys and organization headers