Scoping a Surveillance Audit After a Scope Expansion
You are the lead auditor for a three-year certification cycle at a valve manufacturer certified to API Q1. The current certificate scope covers machining and assembly. Eight months ago the client added an in-house heat-treat furnace and a new forging supplier, and management now wants the scope expanded to include heat treatment. Your audit program for year 2 allocated 5 auditor-days across two auditors based on the original scope. The client's internal audit of the heat-treat area found two open findings and management says they will be closed 'within weeks.' The certification body's procedure requires scope changes to be justified by audit evidence before the certificate is amended. Your team has one auditor with heat-treat metallurgy experience available for only 1.5 days.
1. How should you revise the audit program and audit plan, and what is the justification?
Read the worked answer
The scope change is a significant change under the audit program's change-management clause, so the program must be re-planned, not merely executed as written.
- Re-assess competence and time. Heat treatment is a new process with distinct risks (furnace calibration, pyrometry, quench media control, material traceability). The existing 5-day allocation was derived from the original scope; adding a process area without adding time guarantees shallow coverage.
- Split the sampling. Use the metallurgy-experienced auditor for the heat-treat process audit (furnace records, AMS/API Q1 calibration, hardness verification, supplier approval of the forge) and the second auditor for the unchanged machining/assembly areas.
- Treat the open internal findings as a risk input, not a blocker. Their existence raises the sample size in that area; 'closing within weeks' is not evidence.
- Document the change in the audit program with rationale, and notify the client that the scope expansion decision will be based on objective evidence gathered at this audit, not on the request alone. If evidence is insufficient, report it and defer the scope amendment.
The judgement is that a scope expansion is a program-level trigger, and the lead auditor owns the decision to add resources or defer.
2. The client asks you to confirm in the opening meeting that the certificate will be expanded at the end of the audit. How do you respond?
Read the worked answer
Decline to commit. The opening meeting is for confirming scope, criteria, schedule, and logistics.
Say plainly: this audit gathers evidence against the expanded scope; whether the certificate is amended is a certification decision made after the audit report and technical review, by persons independent of the audit team. Committing would compromise impartiality and misrepresent the audit's authority.
Record the client's expectation in the opening meeting notes so the report can address it explicitly, and confirm in writing that the scope-expansion recommendation will be evidence-based.