Scope Creep at the Supplier
You are planning a second-party audit of a critical fasteners supplier. The audit plan (2 auditors, 2 days) covers: incoming inspection, traceability, and calibration. On arrival, the supplier's QA director says their plating sub-processor - which they outsource - has had two customer complaints about coating thickness in the last quarter, and asks if you'll 'take a quick look' since you're there. Your audit plan did not include the sub-processor, and the sub-processor is a separate legal entity 40 km away. You have 2 days and a fixed plan. Your own organization's purchasing contract requires the supplier to control outsourced processes but does not require you to audit sub-tiers. The supplier's certificate covers plating as an outsourced process.
1. Should you expand scope to include the plating sub-processor? Reason it through.
Read the worked answer
Not automatically, and not by 'taking a quick look' - that is the worst option because it produces an impression of coverage without the depth to support a conclusion.
The decision rests on risk and authority, not politeness. Considerations:
- Authority: Your contract requires the supplier to control outsourced processes; it does not give you audit rights at sub-tiers. Auditing a separate legal entity may require consent and possibly a separate agreement. Check before assuming you can.
- Risk: Two coating-thickness complaints in a quarter on a critical fastener is real risk. Coating thickness affects corrosion and fit. This is not a trivial add-on.
- Feasibility: 40 km away, separate entity, 2 fixed days, plan already full. A genuine sub-tier audit cannot be done as a drive-by.
Best judgement: do not improvise coverage. Instead, within the existing 2 days, audit the supplier's control of the outsourced process - how they specify coating requirements, approve the sub-processor, monitor its performance, and handle the two complaints. That is squarely in your scope and is where the control actually lives. Then recommend a separate, properly planned sub-tier audit (or supplier-led) if the control evidence is weak. Document the scope decision and rationale in the report.
2. How do you record this scope decision so the report is not misleading?
Read the worked answer
State the scope explicitly and the boundary clearly: what was audited (supplier's oversight of plating) and what was not (the sub-processor's own operations). Note the trigger (two complaints), the reason for exclusion (no audit rights / separate entity / plan and time constraints), and the follow-up action (recommend separate sub-tier audit, owner and target date).
This matters because a reader who sees 'plating reviewed' may assume the sub-processor was audited. Precision here prevents a false sense of assurance. A scope limitation stated openly is professional; an unstated gap discovered later destroys credibility.