Scope Creep at the Halfway Point
You are auditing a distribution warehouse against ISO 9001. The audit plan allocates 2 days across receiving, storage, picking, shipping, and management review. At the end of Day 1, you have found: receiving inspection records missing for 3 of 12 sampled lots; a temperature-controlled storage area with no monitoring log for the past 30 days; and a picking-error rate the manager admits is 'higher than we'd like' but has no data to support. The client contact asks you to 'also look at the returns process' because a customer complaint prompted the audit, and to 'spend more time on shipping' since that's where they think the problem is. You have 4 hours left on Day 2 and still owe management review and shipping. The audit criteria and scope in the plan do not include returns.
1. How should you handle the client's requests while preserving the integrity of the audit plan?
Read the worked answer
Principle: The audit plan defines scope and criteria; changes require a controlled decision, not an ad hoc 'yes' to the client.
Handling 'look at returns':
- Returns is outside the planned scope and criteria. Investigating it now would (a) consume time owed to in-scope areas, (b) produce conclusions not supported by the plan, and (c) risk an unbalanced audit.
- Response: decline for this audit, document the request, and route it to the audit program manager as input for scope definition of the next audit (or a focused follow-up). If the client insists it is critical, the program manager - not the auditor mid-fieldwork - decides whether to formally amend scope, extend duration, or issue a separate audit.
Handling 'more time on shipping':
- The client's hypothesis is not evidence. 'Spend more time where I think the problem is' biases the audit toward confirming a preconception.
- Response: allocate time per the plan, but let the Day 1 findings inform emphasis legitimately - e.g., the missing receiving records and unmonitored storage are documented nonconformities that warrant follow-through. Shipping gets its planned time; if the client wants more, that is a scope/duration decision for the program manager.
Protect the remaining obligations: management review and shipping must be completed or the audit is incomplete. Rebalance the 4 hours explicitly and record any planned area not covered, with the reason.
2. The temperature-controlled storage area has no monitoring log for 30 days. The manager says the logger 'probably' worked and offers to pull electronic data after the audit. How do you treat this?
Read the worked answer
Treat as a nonconformity now, with a clear evidence statement:
- The objective evidence is that no monitoring record was available at the time of audit. The requirement (control of monitoring and measuring, and control of storage conditions) is not evidenced.
- 'Probably worked' is not evidence. An auditor does not accept assurances in place of records.
- Offering data after the audit is a common deflection. The audit conclusion is based on conditions observed during the audit. Post-audit data may be considered only through a defined follow-up/corrective-action verification process, and only if it is authenticated and covers the gap period.
How to write it:
- State the requirement, the objective evidence (no log for 30 days; area in use), and the risk (product stored outside verified conditions; potential impact on customers).
- Avoid overstating: do not claim product was stored out of tolerance - you don't know that. Claim the control was not demonstrated.
- Note the offered electronic data as a corrective-action input, not as exculpatory evidence for this audit.
Follow-up: Verify in the corrective-action closure that monitoring is restored, records are retrievable, and the 30-day gap was assessed for product impact (including any customer notification decision).