The Out-of-Scope Carrier Evidence

1. Separate two questions that are being merged.

• Is there a requirement inside the audited scope? Re-read SOP-114. If it says 'ship per approved routing guide' or references the approved list, the four shipments are an in-scope nonconformity. If SOP-114 is silent, the requirement lives only in SOP-207 and is genuinely outside scope.
• Is there a requirement outside the scope? The 26-month review against SOP-207's annual requirement is objective evidence of a control failure, whether or not it is in this audit's scope.

2. Scope is a boundary for conclusions, not a licence to suppress evidence. You may not state a nonconformity against a process you did not audit, but you also may not delete the evidence because the sponsor asked. Standard practice: report it in a clearly separated section (matters noted outside scope / for management attention), do not classify it as a conforming conclusion, and route it to the audit programme manager for a decision on a follow-up audit or a scope extension.

3. Handle the sponsor professionally. Record the request and your response; explain that only the audit client and programme manager can change scope, and that a scope change now would need documented approval and re-planning. Do not argue severity with the sponsor at the exit meeting; present facts.

4. Escalate rather than wait. Significant risk (unapproved carriers, expired control) justifies contacting the programme manager or quality manager before the exit meeting even if they are 'unreachable' - a documented escalation attempt protects the audit's integrity.

Classification: nonconformity (severity argued on risk, not on the sponsor's preference).

Reasoning chain:

• Requirement exists - SOP-114 mandates the approved routing guide.
• Objective evidence - 4 of 12 traced shipments used unlisted carriers; the list itself was not reviewed in 26 months.
• Evidence is verifiable - shipment records, carrier list, revision history.
• Effect - unapproved carriers mean unvetted insurance, liability, transit times and possibly regulatory status; the sampling shows the control did not operate at the time of audit.

Why not an 'observation': an observation is appropriate where the requirement is unclear, the evidence is incomplete, or the risk is low. None of those apply. Downgrading a well-evidenced finding to satisfy the auditee's reporting preference is a direct threat to objectivity and would be visible to any reviewer of the report against the working papers.

State it as condition + requirement + evidence, with no speculation about cause. Any root cause belongs in the corrective action response, not in your statement.

Must change:

• The audit plan: revised scope, criteria, additional time, notification to procurement and the sponsor, and approval recorded with date.
• Sampling rationale: how many carrier assignments and list reviews you will examine under the extended scope, and the basis for the sample.
• The report: scope section states the original and extended scope and when the extension occurred; the finding is now written against SOP-207 with its own evidence.

Must not change:

• Evidence already collected. The four shipments stay as found; you do not retro-fit them to the new scope or re-sample until the finding disappears.
• Independence. The sponsor's influence on scope must not appear as a technical justification; record the original request and the approval trail separately.
• The original findings against SOP-114, if any, which stand on their own.

Also consider: the extension was triggered by an audit discovery, so the programme risk assessment should be updated - if procurement's approved lists are stale here, other sites or categories may share the failure mode.