Three requests two weeks before the stage 2 audit
Two weeks before a stage 2 EMS certification audit at a printing company, the HSE manager sends three requests. First, the audit criteria should be "the corporate EHS standard and our main customer's supplier code, instead of ISO 14001". Second, the team should not visit the ink and solvent store or the plate-making area because that is "commercial information". Third, the audit must run 09:00–14:00 each day to suit production and should take two days rather than the three days the previous certification body used. The scope statement excludes "production of printing plates", yet every plate used on site is made in-house. The legal register records a solvent-consumption threshold above which a permit is required. The site employs 310 people over two shifts.
1. Respond to each of the three requests. Show the reasoning you would use and what the client is entitled to know.
Read the worked answer
Request 1 - criteria. The client may add criteria (corporate standard, customer code) and those become auditable, but ISO 14001 cannot be replaced: the certificate is issued against ISO 14001, so it is the primary criterion. Adding the corporate standard also increases audit effort and needs to be reflected in time. If the corporate standard is stricter, findings against it may still be raised, but classification against ISO 14001 must be clear. Reply: criteria = ISO 14001 plus the client's own EMS documentation (mandatory under 14001), optionally plus corporate/customer requirements if the client confirms they are mandatory for them and time is adjusted.
Request 2 - access. "Commercial information" is not a valid reason to exclude an area with significant environmental aspects (VOC storage, solvent handling, plate processing and its wastes). The audit must sample the aspects and compliance obligations, not the company's trade secrets. Offer practical safeguards: confidentiality undertaking for the team, no copying of formulation records, sampling of records read on site. If access is genuinely refused, the audit cannot conclude coverage of those aspects; record the limitation, report it, and the CB must consider the effect on certification. Do not negotiate away the sample.
Request 3 - timing and duration. Daily windows may be negotiated around shift handovers and process start-ups, but 09:00–14:00 only will miss the start of shift and possibly the second shift entirely - plan must sample both shifts. Audit time is determined by the CB's justified calculation (IAF MD 5 inputs: 310 effective personnel, complexity, permits, shift pattern, significant aspects), not by the client's preference or the previous CB's figure. Explain the calculation and be prepared to justify the difference from three days; if the client provided inaccurate information at contract review, the CB may need to revise the quotation.
2. What must your working documents and audit plan contain to support the audit you have just described?
Read the worked answer
The plan (19011 6.3) should show, as a minimum:
- Objectives, scope, criteria - with criteria explicitly listing ISO 14001, the client's EMS documentation, and any added corporate/customer requirements; scope matching the documented 4.3 statement as verified, not as assumed.
- Team roles and allocation by process/aspect, with clause coverage mapped to processes (not a clause-by-clause walkthrough).
- Time and location detail, including both shifts, handover, the effluent plant, solvent store and plate-making, and the sampling rationale for each.
- Interviews by role (operators, store keeper, maintenance, contractor supervisor, top management), and site tour routes.
- Checklists or process worksheets built around the significant aspects and compliance obligations: for each, what to look for, what records to sample, what performance indicators apply.
- Evidence of preparation: review of the previous audit report and NCs, the legal register, permit conditions, the aspect register, the 9.2/9.3 outputs, and the client's context analysis - so the audit tests risk, not just conformity.
- Contingency note if access or shift coverage is refused, and how it will be recorded.
Circulate the plan to the client in advance for agreement on access, guides and timing, and record any agreed changes. Also confirm with the client the status of the plate-making exclusion: if the activity is in-house and within the physical boundary, the plan should test the exclusion as a potential 4.3 finding rather than silently accept it.
3. Assume the exclusion of plate-making stands. What is the consequence for the certification decision, and how do you handle it at the closing meeting?
Read the worked answer
Analysis. Plates are made in-house, on the same site, under the same management control, using solvents and generating hazardous waste. Under 4.3 the boundary must reflect activities the organisation controls, and the scope must be documented and available to interested parties. An exclusion that removes a genuine aspect and a likely permit trigger makes the scope statement misleading and leaves part of the operation outside the EMS - a nonconformity against 4.3 (and 4.4) and, because scope underpins the certificate, normally a major.
At the closing meeting:
- State the finding and its evidence plainly: the in-house plate line, its solvent use, its wastes, and the absence of any EMS coverage for it. Avoid attributing motive.
- Explain the effect on the certification decision: the CB cannot certify a scope it knows to be inaccurate. The options are (a) extend the EMS to cover plate-making, with the CB adjusting audit time and re-auditing that area, or (b) the client demonstrates a defensible boundary (e.g. a genuinely separate legal entity and site) - unlikely on the facts given.
- Do not accept a verbal promise to "add it next year"; the correction and corrective action must be verified.
- Record the client's response in the report, and pass the finding to the certification decision-maker, who is the person empowered to decide - not the audit team.