Scope boundaries after an acquisition
You are the lead auditor for a certification body conducting a stage 2 audit of Northwind Logistics' ISMS. The scope statement reads: 'Head office and both distribution warehouses, including all IT services supporting order fulfilment.' Three weeks before the audit, Northwind acquired FastTrack Couriers, which runs a separate courier platform and processes customer address data on a cloud service. FastTrack staff use Northwind's ERP for billing. Top management says FastTrack is 'out of scope until integration is complete' and has not included it in the risk assessment or the Statement of Applicability (SoA). The internal audit programme covered only head office, and the management review minutes record the acquisition as 'commercial, no security impact'. The SoA lists all 93 Annex A controls as applicable, with no justification for inclusions.
1. Identify the requirements in question and state whether this is a nonconformity, with your reasoning.
Read the worked answer
Criteria. ISO/IEC 27001:2022 clause 4.3 requires the scope to be documented and to state boundaries and applicability, taking into account the issues in 4.1, the interested parties in 4.2, and interfaces and dependencies with third parties. Clause 6.1.2 requires risk assessment across that scope. Clause 6.1.3 e) requires an SoA with justification for inclusions and exclusions.
Reasoning. The scope statement is ambiguous: 'all IT services supporting order fulfilment' may or may not capture the shared ERP and FastTrack's billing use. Management's assertion that the acquisition has 'no security impact' is not evidence. If FastTrack staff can access Northwind systems or customer data, there is an interface/dependency that clause 4.3 requires the ISMS to address. The absence of any risk assessment for the acquired entity is a gap against 6.1.2. The bare list of 93 controls is weak evidence for 6.1.3 e), but the stronger finding is the unassessed boundary, not the number of controls.
Do not conclude yet. Interview the FastTrack process owner, obtain data-flow and contract evidence, and test whether Northwind can actually apply access control, logging and supplier management over the shared ERP.
2. How would you decide severity, and what would you do before reaching a conclusion?
Read the worked answer
Severity is driven by effect on the management system's ability to achieve intended results and by confidence in the certificate, not by the number of clauses cited.
I would gather evidence on:
- whether FastTrack data or the shared ERP falls inside the claimed scope;
- whether a security incident at FastTrack could affect Northwind's certified services;
- whether controls such as access rights, logging and supplier monitoring are applied to FastTrack users;
- whether the risk assessment and management review actually considered the change.
If the boundary is genuinely ambiguous and controls over the interface are unassessed, I would raise a major nonconformity or at minimum defer the certification decision. The certificate would otherwise tell customers that order fulfilment is covered while a material dependency is outside the system. I would present the objective evidence to the audit team, record it, and give the client the opportunity to correct: clarify the scope in writing, include or exclude with justification, and extend the risk assessment. I would not downgrade the issue to an observation simply because top management disputes materiality.
3. Top management refuses to change the scope statement. What are your options and what must be recorded?
Read the worked answer
I cannot recommend certification for a scope that is inaccurate. Options:
- Record the nonconformity with the objective evidence and state that the certification decision is deferred.
- Offer the client a legitimate narrowing of scope, in writing. If the client restricts the scope to head office only, I must test whether the exclusion is valid: can the ERP be separated, do FastTrack users have access, and are data flows outside the ISMS? If not, the narrowed scope may still be misleading.
- Escalate to the certification decision function, not to the client's commercial contact. The decision function may only certify an accurate scope.
- Assess audit programme implications: if earlier audits missed the interface, the programme's risk-based planning may need review.
Records should include the original and proposed scope wording, the evidence reviewed, management's rationale, the audit team's conclusion and the communication to the client. A verbal assurance is not sufficient.