Two days, two warehouses and a plan that does not reflect the risk
You are lead auditor for a surveillance audit of a third-party logistics provider: head office plus two warehouses 60 km apart. Total audit duration is 2 person-days, one auditor plus a technical expert for the cold-store area. The audit plan you inherited allocates 45 minutes to management review, 30 minutes to internal audit, and 5 hours to clause 8.5. Documentation review shows that the internal audit programme lists 11 processes, but audits of 'returns' and 'customer property' are shown as 'postponed' since 2022; the most recent management review minutes list 4 of the 7 required inputs. Yesterday the client emailed asking to add a newly leased warehouse in another region to the certification scope 'while you are here'.
1. What do you change in the audit plan before the opening meeting, and how do you justify it?
Read the worked answer
The plan is risk-blind. The documentation review has produced two significant signals (internal audit coverage gaps over two years, incomplete management review inputs) and the plan gives them 30 and 45 minutes respectively, while 8.5 gets 5 hours. ISO 19011:2018 requires the audit plan to be risk-based and to be revised where necessary as the audit progresses.
A defensible re-plan for 2 person-days (roughly 16 hours, minus opening, closing, breaks and travel):
- 9.3 management review: 60–75 min, covering the three missing inputs specifically;
- 9.2 internal audit: 60–90 min, covering programme, criteria, auditor independence and the two postponed processes;
- 8.5 and 8.6: reduce to around 3–3.5 h, since it is a surveillance audit and prior performance is known;
- add time for 8.4 (external providers of transport/subcontract warehousing), 8.7/10.2 (returns, nonconforming output, customer property) and 7.5;
- explicit travel and opening/closing slots in the written plan.
Justify it at the opening meeting in terms of audit objectives, identified risk and the need to cover each process at least once - not in terms of 'the client's convenience'. Changes to the plan must be agreed with the audit team and communicated to the auditee; keep a record of the revision and the reason, because the reviewer and any witness assessor will ask.
2. How do you sample the two warehouses and the shifts, and what do you record as the rationale?
Read the worked answer
First separate two ideas: certification-level multi-site sampling (IAF MD 1) is not the same as audit sampling of processes and records. If both warehouses are named in the certification scope as individual sites, you must audit both; you cannot drop one on a sampling argument.
Process/record sampling within and across sites:
- choose the shift with the highest risk profile (usually nights or weekends, when supervision is thinner and the cold chain is most exposed) and one other shift if time allows;
- select records both randomly and judgementally: e.g. 10 dispatch consignments per site, 5 returns, 5 customer-property items, and any consignment involving the postponed processes;
- follow items end to end (from order to delivery confirmation) rather than sampling each clause separately in isolation, which is how real failures show up;
- use information from prior audits and complaints to target the sample.
Record the rationale in the working documents: population size, method (random/judgemental), what was covered, what was deliberately excluded, and why. The rationale is what distinguishes a defensible sample from a convenient one, and it is the first thing questioned when a finding is challenged. If a sample reveals a failure, extend the sample before concluding - a single instance supports an observation; a pattern supports a nonconformity.
3. How do you handle the request to add the new warehouse to the certification scope?
Read the worked answer
Adding a site to a certified scope is a change affecting certification, not an item for the audit plan of an already-planned surveillance audit. It requires planning, determined audit duration, competent resources and an audit of the new site before any certification decision.
Practical handling:
- Do not add it to this audit. The current audit is already time-constrained and the new site is in another region; auditing it properly would invalidate the coverage of the existing plan.
- Confirm in writing to the client that the certificate does not cover the new warehouse until it is audited and the certification body makes a decision. If the client's customers may be misled, that must be explicit and prompt.
- Report the change to the certification body client manager so that an extension audit can be scheduled - with duration computed against IAF MD 5 factors (headcount, complexity, shifts) and with competence for the site's activities.
- Check the contract and the client's obligations to notify changes that affect certification; note in the report that the notification was received, and its date.
Record the request and your response in the audit working documents. The judgement the exam is testing is that scope integrity is not negotiable against an audit timetable: a scope element that has not been audited cannot appear on a certificate, even if everyone 'knows' the site is fine.