Manifest Sampling at a 1,100-Ton Hazardous Waste Generator
You are the lead auditor for a three-day ISO 14001 surveillance audit at a plant that generates about 1,100 tons of hazardous waste per year. You ask for the manifest log covering the last 12 months, which shows 168 shipments. The waste coordinator instead hands you 40 manifests that she selected 'for convenience.' From those you sample 25 and find: three have no returned copy from the disposal facility, one lists waste code D001 while the container label says F003, and one carries a stamped facsimile of the generator signature. The coordinator says the missing receipts 'probably got lost in the mail' and offers to call the facility while you continue. Four hours remain before the closing meeting. There is no evidence that manifesting has been internally audited in the last two audit cycles, and the site's procedure requires exception reports when receipts are not returned within 45 days.
1. The coordinator offers to call the disposal facility while you continue sampling. Is that acceptable evidence? What sampling approach would you use before drawing a conclusion?
Read the worked answer
A phone call is corroboration at best, not audit evidence. It is oral, untraceable, and cannot be verified later; the audit criterion is a returned receipt or a documented exception report. More importantly, the 40-manifest frame is not a sample - it is a convenience selection, so the 3 misses in 25 cannot be extrapolated to the 168 shipments. Before concluding, I would (1) reconcile the manifest log to generation records (waste shipments, container counts, purchase records) to confirm completeness; (2) draw a documented random or systematic sample from the full 168, stratified by waste stream and disposal facility, using a random number generator and recording the method; (3) expand the sample if exceptions appear, because 3/25 gives a wide confidence interval. Only a verified receipt or exception report closes an exception. The coordinator's offer can be used to locate documents, but the documents must be examined. I would also check whether the site's manifest tracking has a 45-day tickler, because the pattern of missing receipts matters more than the individual misses.
2. Classify the three exceptions and state what you would report at the closing meeting.
Read the worked answer
Missing receipts: the generator must file an exception report when the returned copy is not received within 45 days. If no exception reports exist, this is a nonconformity against the site procedure and the regulatory requirement. Three in a 25 sample suggests a tracking gap; whether it is major depends on the expanded sample and whether an exception-reporting process exists at all. Waste code mismatch (D001 on the manifest, F003 on the label): first verify the waste determination, the land-disposal-restriction notification, and the receiving facility's copy. If the facility received the wrong code, the error may have regulatory consequences; it also shows the waste determination or manifest review is unreliable. I would treat it as a nonconformity, likely major if other manifests show the same stream coded inconsistently. Stamped signature: 40 CFR 262.23 requires the generator's certification to be signed by an authorized person; a facsimile stamp may be acceptable only if there is written authorization. If not, it is a documentation nonconformity, but I would sample other manifests for the same practice. At closing I would report confirmed findings, state that the population conclusion awaits the expanded sample, and refuse to accept 'we'll call them' as correction.
3. What does the absence of internal audit coverage of manifesting indicate, and what corrective action would you require?
Read the worked answer
Manifesting is a high-risk process with direct regulatory consequences, so two audit cycles without coverage suggests the audit programme (ISO 14001 clause 9.2) is not risk-based. I would check the audit programme's criteria, scope, and frequency, and whether manifesting was omitted because no one was competent to audit it. The corrective action must address root cause, not just retrieve the receipts. A credible plan would: assign a named owner for manifest reconciliation; implement a log with a 45-day due date and escalation; train generators and shipping staff on waste codes and authorized signatures; add manifesting to the internal audit schedule with a competent auditor; and verify effectiveness by sampling the next 50 manifests at the next surveillance audit. I would also check management review inputs, because a high-risk process with no audit coverage and no exception reports should have surfaced there. Verification of closure would require evidence of the new log operating for at least one quarter, not a signed procedure.