Scope Creep at a Fastener Distributor
An ISO 9001 certification audit is underway at a fastener distributor. The client's certification scope is 'warehousing and distribution of industrial fasteners.' The audit plan covers headquarters and samples two of four warehouses, W1 and W2, chosen because their internal audit scores were highest. With 1.5 audit days left, the auditor visits W3 after a schedule change. W3 contains a 14-person kitting cell that repacks fasteners into customer-branded kits, applies customer labels and lot codes, and ships to three automotive customers. Kitting is 22% of W3 revenue. The only work instruction is a printed customer email from 2023. There is no label-accuracy verification record, and operators say the customer changed label format twice in 2024. W4 has not been visited and may have similar activity. The client says kitting is 'just distribution.' The certification body's audit time was calculated without kitting.
1. Evaluate whether the audit scope, sampling plan and remaining audit time are still valid. What audit trail should the auditor follow before concluding?
Read the worked answer
The plan is no longer reliable. Audit scope is not just a sales description; it must cover processes that affect conformity. Kitting changes product identification, labelling and traceability, so it is a process within the distribution activity unless the client can show it is excluded. Sampling two of four warehouses was based only on internal audit scores, which is a weak risk basis; the sample did not consider process complexity, customer-specific requirements, changes or complaint history.
The auditor should trace the kitting process end to end: customer label requirements and revisions, work instruction approval, label verification, traceability, training, customer approvals, and complaints. The auditor should also establish whether W4 performs kitting by asking for process maps, revenue data, staff counts, customer lists and a remote walk-through, then decide whether a site visit is needed. If the activity is material, the audit time and sample are insufficient; the team leader and certification body must be informed before the audit conclusion.
2. What immediate actions should the auditor take regarding W3 and W4, including communication with the client and certification body?
Read the worked answer
Do not simply write a finding and leave. First inform the client that an undisclosed process has been found and ask for evidence that it is within or outside the certification scope. If it is within scope, request a plan change: add W3 and possibly W4, extend audit time, and assign an auditor competent in kitting and labelling. If the client refuses or time cannot be extended, record the limitation and consider whether a certification decision can be made.
The auditor should not audit W3 superficially or accept a verbal assurance. The certification body must decide whether the audit can continue, whether a special audit is needed, or whether the scope must be clarified. Communication should be factual, not accusatory. Any finding should be raised only after evidence is gathered, and the client should have the chance to provide records.
3. Assume the kitting process is confirmed as an undisclosed activity affecting product conformity. Draft a nonconformity statement and justify whether it is minor or major.
Read the worked answer
Possible NC: 'The organization has not ensured that the customer-branded kitting process at W3 is controlled. Customer label format changes from 2024 were not reflected in a controlled work instruction, and there is no evidence that labels were verified before release. This affects product identification and traceability for three automotive customers.' Clause links: 8.5.1 control of production, 8.5.2 identification and traceability, 7.5.2 documented information.
Classification: major if the auditor confirms that multiple shipments went out with unverified labels or that the process is widespread and the control system has failed; minor if it is isolated, containment is immediate, and no incorrect labels were shipped. The key evidence is whether label errors occurred, whether customer requirements were available, and whether the organization can trace affected lots. Major is justified when the failure is systemic or creates significant risk of product misuse; minor only when it is a single lapse with effective correction.