Scope, Sampling and a Utility That Wants to Stay at Home
You are lead auditor for an initial certification audit of a regional water utility. The proposed scope is 'treatment and distribution of drinking water; collection and treatment of wastewater'. The organisation operates two treatment works, 34 pumping stations and 480 staff; sludge is dewatered on site and then tankered away by a contractor. Stage 1 identified that the effluent discharge consent was exceeded four times in twelve months, that the consent is up for renewal, and that the sludge contractor's waste registration has lapsed. The client asks that the whole of stage 2 be conducted remotely, and asks you to remove sludge disposal from the scope 'because we outsource it'. Your procedure permits remote activity where justified, with on-site verification where risk requires it.
1. Can the client exclude sludge disposal from the certification scope? Justify your answer against the standard and state what you would tell the client.
Read the worked answer
Framework: 4.3 requires the scope to be documented, available to interested parties, and to state the activities, products and services covered. It must be credible: an organisation cannot use the scope statement to carve out activities within its control or influence that generate significant environmental aspects. 8.1 requires outsourced processes to be controlled or influenced, and 6.1.2 requires a life-cycle perspective.
Applying it here:
- The sludge is generated by the utility's own treatment process. Dewatering, storage and loading on site are unambiguously within its control.
- Disposal by a contractor is an outsourced process. Outsourcing transfers execution, not the obligation to control or influence. The contractor's lapsed registration is precisely the kind of control failure the EMS should have caught (8.1 plus 9.1.2).
- Excluding 'sludge disposal' would leave the certificate describing a wastewater treatment system whose principal residual waste stream is unmanaged, which makes the scope misleading.
What to say: explain that the CB certifies against the scope that reflects the actual activities and aspects; the utility may define the boundary of sites, but not strip out an aspect. Offer the constructive route: keep sludge management in scope, define the controls and the monitoring of the contractor, and let the outsourcing arrangements be audited as an operational control. If the client insists, the matter escalates to the certification decision function, not to the lead auditor's discretion.
2. The client wants stage 2 fully remote. How do you decide, and how do you justify your sampling of sites and shifts?
Read the worked answer
Decision logic, not preference: remote techniques are a delivery method, not a reduction in the requirement to obtain sufficient objective evidence. Ask what evidence can only be gathered on site: physical condition of bunding and storage, the state of monitoring and sampling points, emergency equipment and drills, and the observation of operations on the shift where the consent breaches occurred.
Risk factors pointing on site:
- Four consent exceedances in twelve months is a legal-compliance and environmental-impact signal; 9.1.2 evaluation of compliance must be verified where the discharge actually happens.
- A lapsed contractor registration indicates a live control weakness at the sludge loading point.
- Emergency preparedness (8.2) and monitoring equipment (9.1.1) are inherently observation-based.
Sample design: both treatment works must be visited, because the consent applies to the discharges from them; do not sample them as interchangeable sites. Sample pumping stations on a risk basis (those nearest sensitive receptors, those with recent alarms), and record why you did not visit others. Cover the night or weekend shift at at least one works, since that is where the exceedance risk sits and where supervision is thinnest. Remote interviews can carry management review (9.3), internal audit records (9.2) and central documented information.
Record the rationale for the remote/on-site split and the sampling in the audit plan and report; that record is what makes the audit defensible later.
3. What competences must the audit team have, and what impartiality issue must you resolve before the audit starts?
Read the worked answer
Competence (ISO 19011 and the CB's competence criteria):
- Technical knowledge of wastewater treatment sufficient to interrogate the consent conditions, sampling regimes, laboratory results and calibration of the monitoring chain, plus drinking-water treatment for the other half of the scope.
- Knowledge of the applicable environmental legal requirements in this jurisdiction, including how the consent renewal process affects compliance obligations (6.1.3).
- Ability to work in the language of the operators, or an interpreter briefed on audit technique; a good technical expert who cannot be understood on the night shift adds nothing.
- Sector knowledge for outsourced sludge management and waste regulation.
Impartiality: a team member who has provided consultancy, or been employed by the utility, within the period defined by the certification body's rules must be excluded. Where a technical expert is used to cover a competence gap, the expert advises and does not audit as an auditor; the findings remain the responsibility of auditors, and the expert must also be free of a consultancy relationship with the client.
Also check: whether the added sludge scope changes the audit time calculation. If the scope stays broad, the plan must reflect the extra processes and sites, not absorb them into the same days.