Audit Planning, Scope, and Objectives
Domain 3 tests whether you can define an audit so that its conclusion means something: objectives, scope, criteria, programme, and plan are separate artifacts that must not be blurred.
Core rules
- An audit programme is the set of audits planned over time; an audit plan is the schedule and logistics for one audit.
- Objectives state purpose; scope states boundaries (sites, activities, products, period); criteria state what is compared against (ISO 14001, permits, internal procedures).
- ISO 19011 expects risk-based planning: previous findings, process changes, complaint history, and significance of aspects drive time allocation and sampling.
- Initial certification uses Stage 1 (readiness, documentation, context, internal audit and management review completed) and Stage 2 (conformity and effectiveness).
- Team selection follows the competence needed for the scope, and impartiality must be checked before assignment.
- Sampling needs a stated rationale so the conclusion can be defended afterwards.
Worked example
A scope statement reads “EMS at the Riverside plant, excluding wastewater treatment, which is outsourced.” The auditor checks two things: is the exclusion described accurately, and does the outsourced activity generate significant aspects? It does - trade-effluent compliance. Because the organization retains responsibility for control of outsourced processes (8.1), the exclusion cannot be used to avoid auditing how that process is controlled. The finding attaches to the scope statement and the planning process, not to the plant floor.
Traps that cost marks
- Writing scope as if it were criteria, or leaving the audit period undefined.
- Planning only from a generic checklist and ignoring previous audit results.
- Allocating time evenly instead of by risk and significance of aspects.
- Letting the client edit the scope mid-audit without recording and justifying the change.