The distribution centre that sits outside the QMS scope
A regional logistics company operates a 6 000 m² distribution centre 30 km from head office. The centre is leased, staffed by 42 company employees who work under company SOPs and company IT systems; only forklift maintenance is contracted out to the lessor. Two key customer contracts name this centre as the delivery point and require its use in the event of a stock-out at head office. The integrated QMS/EMS scope statement reads: 'Design and operation of warehousing and transport services, excluding the Northern distribution centre, which is operated by a third party.' The quality manager explains the exclusion: 'the landlord controls the building, so we cannot apply the standard there; our previous certification body accepted the wording.' No further justification is documented, the procurement procedure contains no criteria for controlling externally provided processes, and the centre appears in the internal audit programme only as a 'site visit for environmental aspects'.
1. Assess the exclusion against the management system standard the organisation has adopted. Is this a permissible exclusion, an outsourced process, or an in-scope activity? Justify your reasoning.
Read the worked answer
Three concepts are being conflated and must be separated.
Exclusion (ISO 9001:2015, 4.3). An exclusion is permissible only where the requirement cannot be applied and does not affect the ability to ensure conformity of products and services. All three tests fail here: the building is leased, but the 42 employees, the SOPs, the IT systems and the service delivered to customers are under the organisation's control. Requirements such as 8.5.1, 7.1.5 and 9.1.2 can be applied. The exclusion is not justifiable.
Outsourcing (8.4). Forklift maintenance is an externally provided process. It does not move the site out of scope; it creates a control obligation - selection and monitoring criteria, and retained responsibility for conformity.
Scope as documented information. 4.3 requires the scope to be maintained and any exclusion justified. One sentence is not a justification, and 'the certification body accepted it' is not evidence of conformity - prior acceptance is not an audit criterion.
Conclusion: the scope statement is a nonconformity against 4.3, and the absence of any control of the outsourced maintenance is a likely nonconformity against 8.4.1. The environmental boundary must be assessed separately against ISO 14001:2015 4.3 and 4.4, since a landlord-controlled building may genuinely affect aspects the organisation cannot manage.
2. You must now write this up as an internal auditor. Formulate the finding components and state which audit criteria apply, including whether the organisation's own procedures can serve as criteria.
Read the worked answer
An internal audit finding is built from criteria, evidence and conclusion, and the criteria are set by the audit programme and audit client - normally the organisation's own procedures plus the standard it has adopted.
Criteria: ISO 9001:2015 4.3 (scope determination, justification, documented information); 8.4.1 (control of externally provided processes); the internal procedure governing scope, if one exists.
Evidence to collect: the controlled copy of the scope statement and its approval date; the lease and the staffing list showing company employees; the two customer contracts; the organogram showing the centre reporting into operations; the procurement procedure showing no supplier criteria for maintenance; interview notes with the quality manager (date, role); and a trace of one delivery to confirm the centre is actually used for contracted customers.
Conclusion: 'The QMS scope excludes the Northern distribution centre although the site is staffed and controlled by the organisation and delivers to contracted customers; no justification is documented, and the outsourced forklift maintenance is not controlled.' Grade it using the programme's classification rules - likely major, since a whole operating site sits outside the system.
The auditor must not accept the quality manager's account without testing it, and should record a nonconformity rather than an observation: the requirement is clear and the evidence is documentary.
3. What do the process approach and risk-based thinking imply for how you would audit across this boundary, and how would the audit programme change if the centre stays in scope?
Read the worked answer
The process approach means following the flow of value and its interfaces rather than auditing departments in isolation. The audit trail would start with order acceptance, move through stock allocation, picking, loading, transport and delivery confirmation at the Northern centre, and end with complaint handling (9.1.2) and the interface to outsourced maintenance (8.4). Auditing only at head office tests the paperwork, not the process.
Risk-based thinking directs effort to where failure would most affect customers and legal requirements: a single-site stock-out, maintenance downtime on the only forklifts, driver competence, and any hazardous or temperature-sensitive goods. Those risks determine depth, sampling and frequency, not the convenience of the audit team.
For the programme, once the site is in scope its processes need coverage at a frequency justified by risk, and the interfaces should be audited in the same audit or a linked one so that hand-offs are seen rather than assumed. The programme should also verify that the scope decision was escalated to top management (5.1.2 and 9.3.2 inputs), because determining the scope of the system is a top-management decision and an unjustified boundary undermines the effectiveness of everything inside it.