Drawing the Boundary: Scope, Leased Sites and Outsourced Coating
A metal-finishing company operates an owned plant (Plant A) with anodising and plating lines, an on-site wastewater treatment plant discharging to the municipal sewer under a discharge permit, and a leased warehouse 6 km away that stores 8 tonnes of nickel sulfate and 12,000 litres of acids. Its head office, with 30 staff including design and sales, is in a leased office 12 km from the plant. Powder coating of finished parts is outsourced to a job shop that owns the process, the equipment and the operators; the job shop applies coatings to the company's specification. About 60% of sales go to EU customers who require RoHS declarations and increasingly ask for product carbon footprint data. Top management proposes the scope statement: 'Design and manufacture of anodised and plated components at Plant A.' The EHS lead supports it, arguing that the head office and the leased warehouse are 'not core activities' and that the outsourced coating 'is not our activity, so it cannot be in our scope'.
1. Assess the proposed scope statement against the requirements for determining the scope of an EMS. Which exclusions, if any, are defensible?
Read the worked answer
The scope must be determined considering the external and internal issues (4.1), the needs and expectations of interested parties (4.2), and the compliance obligations (4.3). Critically, it must be documented and available to interested parties, and it must not exclude activities, products or services within the organisation's control or influence that have significant environmental aspects.
Leased warehouse - not defensible. The lease is irrelevant; the test is control and influence. Storing 8 tonnes of nickel sulfate and 12,000 litres of acid carries credible significant aspects (spill to stormwater, firewater runoff, soil contamination). Excluding it because it is 'not core' is exactly the exclusion the standard prohibits. Either it is inside the scope, or the company must be able to show those aspects are managed under another credible system - it cannot.
Head office - partly defensible but unwise as stated. The office's own aspects are modest, but 4.3 requires consideration of activities within control or influence. The design and sales functions there determine materials, coatings and customer commitments; excluding 'design' while keeping it in the scope statement is internally contradictory.
Outsourced coating - cannot be waved away. It is an outsourced process under 8.1, which must be controlled or influenced, and its aspects fall within the company's influence under 6.1.2.
A defensible statement covers all sites and functions, with significance assessed per activity.
2. The company wants to keep the scope short and says 'the scope statement is just a sentence, the real work is in the aspect register'. Explain what 4.3 and 4.4 actually require, and what documented information is needed.
Read the worked answer
The scope is not a marketing sentence; it is a boundary decision that determines what the rest of the system must cover. Under 4.3 the organisation determines the scope considering 4.1, 4.2 and 4.3, and must retain it as documented information available to interested parties - customers, regulators, the certification body. Under 4.4 the EMS must then actually cover everything inside that boundary, including the processes needed and their interactions.
The test is consistency between three artefacts:
- Scope statement - what is covered.
- Aspect register and compliance obligations register - which must include every activity, product and service inside the scope, including leased sites and outsourced processes the organisation controls or influences.
- Operational controls and monitoring - which must exist for the significant aspects identified.
If the register lists warehouse spill risk and job-shop coating while the scope statement excludes both, an auditor has a straightforward nonconformity: the scope is not credible and is being used to shrink the audit. If the register also excludes them, the failure moves to 6.1.2 and is worse.
Practical approach: write the scope at the level of activities and functions, not buildings. For example: 'Finishing, storage and distribution of anodised and plated components at Plant A and the leased warehouse, including design and sales at head office; powder coating is an outsourced process controlled through specification and supplier oversight.' Keep the sentence readable, but let it be true.
3. The job shop proposes switching to a chrome-free pretreatment, which changes the waste it generates, and refuses to share its process data, calling it confidential. How should the company handle the outsourced process, and what does this refusal change?
Read the worked answer
8.1 requires that outsourced processes be controlled or influenced, with the type and degree of control defined within the EMS. The company writes the coating specification, so it already has influence; the question is whether that influence is designed or accidental.
The switch is a change, which triggers 6.1.2 (consideration of planned or new developments and changes) and 8.1. Practically:
- Assess the change before approval. Ask what waste streams the new pretreatment creates, how they are managed, and whether the resulting product still meets the RoHS and customer declarations. If data is withheld, that is itself a risk to record under 6.1.1.
- Put the requirement in the contract. Specify the coating standard, the chemicals permitted or prohibited, notification of process change, waste management expectations, and a right to audit or to receive periodic declarations. That is the control mechanism; the scope statement is not.
- Use procurement as the influence point. 8.1 expects a life-cycle perspective in design and procurement; supplier selection and specification are where the company's leverage sits.
A refusal to share data does not remove the aspect from the company's EMS - it shifts it into risk and into supplier evaluation. If the job shop cannot demonstrate control, the options are a different supplier, tighter verification, or documented acceptance of the risk by top management. What is not acceptable is recording the process as 'outside our scope'.