Scope boundary and the customs subsidiary
Northwind Logistics Ltd is a 1,400-employee freight forwarder seeking ISO 37301 certification. Its draft scope statement reads: "Freight forwarding, warehousing and customs clearance services, excluding customs brokerage services provided by Northwind Customs Brokers GmbH, a wholly owned subsidiary in Hamburg." The subsidiary has 60 staff, €18 million revenue, uses the parent's compliance policy and whistleblowing hotline, and the parent's compliance officer approves its procedures. It files import/export declarations for the parent's clients and holds the customs licence under which several parent sites operate. Top management says the subsidiary is a separate legal entity with a different regulator, so it is out of scope; no interface controls or shared obligation register exist. The audit objective includes determining whether the CMS covers all activities within scope and whether compliance obligations are complete. The parent's obligation register lists environmental and employment law but no customs or export-control requirements.
1. Is the exclusion of the Hamburg subsidiary defensible under ISO 37301 clause 4.3? Explain the criteria you would apply.
Read the worked answer
No, not on the facts as stated. Clause 4.3 requires the scope to state the activities, products and services covered and not to exclude activities that affect the CMS's ability to ensure compliance. Legal-entity separation is not determinative. The subsidiary performs customs brokerage for the parent's clients, uses the parent's policy and hotline, and the parent's compliance officer approves its procedures. Those are interfaces that must be managed. The auditor should test whether the parent has compliance obligations arising from the customs licence, client contracts and regulatory liability. If the subsidiary is excluded, the scope statement needs a justified boundary and documented interface controls; otherwise the exclusion is a nonconformity because the CMS cannot ensure compliance for services delivered under the parent's licence and brand. The finding should cite 4.3 and, if obligations are missing, 4.5.
2. What evidence would you examine to determine whether customs and export-control obligations are complete?
Read the worked answer
I would build a trace from obligation sources to controls and records rather than rely on the register alone:
- Compare the customs licence conditions, client contracts and regulator correspondence with the obligation register.
- Interview the subsidiary's licence holder and the parent's compliance officer separately about who identifies and updates customs and export-control requirements.
- Sample at least 10 declarations, including dual-use or restricted-destination shipments, and trace each to screening evidence.
- Check the change log for tariff, sanctions and export-control updates over the last 12 months.
- Review penalty notices, voluntary disclosures and legal invoices for customs matters.
- Test whether the subsidiary's register feeds the parent's risk assessment.
Completeness is demonstrated by source coverage and update evidence, not by the existence of a register.
3. If sampling shows that three customs penalties paid by the subsidiary in 18 months were not in the parent's register and no interface control exists, what finding would you raise and why?
Read the worked answer
This supports a major nonconformity, not an observation. The evidence shows a systemic omission of a high-risk obligation category across a unit that performs in-scope services, and the absence of interface controls means the CMS cannot detect or correct the omission. The finding should cite 4.5 for incomplete identification of compliance obligations, 4.3 for the unresolved scope boundary, and 8.1 if operational controls for customs declarations are not implemented. The report should state the population, the sample, the three penalty records and the missing register entries, and explain the compliance risk. Immediate payment of the penalties would be a correction only; it would not close the nonconformity because the identification and interface processes remain ineffective.