Scope, boundary and outsourced maintenance at a water utility
Northgate Water is a regional utility serving 1.2 million customers through 14 treatment plants, 6,200 km of mains, 38 pumping stations, a SCADA/OT network and a 900-vehicle fleet. Its ISO 55001 scope statement reads: 'Operation and maintenance of water treatment and distribution assets at the 14 treatment plants.' The asset management system manual, however, says the system covers 'all assets owned or used by Northgate Water'. Capital project delivery and the SCADA/OT network sit outside the stated scope, although both affect asset performance and lifecycle cost. Maintenance of pumps and valves is 60% outsourced to a single contractor; the contract contains service levels and safety rules but no asset management requirements, and the contractor's work orders are not visible in Northgate's CMMS. The internal audit programme sampled only the treatment plants. The audit team is preparing a stage 2 audit and must decide how to treat the scope and boundary issues.
1. Does the scope statement meet ISO 55001:2014 clause 4.3? Explain the audit consequences if it does not.
Read the worked answer
Clause 4.3 requires the scope to state the boundaries and applicability of the asset management system and to be available as documented information; it must identify the assets, activities and interfaces covered. Here the scope is narrower than the manual's claim. Capital projects and SCADA/OT affect the in-scope assets' performance, risk and lifecycle cost, so excluding them without explaining interfaces leaves the boundary ambiguous.
The auditor should first clarify with top management whether the exclusions are deliberate and justified. If the system genuinely excludes them, the manual must be corrected and the interfaces described. If not, the scope statement does not reflect the system. Either way this is a finding: a nonconformity against 4.3 and 4.4 if the organization cannot demonstrate control across the claimed scope.
Audit consequence: the audit plan, criteria and sampling must match the agreed scope, and the certification scope cannot be broader than the asset management system scope. The team should not simply audit the manual's 'all assets' claim while the client's scope excludes major asset lifecycle activities.
2. How should the audit team treat the outsourced maintenance arrangement under clauses 8.1 and 8.3? What evidence would you require before raising a nonconformity?
Read the worked answer
An outsourced process that affects in-scope assets is still part of the asset management system boundary. Clause 8.1 requires operational planning and control; clause 8.3 requires the organization to ensure outsourced processes are controlled and to define the type and degree of control. The contract has service levels and safety rules but no asset management requirements, and the contractor's work orders are invisible in the CMMS. That suggests the organization cannot plan, schedule, verify or learn from 60% of maintenance.
But the auditor should test actual practice before concluding: Are there interface meetings, contractor reports, acceptance checks, KPI reviews or contractor audits? If controls exist and are effective but undocumented, the finding may be against 7.6 rather than 8.3. If no controls exist, raise a nonconformity against 8.3 and 8.1 with evidence: contract clauses, CMMS access, sample work orders, interviews with the contractor and planner, and asset management plans. Check whether the contractor's activities were included in risk assessment and whether the organization evaluates the contractor's performance against asset management objectives.
3. The internal audit sampled only the treatment plants. Is this a nonconformity against clause 9.2? Justify your answer.
Read the worked answer
Clause 9.2 requires an internal audit programme planned with consideration of the importance of processes, changes affecting the organization and previous audit results, and it must cover the asset management system. If treatment plants are the only in-scope operating assets, plant-only sampling may be defensible. But outsourced maintenance and the interfaces with capital projects and SCADA/OT, if in scope, are part of the system and affect asset performance. Excluding them from every internal audit is a coverage gap.
Check whether the programme considered the 412 backlog or prior findings. Examine the audit programme, criteria, scope of each internal audit and competence of internal auditors. A nonconformity against 9.2 is appropriate if a significant in-scope process has not been audited over a full cycle without justification. If the internal audit covered the process but sampled narrowly, the finding may concern the effectiveness of the audit rather than absence of coverage; phrase it accordingly.