Purpose, scope and criteria

Separate purpose, scope and criteria before drafting audit questions. Purpose identifies the decision the audit should support: conformity, system effectiveness, or follow-up of an action. Scope defines boundaries: sites, functions, processes, period, products and external interfaces. Criteria are the requirements against which evidence will be compared, such as a quality-agreement clause, product specification, internal policy or adopted standard. A record, interview or observation is evidence, not a criterion. “We will review records” describes a method rather than a purpose. Naming ISO 9001 without defining the activity, site and period does not establish a workable scope.

A useful purpose starts with a claim that a sampled audit can support: “assess whether label release requirements were applied to design and print-file transfer during the last quarter,” not “guarantee that no error exists.” An audit supports a bounded conclusion; a sample cannot prove universal absence of error. Ask who owns the decision and what action the report could inform. A purchasing manager may need a supplier follow-up decision, while a quality manager may need to judge the effectiveness of an internal change. The same records can be relevant to both, yet the applicable criterion and presentation of the conclusion may differ. Evidence-based judgment remains independent of a client's preferred result.

Scope is more than a list of buildings. Define the process from input to output and identify interfaces whose exclusion weakens the inference. For label release, the boundary may begin at technical-text approval and end at authorization to use a print file for a named batch. A subcontract printer may be an interface even when it is outside the auditor's right of access. Name the record period, mode of examination and justified exclusions. Do not turn an access limitation into a broad positive conclusion: if a camera prohibition prevents observation of production, say what was examined and what remains unverified. A changed scope should follow the applicable approval process and have its reason recorded.

An assignment may involve several kinds of requirement: a law within a specific jurisdiction, a contract between two parties, a technical specification and an internal policy. Do not import a rule from a different country or sector into a fictional case. Build a matrix with the precise requirement, source and edition, affected activity and expected evidence. If two texts conflict or precedence is unclear, the auditor records the issue and seeks competent legal or contract interpretation rather than inventing a legal ruling. For a paid external standard, do not attribute a detailed clause you have not read. ISO's public page describes ISO 19011:2026 as guidance for management-system audits; that overview does not expose the full clauses or make ISO 19011 itself a certification requirement.

Evidence can match a criterion yet be too narrow for the period or population in the audit objective. Suppose a fictional policy requires two approvals before a label change. One record with both signatures demonstrates one transaction; it does not establish that every change in the year received them. Conversely, one missing signature does not prove that all changes failed. Make a finding about the examined record, enlarge the sample where risk and time justify doing so, and state the selection logic. A narrow, traceable finding is stronger than an unsupported assertion of system-wide weakness.

Keep a short trace for every test: requirement ID, document edition, process location, record or interview ID, conformity decision and sampling limit. If a procedure changed during the period, do not apply its July wording to a January transaction without evidence that it was then effective. Record effective dates and split the sample by version when necessary. A transaction can satisfy an earlier rule and fail a later one. When no reliable effective version is available, mark the decision criterion unverified instead of issuing a nonconformity under a newer text. This matters in design changes and electronic records whose controlled versions can change quickly.

Scoping also means saying what the assignment cannot answer. If a buyer asks to “verify labels in every market” but provides one day, six records and access to two markets, propose two alternatives: a narrow scope supporting conclusions about those records and markets, or more resources for a broader scope. A coverage percentage does not make six records a guarantee, even if selection were random, and a complaint-led sample cannot estimate prevalence. Present that tradeoff to the commissioning party before fieldwork while preserving the auditor's ability to state evidence limits in the final report. Time is a resource to manage honestly, not a reason to expand the claim after inspection.

Test each scope line by asking which evidence could change the judgment. If the purpose is two-person approval effectiveness, two signatures alone are insufficient when one could be automatic or post-transfer; time order, identity and authority matter. For a supplier agreement, establish whether approval is required by the contract itself or an incorporated procedure and which edition applied on the transaction date. An integrated audit may apply two different criteria to the same process. Give each its own column and do not treat similar evidence as satisfying both without testing each condition. At scope closure, state exclusions, reasons and their effect on findings. Excluding the highest-risk step can make the original purpose impossible to answer; then revise the purpose or obtain access rather than retain an unsupported broad title.

When sharing the plan with client and auditee, invite correction of factual access and sequencing, not removal of an uncomfortable criterion. If records switched from paper to digital halfway through the period, revise evidence sources and time strata rather than leaving half the population invisible. If a subcontract printer is beyond visit rights, put that interface in the report limit and test what the supplier can prove about transfer. A file-send log cannot itself establish print quality. Scope negotiation makes an answerable question explicit while leaving evidence judgment independent during execution.