What Is Audit Scope?
Audit scope defines the boundaries of an audit. It tells everyone involved exactly what will be examined, how far the audit will reach, and what sits outside the audit entirely. Without a clearly defined scope, an audit loses direction. Auditors end up either missing critical areas or wasting time on things that were never meant to be covered.
On this page
In plain terms, audit scope answers three questions: What processes, functions, or areas are being audited? What time period does the audit cover? And what locations, sites, or business units are included?
The scope is not the same as the audit objectives or the audit criteria, though all three are connected. Objectives describe what the audit is trying to achieve. Criteria describe the requirements the auditee is being measured against. Scope describes the physical and functional territory the audit will cover. If you are new to these distinctions, it is worth reading our article on setting audit objectives and criteria alongside this one.
Why Audit Scope Matters More Than Most People Realise
A poorly defined scope creates problems that ripple through the entire audit. If the scope is too narrow, you miss risks. If it is too broad, you run out of time and produce a shallow audit that does not go deep enough to be useful. Either way, the audit findings lose credibility.
Consider a real scenario. An organisation asks an internal auditor to review their purchasing process. The auditor turns up and starts interviewing the warehouse team about receiving, then moves into production, then starts asking about customer complaints. None of that was scoped. The purchasing manager is frustrated, the audit runs over time, and the final report covers too many areas without enough depth in any of them.
That is a scoping failure. It happens more often than it should, and it is entirely preventable.
From a certification audit perspective, the scope also carries legal and commercial weight. The scope of certification is what appears on the certificate. Organisations that define their certification scope too narrowly may exclude profitable business lines. Those that define it too broadly invite scrutiny of areas they are not ready to have examined. Getting this right matters before you even book the certification body.
Exemplar Global Certified Training ProviderRTP No. 310970
The Components of a Well Defined Audit Scope
Physical Boundaries
Physical boundaries define which sites, locations, or facilities are included. For a single site organisation, this is straightforward. For multi site organisations, it requires deliberate decisions about which sites are in scope and which are not, and why.
In a certification audit context, the certification body needs to know which sites will be audited. If you have five warehouses but only two are included in the scope, the certificate will reflect that. Auditors conducting surveillance audits will return to those same sites. If the business has grown and new sites are operating under the same system, the scope needs to be updated.
Functional Boundaries
Functional boundaries define which processes, departments, or activities are included. This is where internal auditors often struggle. It is tempting to scope out difficult areas or functions where relationships are strained. That is a mistake. The areas that are uncomfortable to audit are often the ones that most need scrutiny.
A well defined functional scope will specify which processes are included. For example, an internal audit of the procurement process might include supplier selection, purchase order creation, goods receipt, and supplier performance review. It would not include accounts payable unless that process has a direct interface with procurement that is relevant to the audit objectives.
Time Boundaries
Time boundaries define the period under review. Most internal audits look at activity over the past six to twelve months. Certification audits typically review documented information and records from the period since the last audit. If you are conducting a follow up audit to verify corrective action effectiveness, the time boundary is typically from the date the corrective action was implemented.
Being specific about time matters because it affects what evidence you sample. If you scope an audit to cover the past twelve months but only look at records from the last three, you have not actually audited within the defined scope.
Standard or Criteria Boundaries
The scope should also clarify which standard or which clauses of a standard are being audited. An internal audit programme might schedule different clauses across different audit cycles. If a particular audit is focused on Clause 8 operational processes, that should be stated in the scope. This helps auditors prepare appropriate checklists and helps auditees know what to expect.
Audit Scope in Different Types of Audits
Internal Audits
For internal audits, scope is set by the audit programme manager or the lead internal auditor. It should be informed by risk. Higher risk processes should be audited more frequently and with broader scope. Lower risk areas can be scoped more narrowly or audited less often.
ISO 9001 Clause 9.2 requires that internal audits cover all processes and all clauses of the standard over the course of the audit programme, but it does not require every process to be audited every time. This gives you flexibility to scope individual audits narrowly while ensuring full coverage across the programme as a whole. For a practical breakdown of how this works, see our article on ISO 9001 Clause 9.2 explained.
Supplier Audits
Second party or supplier audits tend to have tightly defined scope because you are auditing someone else's organisation. You need to be specific about what you are there to assess. A supplier audit scope might be limited to the manufacturing process for a specific product category, the calibration and inspection controls, or the documented information relevant to your contract.
Going beyond the agreed scope during a supplier audit creates tension and can damage the supplier relationship. If you discover something outside the scope that concerns you, note it and raise it through the appropriate channel after the audit. Do not simply expand the scope on the day without agreement.
Certification Audits
In a certification audit, the scope is agreed between the organisation and the certification body before Stage 1. It describes the activities, processes, and locations covered by the management system. It is also what will appear on the certificate, typically worded as a description of the organisation's activities and the products or services they deliver.
A common mistake is writing a scope that is either too vague or too narrow. Something like provision of services is not useful. A well written certification scope might read: Design, development, and delivery of civil construction services including earthworks, drainage, and road base preparation across Queensland and New South Wales.
That scope tells the certification body what to audit and tells prospective customers what the certificate actually covers.
Exclusions from Scope
Under ISO 9001, organisations can exclude certain clauses from the scope of the QMS if those requirements are not applicable to their operations. The most common exclusion is Clause 8.3 on design and development, which applies to organisations that do not design products or services but simply deliver to customer specifications.
Exclusions must be justified. The organisation needs to demonstrate that the excluded clause genuinely does not apply and that excluding it does not affect the organisation's ability to deliver conforming products or services. Auditors will check this justification during certification audits. If the exclusion is not defensible, it will be challenged.
Other ISO standards take a similar approach. ISO 14001 and ISO 45001 do not have formal clause exclusions in the same way, but the scope of the management system itself can be defined to exclude certain activities or sites, provided that exclusion does not compromise the organisation's ability to meet its obligations.
Common Scoping Mistakes Auditors See in Practice
Scope Creep During the Audit
Scope creep happens when an audit starts expanding beyond its defined boundaries during execution. An auditor following an interesting thread pulls in processes, people, and records that were never part of the plan. The result is an audit that has gone deep in one unexpected direction while leaving planned areas unexamined.
The fix is discipline. If something outside the scope is clearly significant, note it for the audit programme manager. It might justify a separate audit. But on the day, stick to the scope.
Scope Too Vague to Be Useful
A scope that says all processes without further definition is not a scope. It gives auditors no guidance and gives auditees no clarity about what to prepare. A useful scope names the processes, the locations, and the time period.
Scope That Avoids Difficult Areas
This is a cultural problem. When audit scope is set by people who have a stake in the outcome, there is a temptation to exclude areas that are known to have problems. This defeats the purpose of auditing. The audit programme should be designed with input from risk information, not from a desire to avoid discomfort.
Scope Not Communicated to the Auditee
Auditees deserve to know what is being audited before the auditor arrives. Sending the audit scope in advance gives people time to locate relevant records, brief their team, and prepare constructively. An auditee who is surprised by the scope on the day of the audit is likely to be defensive, which makes the auditor's job harder.
How to Define Audit Scope in Practice
When you sit down to define the scope for an audit, work through the following questions systematically.
- What is the purpose of this audit? The scope should support the audit objectives. If the objective is to verify corrective action effectiveness, the scope should be limited to the process where the nonconformity occurred.
- Which processes are relevant? List the specific processes, not just the department names. Processes are more useful than org chart boxes because they describe what actually happens.
- Which locations are included? Name the sites. If some sites are excluded, state why.
- What time period applies? Be specific. From when to when.
- Which standard or clauses apply? If you are auditing against a specific standard, note which clauses are in scope for this particular audit.
- What is explicitly out of scope? Stating what is out of scope is just as important as stating what is in scope. It prevents misunderstandings on the day.
Once you have worked through these questions, document the scope clearly in the audit plan. The scope should be communicated to the auditee in advance and confirmed at the opening meeting.
Audit Scope and the Audit Programme
Individual audit scopes should be designed to fit within a broader audit programme. The programme sets out all the audits planned for the year, the cumulative scope across those audits, and how that scope ensures full coverage of the management system over the programme period.
Think of it this way. A single internal audit might cover three or four processes. The annual audit programme might include six audits covering all processes and all relevant clauses across the year. The programme scope is comprehensive. Each individual audit scope is focused.
This distinction is important because it gives you the flexibility to run targeted, efficient audits without worrying that you have missed something. As long as the programme as a whole covers everything it needs to, individual audits can be scoped as narrowly as needed to do a thorough job.
If you are building or reviewing your audit programme, our article on building an audit programme that actually works covers the programme level decisions that sit above individual audit scope.
Exemplar Global Certified Training ProviderRTP No. 310970Scope in the Audit Plan and Opening Meeting
The audit scope should appear explicitly in the audit plan. It is one of the first things an experienced auditor or audit client will look for. If the scope is missing or vague, that is a signal that the audit has not been properly planned.
At the opening meeting, the lead auditor should confirm the scope with the auditee. This is a brief but important step. It gives both parties an opportunity to raise any concerns before the audit starts. If there has been a change in the organisation since the scope was defined, for example a new site has been added or a process has been restructured, the opening meeting is the right time to discuss whether the scope needs adjustment.
Any changes to scope after the opening meeting should be documented and agreed by both parties. Do not simply expand or contract the scope informally during the audit.
Training That Covers Audit Scope Properly
Understanding audit scope conceptually is one thing. Applying it under pressure during a real audit is another. New auditors often struggle with scope in practice because they have not had enough experience making scope decisions in realistic scenarios.
At Audit Workshop, our internal auditor and lead auditor courses cover audit scope as part of the full audit planning process. Participants work through practical exercises that involve defining scope, identifying what should be excluded, and adjusting scope when circumstances change. The training is grounded in real audit practice, not just theory, which means you leave with skills you can apply immediately.
Whether you are preparing for your first internal audit or working toward lead auditor certification, getting comfortable with scope decisions early will make every audit you conduct more focused and more effective.
