Scope decides everything and is settled first

Most disputes at closing were scope disputes at opening.

An audit's value is largely determined before anybody arrives, by what was included, which sites, which processes, which period, and what the audit is actually for. Ambiguity there produces a closing meeting in which the auditor and the client disagree about whether something was in scope.

The scope should name the period as well as the processes, since evidence is examined for a defined window and organisations frequently present current arrangements for a past period without noticing the substitution.

Multi-site arrangements deserve explicit treatment. Sampling across sites is legitimate and the basis has to be stated, because a finding at one site may or may not be a system finding, and that distinction changes the response entirely.

Exclusions should be written down with reasons. An area excluded because it was audited recently is different from one excluded because access could not be arranged, and the second is itself worth reporting.

Where the client's real question is broader than the certification scope, the honest response is to say so and offer to look at it separately rather than to stretch the audit and produce findings outside what was agreed.

There is one scoping question worth settling explicitly that rarely is, which is what happens if the audit finds something outside scope. Auditors encounter serious issues in areas they were not engaged to examine, and an agreement about how those will be reported prevents both suppression and an uncomfortable improvisation.