Understanding the Scope of an ISO 22000 Internal Audit

An internal audit that tries to cover everything usually covers nothing well. Two days spent walking every department at surface level can miss the one process where hazard control is failing, while a focused audit of scope, one production line, and its supporting systems can produce findings that change the site. Scope is the decision that makes that difference: what will be audited, against what criteria, within what boundaries, and how deeply.

Clause 9.2 requires internal audits at planned intervals to check whether the food safety management system conforms to your own requirements and to ISO 22000, and whether it is effectively implemented and maintained. Each audit within your programme needs a defined scope. Writing that scope well, before anyone opens a checklist, determines whether the audit can answer those two questions.

What audit scope actually defines

Scope states the extent and boundaries of the audit. For an internal audit it normally names the organisational units and sites included, the processes and products covered, the time period the evidence will come from, and the parts of the system in focus, such as specific clauses or the hazard control plan for one product group. It also names what is excluded. Exclusions are legitimate when stated openly; they become a problem when a weak area quietly stays out of every audit, year after year.

Scope differs from criteria and from objectives. Objectives say why the audit is being done: to verify conformity, to follow up a customer complaint trend, to check a new line before launch. Criteria are the requirements used as the reference: ISO 22000 clauses, your procedures, specifications, and legal requirements. Scope says where and how far the audit reaches. Confusing the three produces vague plans, for example an audit whose stated scope is simply the standard itself, which tells the auditor nothing about where to spend time.

Setting scope from risk and change

ISO 19011 guidance and clause 9.2 both point the same way: the audit programme should take into account the importance of the processes concerned, changes affecting the organisation, and the results of previous audits. In plain terms, scope follows risk. A high-risk ready-to-eat process, a department with repeated deviations, a new supplier of a high-risk ingredient, or a recently changed allergen profile deserves deeper and more frequent coverage than a stable, low-risk area with clean history.

Changes are strong scope signals. New equipment, new product categories, building work, a new shift pattern, revised customer requirements, or a recent withdrawal all argue for inclusion. So do external signals: a supplier alert, a regulator’s findings at a similar site, or illness complaints linked to a product type you make. An annual programme that repeats last year’s scopes unchanged, despite a year of change, is itself a finding about the programme.

Depth, sampling, and time period

Scope also sets depth. Checking that monitoring records exist is shallow. Tracing one product lot from raw material intake through hazard controls, monitoring records, verification, and distribution is deep, and deep tracing finds system breaks that record sampling misses. Define the evidence period too: records from the last three months may hide a seasonal problem, while a scope covering a full production cycle, including nights and weekends where they operate, gives a fairer picture. State sampling intent in the plan so auditees understand findings may rest on samples, and auditors resist claiming a sample proves the whole period clean.

Scope of the system versus scope of one audit

Do not confuse the FSMS scope in clause 4.3 with an individual audit’s scope. The system scope defines which products, processes, and sites the whole management system covers, and it appears on a certificate. An individual audit scope is a subset of that, the slice examined on this occasion. Over a full audit programme cycle, however, coverage should add up: every part of the system scope, every clause, and every shift pattern should be audited at planned intervals. Gaps in cumulative coverage are programme failures even when each single audit looked complete.

Boundaries need care at interfaces. If warehousing is outsourced, or maintenance is contracted, or a co-packer handles one product, decide whether and how those activities fall inside the audit. Externally provided processes remain your responsibility under the standard, so excluding them from all audits leaves a blind spot exactly where your direct control is weakest.

Writing and agreeing the scope

Write the scope before fieldwork, agree it with the audit programme manager, and communicate it to the areas involved in time for them to make people and records available. Keep it achievable in the time allowed: an over-ambitious scope forces rushed evidence and weak conclusions, and auditors should record any scope limitation that affected the result, such as a line that did not run during the visit. If evidence during the audit points outside the scope to a serious food safety risk, do not ignore it for the sake of tidiness. Escalate, agree an extension or a follow-up audit, and record what was done.

Key points

• Scope defines the boundaries, processes, sites, and time period an audit will examine, including stated exclusions.
• Scope, objectives, and criteria are different: why, what boundaries, and what requirements, respectively.
• Risk, change, and previous results should drive scope and depth, as clause 9.2 and ISO 19011 direct.
• Over a programme cycle, audit scopes together must cover the whole FSMS scope, all clauses, and all shifts.
• Outsourced and contracted activities remain your responsibility and must not become permanent blind spots.
• Serious risks found outside scope must be escalated, not ignored.