Audit scope fixes what an auditor will look at, and over what time.

Before any audit starts, both sides agree what is on the table. The audit scope names the parts of the business, the sites, the activities and the dates the auditor will cover. Anything outside it is not examined, and the final report or certificate says nothing about it.

Scope is what a buyer is really reading when they look at your report or certificate. Too narrow, and a customer finds their product or their data centre missing. Too wide, and you pay to audit areas you have not prepared. Scope also drives effort: a certification body plans audit time from what is in scope, and a CPA firm plans its testing from the system and period named in the engagement. Scope can change mid-engagement, but it is disruptive, so the decision belongs at the start.

The audit plan

ISO 19011 has the audit team leader set out scope and criteria in the plan shared before fieldwork.

The certificate

An ISO certificate states the scope it covers, usually in one or two sentences buyers should read closely.

The engagement letter

For a SOC examination, the letter with the CPA firm names the system, the criteria and the period.

The internal audit programme

Each internal audit has its own narrower scope, chosen within the programme.

System boundary

In SOC 2, the boundary describes the system itself: infrastructure, software, people, procedures and data. Audit scope is about the engagement: which system, against which criteria, over which period. The boundary is one input to scope.

ISMS scope

The reach of the management system you run, set under clause 4.3 of ISO/IEC 27001. A certification audit's scope is normally drawn from it; an internal audit may cover only part.

Audit criteria

The requirements you are measured against, such as a standard or the Trust Services Criteria. Scope says where and when; criteria say against what.

• Write the scope in one paragraph a customer could read, naming products, sites and teams.
• Check it against what your largest customers actually rely on.
• List what is excluded and why, and be ready to say so on a sales call.
• Agree scope in writing with the auditor before fieldwork, and raise changes early.

• GuideWriting the ISMS scope statementHow to draw the line and word it so an auditor accepts it.
• GuideScope & the system boundaryWhat's in, what's carved out, and the CUECs your customers own.
• GuideCarve-out or inclusive: how vendors appear in your reportTwo ways to present a vendor, and what each does to your report.

Sources: ISO 19011:2018 (guidelines for auditing management systems) on audit scope, criteria and plans; ISO/IEC 27001:2022 clause 4.3; ISO/IEC 17021-1 on certification audit planning; AICPA AT-C section 205 on examination engagements.