Scope means the boundary of what is covered. The word is used in two ways in food safety. An auditor has a scope: the kinds of food business that person is competent to audit. A programme or has a scope: the sites, products and processes it covers. Good assurance needs both to match the real operation.
, which replaced ISO/TS 22003:2013, sets requirements for bodies that audit and certify food safety management systems, supplementing ISO/IEC 17021-1. Its Annex A classifies the food chain into categories, and Annex C covers the competence of auditors. The aim is that the people assigned to an audit are competent for that category.
| Category code | Food chain category (examples) | Typical business |
|---|---|---|
| BIII | Pre-process handling of plant products | A packhouse handling plant products that are not transformed |
| C | Food manufacturing | A factory making food products |
| D | Animal feed production | A feed mill |
| E | Catering or food service | A catering kitchen or restaurant group |
| F | Trading, retail, wholesale and e-commerce | A food retailer or wholesaler |
| G | Transport and storage services | A cold store or carrier |
| I | Food packaging manufacturing | A maker of food contact packaging |
| K | Production of (bio)chemicals | A maker of food additives or processing aids |
This is a selection, as named in one scheme's published scope rules, not the full Annex A. The standard is paywalled, category codes changed in the 2022 revision, and scheme owners can set their own rules on top. Use the current standard and the scheme's rules for the exact list and the competence needed.
Regulators use scope too. Australia's national framework has a base set of auditor competencies, with separate endorsements for higher-risk processes such as cook-chill, heat treatment, manufactured and fermented meats, and raw oysters and bivalves. Western Australia states that regulatory auditors may audit only within their scope of approval, and publishes that scope. Check the current list with the regulator, because the framework dates from 2009.
| Scope element | Questions to ask | What a clear statement looks like |
|---|---|---|
| Site | Is this address covered? What about the second kitchen, the off-site store or the new unit? | Named sites and activities at each. Storage and delivery are included only where part of the audited system |
| Product | Is this product type included? Is it for vulnerable consumers? | Product types in plain words, rather than a list of every item or brand |
| Process | Does it include the steps that matter for safety, like pasteurising, cook-chill or vacuum packing? | Applied technologies that affect food safety, not every minor step |
| Exclusions | What is left out, and could it affect the safety of the end product? | Exclusions stated openly on the , where permitted. Vague words such as "etc" are not acceptable |
| Outsourcing | Are any steps done by someone else? | Outsourced steps are controlled by the business, but not presented as its own certified activity |
The right-hand column draws on one scheme's published rules on scope statements (May 2026), used here as a worked example. Other schemes will have their own rules.
| Mismatch | How it looks | Why it matters |
|---|---|---|
| The does not cover the site | A supplier sends a from its head factory, but the food comes from another plant | The site supplying you has not been assessed under that |
| The does not cover the process | A supplier adds slicing of product after its audit, with no change to its scope | A high-risk step sits outside the audited system, and customers assume otherwise |
| The plan does not match the operation | A new menu line or a new piece of equipment was never added to the | The of the new step have never been assessed, so and may be missing |
| The auditor's competence does not match the business | An auditor approved for general food service audits a cook-chill line | Real risks can go unseen, and under a regulatory scheme the audit may not count |
| The auditor's approval does not cover the regulator | An auditor approved by one Australian regulator audits under another's Act | An approval under one regulator's law is not an approval under another's, so the audit may not satisfy the legal duty |