The scope defines the subject matter, and what is going to be audited. The scope depends on the needs of the intended user(s), the decided level of assurance, the risk that has been assessed, and the competence and resources available.