Typically, the scope on the certificate and the scope of the quality manual are one and the same. Having said that, once again, the auditor is waaaay off base recording an NC for either situation - since the scope is the scope. Now, if those things activities weren't in the "sequence and interaction of processes", it MIGHT be a minor (this is a surveillance, so what happened before?)
No, however you slice and dice this, the auditor is wrong, the CB should hear about it (because how many other clients have been blindsided by this stupidity and NOT fought it) and they need to get rid of (or take remedial action) with them to stop doing dumb things like raising this as a"major" for one thing, and as a non-conformity for another. This is NOT what CB audits are about...