Key takeaways
- Your scope sets the boundary of your management system: the activities, products and services, and sites it covers. Your certificate repeats it, so it is the line buyers read first.
- Clause 4.3 asks you to work it out from your context, your interested parties and what you deliver. ISO 14001, ISO 45001 and ISO/IEC 27001 each add their own inputs.
- The deciding question is often whether you do the work or manage it. When others carry out the work, the scope says you manage it, and your system controls those providers.
- Under ISO 9001 a requirement can only be treated as not applicable if leaving it out cannot affect what you deliver. Design is the classic case, and certification bodies check it closely.
- Set the scope to match what customers and tenders ask for. Too narrow and the certificate does not answer their question; too broad and you build and audit more than you need.
Scope is one of the first decisions in any ISO project and one of the least discussed. It sets what your management system covers, it shapes what the certification body audits, and it becomes the line on your certificate that customers and tender evaluators read. Set it well and the rest of the project lines up behind it.
Four meanings of “scope” in ISO
Part of the confusion is that the word is used in four ways:
- The scope of the standard. Clause 1 of every ISO standard says what the standard is for. The scope of ISO 45001, for example, is occupational health and safety management systems. It describes the standard itself.
- The scope of your management system. Clause 4.3 asks you to decide which parts of your business your system covers. This is the decision this guide is about.
- The scope of certification. The statement printed on your certificate. The certification body confirms it after auditing your system, and it may not claim more than was audited.
- The scope of an audit. The extent and boundaries of one particular audit: the processes, sites and period it looks at. It changes from audit to audit.
Most questions about scope are about the second and third: what your system should cover, and what your certificate will say.
What clause 4.3 asks you to consider
ISO 9001, ISO 14001, ISO 45001 and ISO/IEC 27001 all handle scope in clause 4.3, because they are built on the same shared structure. Each asks you to start from the issues that shape your business (clause 4.1) and the needs of the people and organisations with a stake in your work (clause 4.2). Each standard then adds its own inputs:
- ISO 9001: your products and services. The scope must state the types of products and services it covers, and justify any requirement you treat as not applicable.
- ISO 14001: your compliance obligations, your organisational units, functions and physical boundaries, your activities, products and services, and your authority and ability to exercise control and influence. The scope must be available to interested parties.
- ISO 45001: the work-related activities you plan or perform. The system has to include the activities, products and services within your control or influence that can affect your health and safety performance.
- ISO/IEC 27001: the interfaces and dependencies between your activities and those performed by other organisations, such as a cloud host or an outsourced IT provider.
In every case the scope is kept as documented information, and everything inside it has to run the system.
Start from what your customers buy
The most practical test is a simple one: what do your customers, and the tenders you want to win, actually buy from you? Your scope should cover the activities that produce those products and services, at the sites where that work is done or controlled, together with the processes that manage them, such as planning, contract review, purchasing, competence, monitoring, internal audit and management review.
From there, a few questions settle most scopes:
- Which activities create what the customer receives?
- Which of those do your own people perform, and which do others perform for you?
- Which sites are involved, permanently or for the length of a project?
Scope comes first in the build for a reason: every later decision about documents, objectives and audits has to line up with it. Our guide to building an ISO 9001 system that works walks through the order.
Managing the work or doing it
This question sits behind many scope decisions in South Africa, especially in construction, engineering, logistics and technical services, where a business often wins and manages the contract while specialist subcontractors carry out part or all of the work.
If your own people do the work, the scope names that work: manufacture, installation, construction, maintenance. If you plan, coordinate and control the work while others carry it out, the accurate scope describes management of the work, for example project management of building projects. The subcontracted work is then controlled through your system as an externally provided process. ISO 9001 clause 8.4 covers this: you select, evaluate and monitor those providers, and you remain responsible for what reaches the customer.
Many businesses sit in between, with some work in-house and some subcontracted, and the scope can say exactly that. What it cannot do is present work as yours when your own people do not do it and you do not control it, because a buyer reads the verbs. A tender that asks for certified construction capability may not accept a certificate that covers project management only, so check what your target tenders require before you settle the wording. Our guide to ISO certification for tenders covers how buyers use the certificate.
Requirements that do not apply
ISO 9001 lets you treat a requirement as not applicable, but only with a justification, and only where it cannot affect your ability to deliver conforming products and services or to enhance customer satisfaction. The usual example is design and development (clause 8.3) for a business that builds or supplies strictly to its customers' designs.
Look carefully before you leave design out. If you create or adapt designs, develop new services, or decide how a product will be made to meet a customer's need, design is probably part of what you do, and certification bodies look closely at design exclusions.
The other standards work differently. ISO 14001 and ISO 45001 have no equivalent provision: every requirement applies inside the scope, so the work there is deciding what falls inside the boundary. ISO/IEC 27001 is the same for its clauses 4 to 10, and handles its Annex A controls through the Statement of Applicability, where any control you exclude needs a justification.
Sites: which locations are covered
List the permanent sites where the work in scope is done or controlled, including the head office if that is where planning, contracts and purchasing happen. Temporary sites, such as construction projects or work at client premises, are usually described in the scope (for example, at client sites in Gauteng) rather than listed one by one, and the certification body may visit a sample of them.
Every site in scope has to run the system. For organisations with several similar sites, the certification body decides how many it visits under the accreditation rules it follows, so a multi-site scope does not mean every site is audited every year. A site left out of the scope is not covered, even if it belongs to the same company.
How to word the scope statement
A good scope statement is short and specific. It names what you do, what it delivers, and where:
- The activities, as verbs that match reality: manufacture, supply, installation, maintenance, design, management.
- The products or services those activities deliver, in words a customer would recognise.
- The sites, or the type of location, such as client sites, where the work is done or controlled.
Avoid catch-all wording such as “all activities of the company”, and avoid listing every product line. Certification bodies have to word certificates so they are not misleading, and they will query a scope that claims more than they audited. Buyers who check a certificate read this line first, so it is worth getting exactly right.
Example scope statements
These examples are illustrative, written for this guide rather than taken from any client.
| Situation | Example scope | Why it is worded this way |
|---|---|---|
| A manufacturer on one site that works to its customers' drawings (ISO 9001) | “Manufacture and supply of injection-moulded plastic packaging at the Germiston plant.” | The activity, product and site are all named. Design is treated as not applicable, with a justification, because the business only works to customer drawings. |
| A service business working at client premises (ISO 9001) | “Provision of commercial cleaning and hygiene services at client sites in Gauteng, managed from the Midrand office.” | The work happens at client sites, so the scope names the type of location and the office that controls it. |
| A contractor that builds with its own teams (ISO 9001) | “Construction of commercial and industrial buildings at project sites in Gauteng.” | The business does the work itself, so the scope names the work. |
| A contractor that manages subcontracted building work (ISO 9001) | “Project management of commercial building projects, with construction carried out by approved subcontractors.” | The business manages the work, so the scope says so. The subcontractors are controlled as external providers. |
| A distribution business with three depots (ISO 9001) | “Warehousing and distribution of packaged goods from the Johannesburg, Durban and Cape Town depots.” | Each depot runs the same system and is named, so the certificate covers all three. |
| A fabricator that also installs on site (ISO 14001 and ISO 45001) | “Fabrication of structural steel at the Benoni works, and its installation at client sites.” | The environmental and safety risks of site installation are inside the boundary, so the installation work is named. |
| A software business (ISO/IEC 27001) | “The information security management system supporting the development, hosting and support of the company's online booking platform, operated from the Pretoria office.” | It names the services and the location the system protects. Hosting by a cloud provider is an interface the system has to manage. |
Getting the size right
A scope that is too narrow saves effort now and costs you later. If a tender asks for certification that covers the work you are bidding for, a certificate that covers a different activity or site does not answer the question.
A scope that is too broad has the opposite cost. Every activity and site inside it has to run the system and can be audited, and the certification body sets audit time partly by the scope, the number of people and the sites. Start with what customers buy, and extend when you need to.
Scope can change. Adding an activity, product or site is a scope extension: the certification body audits the new part, often at a surveillance visit, before it appears on the certificate. If you know a new site or service is coming, plan it into the system early.
How we help you set it
Scope is one of the first things we settle with a client. After the gap audit, the proposed scope goes into the proposal with the consulting days, price and timeline, because the system design, the internal audit programme and the certification body's audit plan all follow from it. We help you decide it and word it; the decision is yours, and the independent certification body confirms what it certifies. If you are weighing up where your boundary should sit, contact us and we will work through it with you.