ISO 9001 scope: how to define it, what you may exclude, and the mistakes that cost you

What the scope is, and what clause 4.3 requires

Two statements carry the word scope: yours, the scope of the quality management system kept as documented information, and the certification body's, the scope of certification printed on the certificate. They should match; the certificate may cover part of your system, never more than was audited.

Clause 4.3, Determining the scope of the quality management system, sets the method. You fix the boundaries and applicability of the system in the light of the issues identified under clause 4.1, the requirements of relevant interested parties under clause 4.2, and the products and services you provide. Within that boundary, every requirement that can be applied must be applied. The documented scope names the types of products and services covered and justifies any requirement found not to apply. Conformity to ISO 9001 can then be claimed only if those requirements do not affect your ability or responsibility to deliver conforming products and services and to enhance customer satisfaction.

What you may exclude, and what you may not

Most people call these exclusions, but the test is applicability, not preference. Three requirements are the usual candidates, each needing a written reason.

• Design and development of products and services (clause 8.3). Not applicable where you work only to designs your customer owns and you may not change, like a machine shop making parts to customer drawings. It applies once you create or adapt a design.
• Measurement traceability, within monitoring and measuring resources (clause 7.1.5). Can fall away where no measuring equipment is used to verify conformity, as in many advisory services; rarely in manufacturing or construction.
• Property belonging to customers or external providers (clause 8.5.3). Often claimed, seldom justified: customer drawings, samples, tooling, premises and personal data all count.

Requirements that describe the system itself never qualify: leadership, planning, competence, documented information, internal audit, management review and corrective action apply to every organisation, and marking one not applicable will be challenged at Stage 1. Nor is "not yet implemented" a justification; it is a gap.

Defining the scope in five steps

1. List what customers receive. Name products and services by type, as a customer would; next year's launches can join later by extension.
2. Map the processes behind them, from enquiry to after-sales support, with the purchasing, planning, maintenance, HR and IT that delivery depends on.
3. Locate the work. Each office, plant or warehouse on the certificate is audited, or sampled where sites run very similar activities under one system and a central function. For project sites and client premises the scope describes the activity; expect the auditor to visit some live jobs.
4. Mark who performs each step. A group company or shared-service centre can be brought into the scope; otherwise it is controlled as an external provider.
5. Test every requirement for applicability, justify any that cannot apply, then draft the certificate wording and check it against what customers and tenders ask for.

Outsourced processes stay inside the scope

An outsourced process is a step in your own delivery that another party performs: heat treatment, calibration, courier delivery, cloud hosting, a subcontracted installation crew. Handing it over moves the work, not the responsibility. Clause 8.4, Control of externally provided processes, products and services, keeps such processes within the control of your system, with the type and extent of control matched to their effect on what you deliver. Certification bodies also require your application to identify the outsourced processes that affect conformity.

Control shows in records: a machine shop outsourcing heat treatment keeps the specification it issued, the treatment certificates, its own hardness check on receipt and the provider's performance record. Without that trail, expect a nonconformity against clause 8.4.

How the scope reads on the certificate

ISO/IEC 17021-1, the standard certification bodies are accredited to, requires the certificate to name your organisation and each site and to state the scope of certification by products, services and processes as they apply at each site. The wording is proposed in your application, checked at Stage 1 and confirmed after Stage 2; review the draft before issue. The body also maps your scope to sector codes that its accreditation must cover; see our guide to choosing an ISO 9001 certification body.

How the scope sets the audit days

Audit days follow international audit-time rules that accreditation bodies enforce, with the scope as the main input. Everyone involved within the scope counts, whether permanent, temporary or part-time, so a support team serving the certified operation stays in the count whatever the scope document says.

Other scope choices move the figure. Added sites, work spread across several buildings, heavily regulated activities and more than one working language all add time. A genuine absence of design responsibility can lower it, within a 30% cap on total reductions, and outsourced processes are weighed too. The contract must show how the body reached its figure, so you can check it quoted the scope you meant. Our guide to ISO 9001 certification cost: what moves the price shows how the days become fees.

Four scope mistakes that cost you

• Too wide. Services not yet delivered, sites not yet running, products still in development. With no records to sample, the scope is cut back at Stage 2 or findings follow, and the days are paid for regardless. Certify what runs today; extend later.
• Too narrow. Only what one customer asked about, or only head-office functions while the product is made elsewhere. The next tender names the missing part, and an extension audit races its deadline. Set the scope for the customers you expect over the three-year cycle.
• Silent exclusions. A requirement dropped without justification, a site omitted without explanation, or a website presenting the whole company as certified when one site is. An auditor tracing an order walks into the design office or warehouse the system ignores, and the result is a nonconformity against clause 4.3 or a misleading claim the certification body must act on.
• A scope drawn around a weak process. Leaving out the installation team behind most complaints, or calling design not applicable to avoid design controls. Complaints about in-scope products lead the auditor straight there, the clause 4.3 test fails, and the fix that mattered is postponed. Keep it in and fix it first.

ISO 9001 scope: questions buyers ask