Blog ISO Guide: Understanding the Scope of your Management System

Determining the scope of your management system is a key starting point in the implementation process. The scope is vital as it defines how far the management system extends within the organization’s operations and details any exclusion from the standard’s requirements, if exclusions are permitted and, the justification for these.

The Scope falls within clause 4.3 of the standard and states that ‘the organization shall determine the boundaries and applicability of the management system’ and details the requirements for determining the scope of the management system.

In addition, the scope is to include any requirements of the standard that can be applied, and if a requirement is determined to not apply, the organization will not use this as a reason for not ensuring conformity of product and service.

The scope must state the products and services covered by the management system. For instance, if the organization is a calibration specialist, then they must adhere to regulatory requirements, and therefore do not create these requirements. For example, within the ISO9001 quality management system, they could exclude clause 8.3 Design and development of products and services, as they don’t design or develop any. They just provide a calibration service which is regulated.

Defining the boundaries of your scope

Careful consideration about what you include within your scope must be taken.  A look at the critical areas, processes and procedures should help identify the boundaries.  Many organizations implement management systems that only cover critical areas of the business. For instance, a manufacturing company may only want a quality management system that covers its production and support functions. Therefore its sales and finance departments may not be included within the scope.

When deciding your scope it is best to work through your business processes. Depending upon the ISO standard you are looking to get certified to, there will be mandatory requirements and these must be considered.  Many management systems require that staff working within the boundaries of the scope are competent, have roles and responsibilities defined and if necessary, training and upskilling requirements identified.  This generally falls under the HR umbrella, so they would fall within the scope of the management system.

Make your scope statement clear and concise

Your scope does not have a size limit and should include enough information to determine what is covered by the processes of the management system. However, it is important to make it clear what is included and what is not. If it is not clear to you what processes in your company are covered by your management system, then how will it be clear to an outside auditor or other interested party?

Making your scope statement simple and easy to read can help to focus your management system’s efforts and prevent unnecessary questions about activities that you may perform that may not be applicable to your certification.

As you implement your management system keep reviewing your scope.  It will need adjustment as areas, previously not thought to be part of the management system, become obvious. This is also true as your management system matures, or your organization grows.  The scope of your management system will continue to change over time and should be reviewed during your management review meetings to ensure it still is fit for purpose.

Written by Ted Spiller, CertiKit’s Compliance Consultant. Ted is an expert in many ISO management systems; he is a Lead Auditor for ISO9001 and ISO14001, and an Auditor for ISO45001 and ISO22301.

More ISO Resources

CertiKit is a provider of ISO toolkits, consultancy and internal auditing services, and has helped more than 4000 organizations worldwide with their compliance.

For more guidance on implementing the ISO standard of your choice, go to our guidance pages where you can find more specific information about each standard and more downloadable resources.

More ISO Guidance