Home › ISO Knowledge Hub › ISO Scope & Applicability

ISO Scope & Applicability

Define clear management system boundaries across legal entities, sites, activities, products, services and externally provided processes. Learn when a requirement may be determined not applicable, how to document the rationale and which records demonstrate an accurate scope.

Scope Types Boundary Mapping Applicability Examples Audit Evidence FAQ

01. What the Scope Must Communicate

The scope of a management system identifies the organizational boundaries and activities to which the relevant management system requirements apply. It should reflect the organization’s actual context, products and services, interfaces, compliance obligations and intended outcomes.

Start by defining what the business actually does and which legal entities, sites, functions and externally provided activities influence its outcomes. A scope statement is not a marketing slogan, a list of certificates or permission to disregard a process that remains under organizational responsibility.

Boundaries: Legal entity, organizational units, physical or virtual locations and functional interfaces.
Coverage: Products, services, core processes and supporting or outsourced processes.
Applicability: A traceable rationale tied to the specific standard and its applicable edition.
Auditability: Accurate records that demonstrate where controls operate and who is accountable.

First decision: Choose the relevant ISO standard before interpreting its scope requirements.

Two professionals reviewing organizational process mapping and scope documentation at a workplace table

02. Management System, Certification and Audit Scope

Three scopes are related, but they answer different questions. The scope of a management system is set by the organization; a certification scope is agreed and verified with a certification body where certification is pursued; and an audit scope specifies the boundaries of a particular audit.

MS Management System Scope

What entities, sites, activities, products, services and relevant interfaces the management system governs. It guides implementation, operational controls and internal performance evaluation.

CERT Certification Scope

What a particular certificate represents, subject to the certification body’s assessment and its applicable certification rules. It must not imply unassessed sites or services are certified.

AUDIT Audit Scope

What locations, functions, processes, activities and timeframe an individual internal or external audit will cover. Different audits may sample different parts of the management system.

A defensible scope is specific

Avoid vague claims such as “all business activities” when the organization has multiple entities or distinct operations. Conversely, do not narrow the stated scope simply to omit difficult interfaces. Verify that the statement matches operational reality and any certification claim.

03. Elements of an ISO Scope Statement

Define each boundary in an agreed order. Each element below should be supported by a process map, site list, ownership information or another contemporaneous record.

WHO 01 · Organizational boundary

Identify the legal entity or entities, business units, accountable management and decision authority covered. A group brand alone may not establish legal responsibility.

WHERE 02 · Sites and locations

Identify production facilities, offices, remote teams, off site work, temporary sites and virtual or cloud locations as relevant.

WHAT 03 · Products and services

Describe what is delivered, to whom and through which activities. Use terminology that clients and auditors can recognize.

HOW 04 · Internal processes

Identify the operational and supporting processes that create, deliver, monitor or improve scoped outcomes.

INTERFACE 05 · Outsourced processes

Identify functions provided externally that influence conformity or management system outcomes, and specify the required level of control.

WHY 06 · External duties

Consider applicable laws, regulations, customer specifications, contractual commitments and other relevant obligations.

04. Scope Boundary Mapping: Entities, Sites & Outsourcing

Use a boundary map to make the extent of the management system visible to process owners and auditors. The following example distinguishes internal organizational sites from externally provided but controlled work, and from an unrelated legal entity.

Scope boundary hierarchy showing three included company sites, two outsourced controlled interfaces, and an unrelated entity outside scope — **Illustrative mapping only:** “Outsourced” does not mean “outside the management system”. The organization retains appropriate responsibility and controls over activities affecting its scoped outcomes. Whether an entity or site is in scope must be justified from the actual organizational structure and chosen standard.

Outsourcing: A critical scope decision

Identify the externally provided output, process owner, required controls, applicable obligations and retained records. Do not assume that moving an activity to a supplier eliminates the organization’s responsibilities. See Outsourced Processes and Their Impact on ISO Scope.

05. Applicability and Justified Non Applicability

Applicability decisions must be made against the actual requirements of the selected standard and edition. A reason such as “we have no design department” is not sufficient where design activities are performed by another function or supplied externally under the organization’s responsibility.

Assess whether a requirement applies

Identify the exact requirement and relevant edition.
Test it against in scope products, services, activities and organizational responsibilities.
Consider customer, statutory, regulatory and contractual commitments.
Identify who performs the activity, including external providers.
Document objective evidence and approve the applicability rationale.

Do not treat exclusion as a shortcut

Non applicability must be permissible under the particular standard.
A missing department does not necessarily mean a missing activity.
Outsourced work may still require controls and evidence.
A scope or applicability decision cannot mislead a customer or remove duties the organization retains.
Review the decision after business, site, product or process changes.

Standards specific caution: ISO 9001 provides a framework for determining whether particular requirements are applicable in its quality management system scope. Do not automatically apply that approach to ISO 14001, ISO 45001 or ISO/IEC 27001 without reviewing their own scope and applicability provisions.

ISO/IAF guidance provides useful examples and is explanatory rather than a replacement for normative wording. Refer to ISO 9001 Auditing Practices Group and your applicable licensed standard edition.

06. Example Scope Statements

A scope statement must be accurate, concise and understandable to the people who perform work and those who rely on the management system. The text below is illustrative and must be rewritten for the real legal entity, site list, activities, processes and standard.

QMS Manufacturing organization

Illustrative quality management scope: “Assembly, inspection and distribution of industrial control components at the Riverside production site and the North Park engineering office, including customer support and controlled externally provided logistics.”

ISMS IT services organization

Illustrative information security scope: “Information security governance and operation of customer application hosting, technical support and administrative activities performed by Meridian Cloud Services Ltd. across the City Centre office and identified hosted service environments, including relevant external provider interfaces.”

SITES Multi site service provider

Illustrative management system scope: “Provision of equipment maintenance, scheduling and customer assistance by Meridian Field Services at the central office and designated service locations, including centrally managed procurement and externally provided calibration services.”

What a strong statement should name

Entity and boundary: Precise organizational name(s) and included sites, where appropriate.
Processes and outputs: Products/services and material activities in scope.
Interfaces: Important externally provided activities and control responsibilities.
Applicability: The documented rationale for any non applicable requirements, where the standard permits.
Alignment: Consistency with operational records, customer facing claims and, where applicable, certificate wording.

07. Scope Definition & Audit Evidence Matrix

An audit ready scope is supported by a traceable set of records, not merely a paragraph in a policy. Use this matrix to plan what should be available for internal review and third party assessment.

On narrow screens, swipe sideways within the table to view all columns.

SCOPE ELEMENT	DEFINITION / QUESTION	EXAMPLE EVIDENCE	AUDIT CHECK
Legal entities	Which entities own the activities and are covered?	Registration, organizational charts, management authorizations	Interview leadership; test organizational boundaries
Sites and remote work	Which fixed, temporary, remote or virtual locations participate?	Site register, network map, facility plan, remote work controls	Sample each relevant site type and interface
Products & services	What products, services and customer groups are covered?	Product catalogue, service definitions, customer contracts	Trace a delivered product/service end to end
Core & support processes	Which processes affect scoped outcomes?	Process map, KPIs, responsibility assignments	Walk through operating controls and records
Outsourced processes	What external work affects outcomes and how is it controlled?	Contracts, SLAs, supplier reviews, acceptance records	Test control design and effectiveness at interfaces
Applicability rationale	Which requirements are determined not applicable, where permitted?	Applicability log, technical rationale, management approval	Compare rationale with actual performed work
Changes & exceptions	How are acquisitions, new sites and process changes assessed?	Change records, updated scope, review minutes	Verify re approval and affected site communication
Certification claims	Does publicly stated coverage match the certificate, if any?	Certificate, certification body schedule, published claims	Check scope consistency and any limitations

Sample tracing technique

Select a recent customer order or delivered service, identify the site and employees involved, follow each relevant process and outsourced handoff, then verify that the result is covered by the written scope and applicable controls. Repeat with a second scenario that tests a different site, activity or interface.

08. Six Step Scope Definition and Review

Treat scope definition as an evidence based governance decision. A short sequence reduces rework during implementation and creates a documented basis for auditors to test.

01 01 Confirm standard

Verify the chosen standard, edition, business purpose and requirements for defining scope.

02 02 Gather boundaries

List legal entities, sites, teams, products, services, suppliers and critical interfaces.

03 03 Map processes

Identify core and support activities, interfaces and outsourced processes affecting intended outcomes.

04 04 Assess applicability

Evaluate each relevant requirement and record defensible reasons for any permitted non applicability.

05 05 Draft and validate

Prepare the scope statement, test it with process owners and compare it with real workflows.

06 06 Approve and maintain

Approve the scope, communicate it, monitor change triggers and align it with applicable audit/certification information.

Practical release gate

Before approving the scope, verify that no relevant business unit, site, outsourced activity or customer requirement is overlooked, that non applicability decisions are defensible, and that management and affected process owners agree with the boundaries.

09. Common Scope Definition Mistakes

The following failure modes are frequently encountered when scope is treated as a formality rather than an operational decision.

AVOID Copying another certificate

Borrowed wording often hides a different legal entity, site pattern, product mix or service model. The scope must describe the organization’s own operations.

AVOID Excluding inconvenient suppliers

Externally provided activities may still influence conformity and require operational control and evidence.

AVOID Ignoring multi site variation

Different locations can have different process responsibilities, conditions and risks. A generic statement can become misleading.

AVOID Assuming all requirements are optional

The permission to determine non applicability depends on the selected standard. Document the exact clause and justification.

AVOID Confusing certificate and system

A certification scope may be narrower than the management system and must accurately reflect assessed activities.

AVOID Failing to review after change

Mergers, new sites, products, outsourcing or new obligations can make the scope out of date.

10. Frequently Asked Questions

Answers to common questions from organizations defining new or extended ISO management system boundaries.

Is a management system scope the same as the certificate scope?

Not necessarily. The management system scope is set for the organization’s system, while the certification scope must accurately represent what the certification body has assessed and certified. A single audit may have a narrower audit scope.

Can one management system cover multiple legal entities?

It can be structured to cover multiple entities where the governance, control arrangements and applicable standard permit it. The relationships, authority, sites and actual operating coverage must be explicit; certification arrangements may require additional evaluation.

Are outsourced processes automatically outside scope?

No. Outsourcing does not automatically eliminate responsibility for activities that affect the management system’s intended outcomes. Define what must be controlled, who is accountable and what evidence is retained.

Can an organization exclude design and development requirements?

For a quality management system, the organization should first establish whether it actually performs or remains responsible for design related work. Any justified determination of non applicability depends on the requirements of the applicable edition. Avoid assuming a department name proves that a requirement does not apply.

Can ISO 14001 scope exclude an inconvenient activity?

Do not apply an ISO 9001-style non applicability concept automatically to environmental management. Evaluate the applicable ISO 14001 scope requirements, organizational activities and environmental aspects using the current edition.

Must every site be included in a certificate?

The applicable certification arrangement can define which sites are assessed and included. Do not suggest that a site is certified unless the certificate and its scope support that claim.

What records should an auditor expect?

A documented scope statement, organizational/site data, process maps, defined externally provided process controls, customer or regulatory requirements, applicability rationale where permitted, and actual operating evidence.

When should scope be reviewed?

Review scope when there are material changes in legal entities, sites, products, services, process ownership, outsourcing, applicable requirements or intended outcomes, and as part of the management system’s planned reviews.

Does certification have to be obtained?

Not for every use of every ISO standard. Determine whether law, a customer contract, procurement rules or other applicable commitments require independent certification.

11. Related Knowledge, Official Sources & Next Steps

Use the related ISO Toolkits articles to deepen a scope decision and primary ISO materials to confirm the applicable edition and wording.

Official sources and publication notes

ISO: Standards Catalogue authoritative catalogue, editions and publication status.
ISO: Management System Standards overview of MSS and their common structure.
ISO 9001 Auditing Practices Group educational papers addressing scope, applicability, audit practice and outsourcing.
ISO/IAF APG: Scope and Applicability (PDF) useful scope distinctions and auditor considerations; note that it references ISO 9001:2015.
ISO: Certification distinction between ISO’s standards role and independent certification.

Choose an ISO Standard →Explore ISO Toolkit Selector →