Defining the QMS Scope for ISO 9001 Certification
ISO 9001 Clause 4.3
This clause requires the organisation to prepare a documented scope for its quality management system, which states the types of products and services covered.
What Does ISO 9001 Clause 4.3 Require?
Clause 4.3 of ISO 9001:2015 requires your organisation to determine the boundaries and applicability of your quality management system. In practical terms, this means deciding what your QMS covers - which activities, products, services and locations fall within it - and documenting that clearly.
When determining the scope, the standard says you must take into account three things: the internal and external issues identified under Clause 4.1, the requirements of interested parties identified under Clause 4.2, and the products and services your organisation provides. The resulting scope must be documented and made available as documented information.
If you decide that any requirement of the standard does not apply to your organisation, you can exclude it - but only where that exclusion does not affect your ability to deliver conforming products and services or enhance customer satisfaction. Any exclusions must be clearly stated and justified within the scope documentation.
Two Meanings of Scope - and Why It Causes Confusion
One of the most common sources of confusion around Clause 4.3 is that the word "scope" is used to describe two related but distinct things.
The first is the QMS scope as a management system requirement - the documented definition of what your quality management system covers, which activities and locations are included, and any clauses of the standard you are not applying. This is what Clause 4.3 actually requires.
The second is the certificate scope - the short statement that appears on your ISO certificate describing your organisation's activities. This is what your certification body uses to summarise what you are certified for, and what customers will see when they look up your certificate.
These two things should align, but they are not the same document. Your internal QMS scope documentation may include detail about exclusions, justifications and boundaries that would not appear on a certificate. The certificate scope is typically a concise plain-language description of what the business does and what is covered.
What Should the Certification Scope Include?
A simple example might read: '[Company name] provides commercial cleaning services to offices and retail premises across the South East of England.'
The wording of this scope will be agreed with your certification body. Some like to include full address and location information in the scope. Others are content with a shorter description of the business activity, taking the view that the address is already printed elsewhere on the certificate. There is no single correct format prescribed by the standard for certification scope.
Where only part of the business is covered by the QMS, that should be stated with a clear rationale. Where the organisation operates across multiple sites, the scope should reflect which are included.
Exclusions and the Design Clause
If any clause of the standard genuinely does not apply to your organisation's activities, you can state it as not applicable and exclude it from the scope - provided the exclusion is justified and does not affect your ability to deliver conforming products and services.
The clause most commonly excluded is Clause 8.3 (Design and development). For organisations that manufacture to customer specifications or deliver a defined service without any design input, the simple reading of the standard is that Clause 8.3 does not apply.
In practice, this is one of the most inconsistently handled areas across the certification industry. Some certification bodies accept the exclusion readily where it is clearly justified. Others take the position that Clause 8.3 can never be excluded - arguing that any decisions about how a product or service is configured constitute design activity, so the clause always applies in some form. The standard does not support that interpretation, but it is applied often enough to cause real problems. Before finalising any exclusion of Clause 8.3, it is worth checking the specific position of the certification body you are using, as their interpretation will matter more than the standard in this instance.
Where to Document the Scope
The scope must be available as documented information. For organisations using a management system manual - such as IMS1 - the manual includes a dedicated scope and overview section that covers the integrated management system. The wider context - company profile and the internal and external context considerations from Clause 4.1 and Clause 4.2.
Organisations without a formal manual should have a clearly titled standalone document that can be easily retrieved and shared with auditors during certification or surveillance visits.
If you are going for certification, the scope wording submitted to your certification body should match what is documented in your management system. Discrepancies are a common audit finding and can cause unnecessary delays.
When I'm auditing against Clause 4.3, the first thing I want to see is a documented scope - somewhere in the management system, clearly stated. I'll check that it reflects the actual activities of the business and that any exclusions are credible and justified. At a surveillance or re-certification audit I'll also check the scope in the management system is consistent with what's on the certificate - if they've drifted apart, that's a finding. Where an exclusion has been claimed for Clause 8.3, I'll look at whether the organisation is genuinely making any design decisions. If there's evidence of design activity, the exclusion needs to be reviewed.
Getting the scope right at the outset saves a lot of difficulty later. I've seen organisations write a scope that's too narrow, which then creates problems when an auditor identifies activities the QMS doesn't formally cover. Equally, a scope that's too broad can create obligations the business isn't set up to meet. If you're using IMS1, the scope section of the manual gives you a clear place to record it, alongside the certification scope and any exclusions. My advice is always to agree the scope wording with your certification body before certification rather than finding out at the Stage 1 audit that they want something different.
With scope it is important to plan and know what is 'in-scope' before approaching a certification body for a certification quote. Certification costs are usually based on consideration of company size, turnover and the scope so it's important you don't include any locations, sub-divisions or services that don't need to be covered by the management system or the certification.
The Clause 8.3 exclusion of design situation is genuinely a mess. If your business doesn't design anything - you make things to a customer's drawing, or you deliver a standard service - common sense says Clause 8.3 doesn't apply to you and you can exclude it. That's what the standard says too. But some certification bodies flatly refuse to accept that exclusion, arguing that any element of deciding how to deliver a service counts as design. They're not applying the standard correctly in my view, but arguing about it mid-certification isn't a great position to be in. Before you exclude Clause 8.3, check what your certification body thinks about it first and it's sometimes safer to just include a design procedure and review forms even though these will never be used!
Practical Compliance Guidance
To comply with Clause 4.3, you need a documented scope statement that reflects what your QMS covers, based on your context and interested parties, and that is kept up to date as your organisation changes. If you are working towards certification, this also needs to align with the scope on your certificate.
The alphaZ documents below support compliance with Clause 4.3 directly. The IMS1 Manual provides the primary location for documenting both the scope and the organisational context that informs it. The associated registers support the Clause 4.1 and Clause 4.2 inputs that the standard requires you to consider when determining scope.
| alphaZ document | How to use it |
|---|---|
| ISO 9001 Management System Toolkit | The complete toolkit for implementing an ISO 9001 compliant management system. Includes the IMS1 manual, all policies, procedures, registers and audit checklists. |
| IMS1 Integrated Management System Manual | Primary location for documenting the QMS scope and certification scope. The manual covers organisational context, company profile and the internal/external factors that inform scope determination. |
| F-IMS20 Document Register | Records all controlled documents within the management system, including the scope statement and supporting documentation. |
| F-IMS22 Interested Parties Register | Documents the interested parties and their requirements considered as part of Clause 4.2 - a direct input into scope determination under Clause 4.3. |
| F-IMS23 Opportunities and Risks Register | Captures the internal and external issues (SWOT/PESTLE) from Clause 4.1, which are the other key input to defining the scope of the QMS. |
Note - all the above files can be downloaded with an alphaZ subscription
