ISO 9001 has multiple places where it talks about “scope”. There’s the scope of ISO 9001, the scope of your management system, the scope of your certification, and also the scope of an audit. It can be a bit confusing due to the various contexts in which "scope" is used.
Let's take a closer look at how the concept of "scope" is used and what you should keep in mind.
Scope 1 - Scope of ISO 9001
The ISO 9001 standard, “Quality Management System - Requirements,” has a first clause titled “1 Scope.” This clause defines the scope of the standard itself, stating under what circumstances the requirements apply to an organisation.
Generally, the full scope of ISO 9001 applies to your quality management system (i.e., all the requirements) unless there are certain activities you don’t do, in which case you can claim an exemption for the clauses that don’t apply.
There are only a few clauses where that can happen, e.g. Clause 8.3 if you don’t do any design, 7.1.5 calibration of measuring equipment if you don’t use measuring equipment, 8.5.2 traceability if that’s not necessary for your business, 8.5.3 if you don’t handle customer property.
Scope 2 - Scope of the Management System
This is about defining what parts of your business are covered by your QMS—the activities within and activities outside of the quality management system. It must be documented and is typically just a paragraph or two. You can’t arbitrarily exclude bits of your business from the scope. There has to be clear boundaries. Who is responsible for these activities and how they affect your products and services must be considered.
If a business area is outside the scope of the QMS but affects quality, it must still be controlled - just like an external provider. You’ll need to be able to show an auditor how you control that ‘outsourced’ process.
Most small to medium businesses will have everything in the scope of the management system. For companies that limit their scope, it’s often about location - e.g. the Sydney branch is in, but the Perth branch is out. This can be a common starting point for implementing a new QMS, with a plan to expand the scope to other locations once the system is established.
The scope boundaries may be defined by specific product lines, services, departments, or organisational functions to be included or excluded from the QMS scope. It is important to consider customer expectations when determining the scope. For example, excluding R&D may be acceptable, while omitting a critical production step from the certification would not be acceptable to customers or auditors.
Determining the system's scope should be done in the early stages of implementing a QMS - just like determining a project's scope before you start a project. There are commercial aspects, e.g., particular customers who care about your certification, so determining the scope is a strategic decision for top management.
Scope 3 - Scope of the Certification
This is generally the same as the scope of the management system, but you might make it smaller - e.g., the management system applies to both Sydney and Perth branches, but only Sydney is ready, so that’s the scope for the certification for now.
An external auditor will only audit what is inside the scope of your certification. This scope appears on the ISO 9001 certificate and must be brief. It should describe the scope in a way that makes it straightforward to customers precisely what products and services are covered - particularly if some are excluded.
When documenting the scope of your certification, you need to include a description of your products and services, the nature of your activities (or position in the value chain). It may also include information on location and the industry or types of customers you service. The scope of certification is usually just one sentence. Here are some examples:
- Design and manufacture of… bulk material conveyor parts.
- Distribution of… marine bollards.
- Provision of…business advisory services... to accounting practices in NSW.
- Application and repair of… painting and surface coatings... to the mining and construction industries in WA and NT.
You can access certification information for other organisations to see more examples of certification scope.
The auditor will verify the scope of the certification to ensure it is appropriate for your organisation. You must be able to demonstrate that you do everything within the scope of your certification. Changing the scope of your certification requires an external audit, so most businesses choose to do that during a regular surveillance or recertification audit.
Scope 4 - Audit Scope
When you have your certification audit, the external auditor will look at the locations and activities to be certified, so in this case, the audit scope is the same as the scope of the certification.
For internal audits, you can choose to do the whole system all at once or break it into smaller parts. The scope of an internal audit is the requirements, locations, activities and/or processes you plan to cover each time. Take a look at our tips and tricks for stress-free internal quality system audits.
How all the Scopes Relate to Each Other
Here’s a diagram showing how all those scopes fit together:
Let’s go through an example. Here’s a process map showing the scope of the QMS for a manufacturing business.
This business makes products that don’t require traceability, so that clause in the standard doesn’t apply. The 'traceability' clause is represented by area 1 in the diagram above. It's in the scope of the standard but outside the scope of the business.
The process map shows a “People” procedure in their QMS documentation, which includes references to HR policies and payroll, and the “Business Planning” process includes marketing plans. These are certainly important business activities and are included in the scope of their management system, but they are outside the scope of ISO 9001. These activities are represented by area #2.
This business is based in Brisbane, and a new distribution warehouse is being set up in Townsville. The new warehouse is not yet fully operational, so the business has chosen to leave it out of the certification scope. Brisbane is in the certification's scope, area 3. Townsville is in area 4 of the diagram - in the scope of ISO 9001 and in the QMS, but out of the certification.
They plan to conduct four internal audits over the year. Each one has a different audit scope that covers a part of the QMS, as follows:
- February: Production and Release activities
- May: Enquiries, Orders, Purchasing, Warehouse, Shipping, and Warranty
- August: Support and Evaluation processes
- October: Planning and Improvement processes
The diagram shows the scope of one of these audits as area 5.
In another small business example, where all of the ISO 9001 clauses apply to the business, all business activities are in the scope of the certification, and an audit covers the whole system, the various scopes would be identical:
In conclusion, we've examined the different meanings of "scope" in ISO 9001 and how the scope of the standard, management system, certification, and audit all fit together. Understanding these various aspects is essential for effectively navigating ISO 9001.
Quality Systems Toolbox software securely stores, shares, and controls documented information like system scope, making it easy to find the most current version whenever you need it - such as during an external audit or for an annual review. You can also manage audit processes, findings, reports and other system records in one centralised location for your QMS.
Would you like to see whether Quality Systems Toolbox software could help your management system? Please contact us to book your free demo or call us at 1300 551 588 (AET)