Write a scope that matches the organisation

PRACTICAL GUIDANCE

The starting point

A useful scope tells a reader what the management system covers and where its boundaries sit. It should help customers, staff and auditors understand the claim without creating a false impression of wider coverage.

Distinguish the system, audit and certificate

The management system scope describes the boundary of the system. An audit scope defines the extent of a particular audit. The certification scope is the claim assessed and approved through the certification process. The three should be coherent, but they do not always use identical wording or detail.

Our recommendation is to keep a working explanation behind the concise public wording. That explanation can show entities, services, sites, teams, systems and dependencies without placing sensitive details on the certificate. Agree the certification wording with the certification body rather than presenting a draft as an approved claim.

Describe the actual service or product

Begin with what the organisation does for its customers or other intended recipients. “Business services” may be too broad to communicate meaningful coverage; a list of every task can be too detailed to remain useful.

As a practical exercise, ask a customer and an operational colleague to read the draft independently. Could either reasonably believe it covers something the organisation intends to exclude? Can staff identify which processes contribute to the described activity? Revise wording that depends on internal abbreviations or hides the nature of the work.

Map boundaries and dependencies

List the legal entities, locations, remote arrangements and significant outsourced activities relevant to the scope. Identify shared services such as human resources, procurement, identity management or facilities that support an included activity.

An organisational boundary does not make a dependency disappear. Our suggested map shows where control is direct, where responsibilities are shared and where assurance comes from an external provider. Describe how interfaces are managed. A supplier’s certificate may be useful evidence, but it does not automatically place your organisation within the supplier’s certification scope.

Apply the specific standard’s rules

Different standards have different rules about scope and applicability. Use the licensed requirements standard to determine how they apply. For ISO/IEC 27001, the management system requirements in clauses 4–10 apply, while Annex A control selection is addressed through risk treatment and the Statement of Applicability.

Do not generalise one standard’s approach to another. If an exclusion or boundary is important to the business case, resolve it early with competent advice and the certification body. Keep the rationale, affected interfaces and resulting controls together so that the decision can be reviewed.

Review the scope when the organisation changes

Our recommended review triggers include new services, sites, acquisitions, major suppliers, new AI uses and significant changes in data processing. Decide which changes require notification or assessment under the certification agreement.

Update operating documents and public claims consistently after the approved change. A marketing page can become misleading if it continues to describe a broad certification claim after a scope reduction or organisational separation. Assign an owner to keep certificate schedules, supplier questionnaires and website wording aligned with current status.

A practical scope brief

Use the following prompts to prepare a discussion, then turn the answers into clear prose. They are an editorial checklist, not a prescribed certification form.

• Entity: which organisation or organisations are included?
• Activity: which products, services and supporting processes are covered?
• Location: which physical and relevant virtual working arrangements are included?
• Interfaces: which shared functions and external providers support the activity?
• Boundary: what is outside the scope, and how are the interfaces managed?
• Change: who approves the scope and keeps related claims current?

Related guidance and practical next steps