What is a management system scope statement?

A management system scope statement is a documented declaration of what an ISO management system covers. It defines the boundaries of the system - including the products or services, locations, and organisational functions to which the standard applies. It is a mandatory documented requirement under ISO 9001, ISO 14001, and other High Level Structure standards.

What must be included in an ISO scope statement?

An ISO scope statement must describe the products or services covered, the locations or organisational boundaries included, and any justified exclusions. For ISO 9001, any excluded clauses must be identified and the reason for exclusion explained. The scope must be specific enough that an auditor or customer can clearly understand what the certificate covers.

Can you exclude clauses from your ISO 9001 scope?

Yes. ISO 9001 permits certain clauses to be excluded if they are not applicable to the organisation's activities, provided the exclusion does not affect the organisation's ability to deliver conforming products or services. The most commonly excluded clause is Clause 8.3 (Design and Development), which may not apply to organisations that manufacture to customer-supplied specifications rather than their own designs.

How does the scope statement connect to the rest of an ISO management system?

The scope defines the boundary within which all other elements of the management system operate. It determines which processes must be documented, which risks must be assessed, which staff require training, and which sites must be included in the internal audit programme. Changes to the scope must be formally reviewed and the certification body notified.

How often should an ISO scope statement be reviewed?

The scope should be reviewed at least annually during the management review, and whenever a significant organisational change occurs - such as opening a new site, launching a new product line, or exiting a market. Any change to the scope must be communicated to the certification body, which may require a revised audit before the updated scope is reflected on the certificate.

What Is a Management System Scope - and How Do You Define One?

When an auditor arrives to assess your ISO certification, one of the first documents they will ask to see is your scope statement. It is rarely the most glamorous part of an ISO implementation, and it tends to receive less attention than the risk register or the quality policy. That is a mistake. A poorly written scope can undermine your entire management system - and a well-written one can make your certification journey considerably smoother.

This article explains what a management system scope is, why it matters, how to write one, and what good looks like in practice.

What Is a Scope Statement?

Your scope statement is a formal, written declaration of what your management system covers. It defines the boundaries of your system - the activities, locations, products, services, and parts of the organisation to which your ISO standard applies.

Think of it like the terms and conditions of your certification. It tells your customers, your auditors, and your own staff exactly what the certificate on your wall actually means. If something falls within your scope, it is subject to the requirements of the standard. If it falls outside, it is not - but you must be able to justify that exclusion.

Every ISO management system standard that follows the High-Level Structure (the common framework shared by ISO 9001, ISO 14001, ISO 45001, and others) requires a documented scope. It is not optional, and it is not something you define loosely and revisit only at your three-year recertification.

Why Does It Matter?

There are three reasons the scope statement deserves serious attention.

It sets the boundaries of your certificate. When a customer or procurement team asks to see your ISO certificate, they may also ask what it covers. A certificate that applies only to your head office, for instance, does not extend to your warehouse or your field operations unless they are explicitly included. Misrepresenting the scope of a certificate - even unintentionally - can damage trust and in some cases create contractual or legal complications.
It shapes everything that follows. Your scope determines which processes need to be documented, which risks need to be assessed, which staff need to be trained, and which sites need to be audited. Get the scope wrong at the beginning and you will either be doing far more work than necessary, or you will find yourself with gaps that an auditor will identify.
It is one of the few mandatory documented requirements. Both ISO 9001 and ISO 14001 explicitly require the scope to be documented and available as documented information. It is one of a small number of documents the standard insists must exist in writing.

What Must a Scope Statement Include?

The standard sets out three things your scope must address:

Products and services. What does your organisation produce or deliver? For a manufacturer, this is the products it makes. For a service business, it is the services it provides. Be specific enough to be meaningful, but not so granular that the scope becomes unwieldy.
Applicable locations and organisational boundaries. Where does the management system apply? This might be a single site, multiple sites, or specific departments within a larger organisation. If your organisation has parts that are genuinely outside the scope - a separate subsidiary, a different business unit operating under different processes - these need to be noted and justified.
Justified exclusions. ISO 9001 allows organisations to exclude certain clauses if they are not applicable to their operations, provided those exclusions do not affect the organisation's ability to deliver conforming products or services. The most common example is Clause 8.3 (Design and Development), which can be excluded by businesses that follow a customer-provided specification rather than developing their own designs. Any exclusion must be stated in the scope and explained - not simply omitted.

ISO 14001 does not use the same clause-exclusion mechanism, but it does require you to define the physical and organisational boundaries of your environmental management system clearly.

Common Mistakes to Avoid

Scope creep in reverse. Some organisations write a scope so narrow that it excludes activities that are genuinely central to what they do. This can make the certificate appear misleading and will raise questions from an experienced auditor.
Scope that is too broad. The opposite problem is equally common - declaring that the scope covers "all activities of the organisation" when in reality only certain functions have been brought into the management system. Auditors will test this by looking at whether the processes, risks, and controls actually cover everything the scope claims.
Vague language. Phrases like "various activities" or "general operations" do not constitute a scope statement. It needs to be specific enough that an independent person reading it could understand what is and is not covered.
Forgetting locations. Multi-site businesses frequently write a scope that implies full coverage but only audit and document processes at one location. If a site is in scope, it must be treated as in scope throughout the system.

How to Write Your Scope Statement

A useful formula for drafting a scope statement is to work through four questions in order.

What do we do? Start with your core products or services. Describe them in plain language that a customer or auditor unfamiliar with your business could understand.
Where do we do it? List the sites, locations, or departments included. If some sites are excluded, note that and explain why.
Who are we doing it for? This is not always required explicitly in the scope statement, but thinking through your customer base and the sectors you serve helps ensure your scope accurately reflects what the certificate is meant to demonstrate.
What are we leaving out, and why? Identify any clause exclusions (for ISO 9001) or boundary exclusions, and document the reasoning. The justification does not need to be lengthy, but it must be credible.

Once you have worked through these questions, write the scope statement as a single, coherent paragraph or short series of sentences. It should be concise - typically no more than a short paragraph - but complete.

Example One: ISO 9001 Scope for a Manufacturing SME

Returning to our fictional company from the SWOT article:

"The design, manufacture, and supply of precision-engineered components for the construction sector, carried out at Hartley Precision Engineering Ltd's single site in Sheffield. This scope excludes Clause 8.3 (Design and Development) in respect of components manufactured to customer-supplied specifications."

Notice what this scope does well. It names the activity (design, manufacture, and supply), the product type (precision-engineered components), the sector served (construction), and the location (Sheffield). It also explicitly states and justifies the one clause exclusion. An auditor reading this knows immediately what to expect and what to look for.

If Hartley later opened a second facility in Leeds and began producing components for the rail sector, the scope would need to be updated before that site or that work could be considered covered by the certificate.

Example Two: ISO 14001 Scope for a Facilities Management Company

"The environmental management of facilities services - including cleaning, waste management, and building maintenance - delivered by Greenway Facilities Ltd across client sites in the North West of England. The scope excludes the organisation's head office function in Manchester, which does not directly deliver operational services."

Here the scope is defined by service type and geography rather than a product. The exclusion of the head office is noted and justified on the basis that it does not deliver operational services directly. For ISO 14001, the environmental impacts associated with the in-scope activities - waste generated on client sites, vehicle emissions from field teams, chemicals used in cleaning - would all need to be assessed and controlled. The head office's environmental footprint, by contrast, falls outside the scope of this particular certificate.

This distinction matters. If Greenway's head office had significant environmental impacts - a large energy footprint, for instance - an auditor might question whether excluding it is truly justified.

How the Scope Connects to the Rest of Your Management System

Your scope statement does not exist in isolation. It connects directly to several other parts of your management system.

Your SWOT or PESTLE analysis helps you understand the context within which your scope sits. The internal and external issues you identify should be consistent with the activities and boundaries you declare in your scope.
Your interested parties register should reflect the stakeholders relevant to the activities within your scope. If your scope covers manufacturing but not logistics, then logistics-related stakeholders may fall outside the register - though in practice, supply chain relationships often mean they remain relevant regardless.
Your risk register must address the risks associated with in-scope activities. A common audit finding is a risk register that covers only part of what the scope declares.
Your internal audit programme must cover all sites, functions, and processes within the scope over the audit cycle. This is one of the most practical reasons to keep your scope realistic - every part of it must be audited.

Reviewing and Updating Your Scope

Your scope is not set in stone. It should be reviewed whenever your organisation undergoes significant change - entering a new market, acquiring a new site, launching a new product line, or exiting an existing one. The review should be formally documented, and if the scope changes, your certification body must be notified. Depending on the nature of the change, they may require a surveillance visit or a revised audit before the updated scope can be reflected on your certificate.

At minimum, the scope should be reviewed annually as part of your management review process, even if no changes are made. A recorded confirmation that the scope remains accurate is itself useful documented evidence.

A Note on Integrated Management Systems

If your organisation holds or is seeking certification to more than one standard - ISO 9001 and ISO 14001, for example - it is worth considering whether the scopes should be aligned. Many organisations choose to operate an Integrated Management System (IMS), in which a single set of documentation, processes, and audit activities serves multiple standards simultaneously. In this case, a single scope statement can cover both, provided it addresses the relevant requirements of each standard.

This is not mandatory. Some organisations maintain separate management systems with different scopes - for instance, where only part of the business is relevant to environmental management. Both approaches are valid, but the integrated approach tends to reduce duplication and audit fatigue considerably for SMEs.

Finding Support

Defining a scope that is accurate, auditor-ready, and genuinely useful to your business is one of the areas where working with an experienced ISO consultant pays dividends quickly. Getting it right at the start avoids costly scope amendments, surveillance visits, and the kind of minor nonconformities that can knock confidence in an otherwise well-prepared system.

The ISOCentral directory lists consultants across the UK and US who specialise in helping SMEs define and document their management systems from the ground up. Whether you are implementing ISO 9001 for the first time or preparing for the 2026 transition, finding the right support early is one of the best investments you can make.