By Russell Lawson, ISO consultant, auditor, and founder of The Compliance Companion - a platform that helps businesses simplify ISO 9001, ISO 14001, ISO 45001 and ISO 27001 with AI-powered templates, expert support and practical tools. Russell has worked with hundreds of businesses to implement and streamline management systems that actually work in the real world - not just on paper.
Most people skip past Clause 4.3 of the ISO standards because it looks short and harmless:
“Determine the boundaries and applicability of the management system to establish its scope.”
Simple, right? Just write a sentence or two, job done.
But after years of working with organisations on ISO 9001, ISO 14001, ISO 45001 and ISO 27001 - and auditing countless more - I’ve learned this:
The scope sets the tone for everything else.
When it’s vague, overcomplicated, or too narrow, it creates confusion. When it’s clear, accurate and aligned with how your business actually operates, it makes the entire system easier to implement, manage, and audit.
In this blog, we’ll break down what ISO really means by “scope,” why it matters more than most people realise, and how to get it right from the start.
What Does ‘Scope’ Actually Mean in ISO Standards?
Your scope is the definition of what your management system covers - and just as importantly, what it doesn’t.
It should tell us:
-
What parts of the organisation are included (sites, departments, services)
-
What the management system applies to (e.g. design, manufacture, installation)
-
Where the organisation operates (physical locations, remote working, etc.)
-
Whether anything is excluded (with a good reason why)
It’s not a slogan. It’s not a marketing pitch. It’s a boundary.
As I often tell clients: if you get the scope wrong, the rest of the system will be built on the wrong foundations.
Why Auditors (Like Me) Care So Much About Scope
When I put my auditor’s hat on, one of the first things I check is the scope.
Why? Because it tells me where I’m supposed to look - and what I should be assessing. If the scope says “Head Office only,” then I’m not going to spend my time asking questions about warehouse processes or international branches.
But if a company’s activities clearly extend beyond what’s written in the scope - or if key functions are excluded without justification - then I start asking questions.
I’ve had clients say, “Oh, that bit’s handled by another team” or “That service isn’t covered by ISO.” If it’s not clearly explained in the scope, that can become a major nonconformity - not because of the activity itself, but because the system doesn’t accurately reflect reality.
Common Scope Mistakes (I’ve Seen Them All)
Here are a few examples I’ve encountered in real audits and consultancy projects:
Too Generic:
“The provision of goods and services.”
What goods? What services? Where? For whom? This tells me nothing.
Overly Technical or Confusing:
“Design, installation, and maintenance of electro-mechanical subassemblies across multi-jurisdictional operations with integrated third-party oversight.”
What does that even mean? If your own employees don’t understand your scope, it’s not helping anyone.
Misaligned With Reality
A company says their scope is “Manufacture only” - but then during the audit, I discover they also install and maintain the products. That’s not just a scope issue - it’s a risk to compliance.
Missing Locations or Departments
If your system covers multiple sites or teams, the scope needs to reflect that. I’ve seen many businesses only reference head office while the actual work happens elsewhere.
How to Get Your Scope Right - First Time
From my experience working with everyone from start-ups to manufacturers and service providers, here’s what works:
- Keep it simple but specific
State clearly what your business does, where it does it, and what’s included. No jargon.
- Reflect reality
Don’t write the scope based on what’s easiest to certify. Write it based on how your organisation actually operates.
- Use it as a tool - not a tick-box
A well-written scope makes it easier to plan audits, manage compliance, and communicate with staff and stakeholders.
- Update it when things change
If your business adds a new site, product line or service, revisit the scope. I’ve seen scopes that haven’t been touched in years, even though the business has completely changed shape.
Here’s an example of a good, simple scope from a client I worked with recently:
“The provision of building repair, reinstatement and drying services, including scoping and management, across domestic and commercial properties in the UK.”
It tells you exactly what the company does, where it operates, and gives a clear picture to both the business and the auditor.
A Final Word on Exclusions
If you’re working with ISO 9001, you may want to exclude certain clauses that don’t apply (for example, Clause 8.3 on design, if you don’t do design).
That’s fine - but the scope needs to justify those exclusions clearly. I always advise clients to explain why something is excluded and show that it doesn’t affect the product, service, or customer.
Auditors will always check whether exclusions are valid and justified - and whether the system still meets the intent of the standard.
Need a Smarter Way to Build Your ISO System?
At The Compliance Companion, we provide ready-made templates - including scope statements - that help you get this right from the start. Our system is designed to guide you through writing a meaningful scope, defining exclusions properly, and aligning the whole management system around what you actually do.
No fluff. No overcomplication. Just practical help that works.
👉 https://the-compliance-companion.co.uk/harness-the-future-of-iso