What the clause requires
The scope states where the quality management system applies: which products and services, which sites, which processes. To define it, the company considers the internal and external issues of clause 4.1, the requirements of the interested parties of clause 4.2, and its own products and services. The scope has to be available and maintained as documented information, and it is one of the few documents the standard names explicitly, alongside the quality policy and the quality objectives. It is also the first thing an auditor reads, because it sets the boundary of everything that will be audited afterwards.
Every requirement of the standard applies inside the scope. A company may only declare a requirement not applicable if it genuinely cannot be applied and if leaving it out does not affect the ability to ensure the conformity of products and services and to enhance customer satisfaction. The most common case is clause 8.3, design and development, in a company that manufactures strictly to the customer drawing. The justification has to be written down, and it has to survive an auditor asking who decides the dimensions when the drawing is silent.
The scope is also printed on the certificate, so the wording matters: it has to be clear to the customer who reads it. "Manufacture of precision machined parts to customer drawings" says a great deal; "the activities of the company" says nothing at all. The auditor checks two things: whether the scope matches what the company actually does on the shop floor, and whether any relevant activity, site or outsourced process was left outside the boundary in order to avoid a requirement. A scope written to hide work is a finding waiting to happen.
What the auditor asks to see
- A documented scope naming the products, the services and the sites that it covers
- A written justification for each requirement the company declared not applicable
- Consistency between the wording of the scope and the activities observed in the company
- The scope reviewed whenever the company changes product, service, process or site
Where companies most often get it wrong
- Excluding clause 8.3 when the company does develop product or adapts the customer design
- A vague scope that makes it impossible to know what was actually certified
- A relevant site or externally provided process left out with no justification at all
- A scope left out of date after the launch of a new line of service
Example of a nonconformity
- Requirement
- ISO 9001, 4.3: a requirement may only be declared not applicable if it does not affect the ability to ensure the conformity of products and services.
- Evidence
- The scope declares clause 8.3 not applicable ("we manufacture to the customer drawing"). During 2026 the engineering team developed three in-house fixtures sold from the catalogue (DIS-01 to DIS-03), with internal design and validation.
- Finding
- The design and development requirement was declared not applicable for an activity the company performs.
Ready-made templates for this clause
Frequently asked questions
Does ISO 9001 still talk about "exclusions"?
The 2015 version replaced the term with "not applicable". In practice the justification is still mandatory and the criterion became stricter.
Can I certify only one site?
Yes. The scope defines the sites covered, and the certificate is only valid for what the scope says.
Which requirement is usually not applicable?
Clause 8.3 (design and development) in companies that only build to the customer design, and parts of 7.1.5 in companies that do not measure anything to release product. Each case needs its own justification.