Describing the scope of certification: tips and examples

Are you about to start a certification process? Then the scope of certification must be described carefully. The scope defines which activities, products, services and locations are included in the certification. The scope description must be clear, complete and not misleading. Anything outside the scope of certification is not assessed as part of the certification audit. Would you like to know how a certification process starts at Brand Compliance? Read the certification process step by step.

What is a scope? #

A scope describes the nature, extent and boundaries of the certification. It is a textual description of the activities, processes, products or services of the organization that fall within the scope of certification. A scope description makes clear which part of the organization has been assessed and certified. A well-defined scope provides clarity, direction and focus. Formulate the scope in such a way that a third party immediately understands what the certificate has been issued for. The scope should make clear which activities, processes, products or services meet the relevant standard.

The management system to be certified is established on the basis of a predefined scope. The scope of certification is determined during the application for certification. Based on the scope description, Brand Compliance can assess whether the application falls within the scope of its accreditation and whether a proposal can be prepared.

Supporting processes #

It is not always necessary to explicitly mention supporting processes in the scope description when they do not have a prominent role within the scope of certification. Examples include marketing, HR and purchasing. This does not mean that these processes are automatically outside the certification. If a supporting process directly affects the primary process, the service or the product delivered to the client, it may be relevant to the scope of certification. Focus the scope description on the activities, processes, products or services that directly relate to what the organization delivers and what is controlled within the management system.

Tips for a clear scope description #

When describing the scope, it is important that the wording is factual, clear and not commercial. The following points can help you formulate a clear scope description:

• Clearly define what is included in the scope of certification and what is not.
• Describe activities, processes, products or services in concrete terms.
• Limit the use of abbreviations.
• Avoid ambiguous or misleading wording.
• Do not use subjective or commercial claims, such as “high-quality”, “innovative” or “market leader”.
• Use verbs to make clear what the organization does.

For example:

“Selling and repairing cars.”

Instead of:

“Car dealer.”

Where several activities are included, it is useful to apply a clear structure. This helps prevent the scope from being interpreted in a misleading or ambiguous way. In such cases, the scope can be structured with bullet points, for example:

“Information security related to:

• developing, implementing and managing software;
• providing management and support services;
• managing client data within the agreed service delivery.”

Scope description for an ISMS #

For an ISMS, an information security management system, the scope description is particularly important. The scope makes clear which information, processes, systems, locations and services the information security management system applies to.

Examples of a scope description for ISO 27001 certification are:

“Information security related to developing, implementing and managing software for storing, retaining and processing medical data in support of occupational health services, including the management of databases and servers in an external data center within the EU.”

“Information security related to advising, designing, developing, integrating, maintaining and operating mobile applications and web applications for processing personal health information and providing associated external hosting services.”

Scope description for NEN 7510 #

For NEN 7510 certification, the scope of certification must make clear which activities, products or services relate to the management of personal health information. Where parts of the management of personal health information have been outsourced, this must be clear from the scope description. The relationship with the applicable controls from the organization’s Statement of Applicability should also be clear.

An example of a scope description is:

“Information security related to setting up, configuring and managing IT environments for office automation in which personal health information may be processed, where application management and storage of personal health information are partly outsourced.”

Scope and the certification audit #

The scope description plays a role in the preparation and performance of the certification audit. During the stage 1 audit, the auditor assesses, among other things, whether the management system is sufficiently prepared and whether the scope of certification has been clearly described. A clear scope helps define the boundaries of the audit and prevents uncertainty about which activities, locations, processes or services are included in the certification.

Conclusion #

A clear scope description shows which part of the organization is included in the certification. The description should be factual, concrete and not misleading. Avoid commercial wording and describe what the organization does, for whom, where and within which boundaries.