How to Audit QMS Scope and Exclusions in ISO 9001

Why QMS Scope Is One of the Most Audited Clauses

Auditing the scope of a Quality Management System sounds straightforward on paper. You check the scope statement, compare it to what the organisation actually does, and move on. In practice, it is one of the areas where certification auditors raise findings most often, and where internal auditors frequently miss things that matter.

The scope defines the boundaries of the QMS. It tells you, the auditor, what is included, what is excluded, and why. Get the scope wrong and everything downstream is built on a shaky foundation. An organisation can have excellent procedures and well-trained staff, but if the scope does not reflect reality, the certificate does not mean what it claims to mean.

This article walks through how to audit ISO 9001 Clause 4.3 properly, what evidence to gather, how to assess claimed exclusions, and the common problems auditors encounter in the field.

What Clause 4.3 Actually Requires

ISO 9001:2015 Clause 4.3 requires the organisation to determine the boundaries and applicability of the QMS and then document the scope. The standard says the scope must be available and maintained as documented information.

When determining the scope, the organisation must consider three things:

• The external and internal issues referred to in Clause 4.1
• The requirements of relevant interested parties referred to in Clause 4.2
• The products and services of the organisation

The scope must state the types of products and services covered. Where a requirement of ISO 9001 cannot be applied, the organisation can exclude it, but only if that exclusion does not affect the organisation's ability or responsibility to ensure the conformity of products and services and the enhancement of customer satisfaction.

That last sentence is the critical test for any exclusion. It is not simply a matter of saying a clause does not apply. The organisation must demonstrate that excluding it does not compromise product or service conformity or customer satisfaction. As an auditor, that is your primary line of inquiry.

Starting the Scope Audit: Document Review Before You Walk the Floor

Before you interview anyone or visit a single workstation, review the scope statement as documented. Ask yourself these questions as you read it.

Is the Scope Statement Specific Enough?

A scope statement that reads

provision of services

Does the Scope Align with Context and Interested Parties?

The scope must be informed by the outputs of Clause 4.1 and Clause 4.2. Ask to see the context analysis and the interested parties register. Check whether the scope reflects the issues and requirements identified there. If the context analysis identifies a significant product line or a key customer segment, but that area is absent from the scope, you have a gap to explore.

For a deeper look at how to audit the context analysis itself, see our article on how to audit organisational context under ISO 9001 Clause 4.1.

Has the Scope Changed Since the Last Audit?

If you are conducting a surveillance or recertification audit, compare the current scope statement against what was certified previously. Organisations frequently add new product lines, open new sites, or acquire other businesses without updating the scope. Changes in scope should trigger a review of whether the QMS has been extended to cover those new activities.

Auditing the Boundaries: Does the Scope Reflect What the Organisation Actually Does?

This is where you leave the desk and start talking to people. The scope on paper is only part of the picture. You need to verify that the scope reflects operational reality.

Walk the Process from End to End

Follow the key processes from customer enquiry through to delivery. As you do, note whether every significant activity falls within the scope. If you observe a process that is clearly part of delivering the product or service but is not mentioned in the scope, ask why. The answer may be legitimate, or it may reveal that the scope has not kept pace with how the business operates.

For example, an engineering firm may have scoped its QMS to cover design services only. If during the audit you discover they are also providing project management and site supervision as part of their standard offering, those activities need to be assessed against the scope. If they are systematically excluded without justification, that is a nonconformity against Clause 4.3.

Interview People at Different Levels

Ask workers what they do and how their work contributes to the product or service. Then compare their answers to the scope statement. Frontline staff often have a clearer picture of operational reality than the documentation suggests. If a production operator describes tasks that sit outside the documented scope but are clearly integral to the product, that is worth recording as a finding.

Check Multiple Sites and Functions

If the organisation operates across multiple locations, verify that the scope makes clear which sites are included. A common problem is a scope that implies all sites are covered when, in practice, one or two locations have never been integrated into the QMS. Ask for evidence that those sites are actually audited internally, that their processes are controlled under the system, and that their outputs are subject to the same quality controls.

Auditing Exclusions: The Most Contested Area of Clause 4.3

Exclusions are where auditors and organisations most frequently disagree. The standard permits exclusions, but the bar for justifying them is higher than many organisations appreciate.

What Can and Cannot Be Excluded

Only requirements from Section 8 of ISO 9001 can be excluded. You cannot exclude requirements from Sections 4 through 7 or Sections 9 and 10. If an organisation claims to exclude Clause 5.1 or Clause 9.1, that is not a valid exclusion. It is a nonconformity.

Within Section 8, the most commonly excluded clauses are:

• Clause 8.3 Design and Development, often excluded by organisations that do not design their own products
• Clause 8.5.3 Property belonging to customers or external providers, excluded where no such property is handled
• Clause 8.5.4 Preservation, excluded where the nature of the product makes it inapplicable

How to Assess Whether an Exclusion Is Justified

For each claimed exclusion, apply the two-part test from the standard. First, can the requirement actually be applied given the nature of the organisation's products and services? Second, does excluding it affect the ability to ensure conformity or enhance customer satisfaction?

Take Clause 8.3 as an example. An organisation that assembles products to a fixed customer specification and makes no design decisions of its own can reasonably exclude design and development. But if that same organisation modifies designs, selects materials, or makes engineering decisions that affect product performance, Clause 8.3 applies and cannot be excluded.

The test is not whether the organisation calls what it does design. The test is whether the activities described in Clause 8.3 are actually occurring. Ask the organisation to walk you through a recent project. If design decisions are being made, even informally, the exclusion is not justified.

Ask for the Rationale in Writing

The scope statement must document any exclusions, and the justification for those exclusions should be evident. Ask to see how the exclusion was determined. A well-managed QMS will have a documented rationale, often as part of the scope statement itself or as a supporting document. If the organisation cannot explain why a clause was excluded beyond saying

it does not apply to us

Common Exclusion Problems Auditors Find

In practice, the following problems come up regularly:

• Clause 8.3 excluded by an organisation that is clearly making design decisions, often because they have always done so informally and never recognised it as design activity
• Clause 8.5.3 excluded by a service organisation that routinely handles customer-supplied data, equipment, or intellectual property
• Exclusions that were appropriate at certification but have since become inapplicable because the business has changed
• Exclusions listed in the scope statement without any accompanying justification

Each of these situations warrants a finding, ranging from an observation to a nonconformity depending on the severity and evidence available. For guidance on how to classify what you find, see our article on audit findings, observations, and nonconformities.

Linking Scope to the Rest of the Audit

The scope audit does not exist in isolation. What you find during the scope review will shape the rest of your audit plan.

Scope Drives Sampling Decisions

Once you have confirmed what is in scope, your sampling decisions should reflect that. If the scope covers three product lines but you only sample records from one, you may miss significant conformity issues in the others. Make sure your audit programme addresses the full scope, not just the parts that are easiest to access.

Scope and Outsourced Processes

Many organisations outsource parts of their process. Outsourced processes do not fall outside the scope simply because they are performed by an external provider. Clause 8.4 requires the organisation to control externally provided processes, products, and services. If an outsourced function is integral to the product or service, it must be controlled under the QMS even if it is performed by a third party.

When reviewing the scope, check whether any outsourced activities are relevant to product or service conformity. Then verify during the Clause 8.4 section of the audit that those activities are adequately controlled. A scope that treats outsourced core processes as outside the system is a problem that cuts across multiple clauses.

Scope and Certification Claims

For third-party auditors, there is an additional consideration. The scope statement is what appears on the certificate. If the scope on the certificate does not match what the organisation is actually doing, customers and regulators who rely on that certificate are being misled. This is a serious issue and one that certification bodies take very seriously. As a lead auditor, you carry responsibility for ensuring the certified scope is accurate.

Writing Up Scope-Related Findings

When you identify a problem with the scope, be precise in how you document it. Vague findings like

scope does not reflect operations

For example:

The documented scope (Clause 4.3) excludes design and development activities. However, during interviews with the engineering team and review of project files for Project X and Project Y, it was confirmed that the organisation selects materials, determines product dimensions, and approves design changes. These activities fall within the scope of Clause 8.3 and cannot be excluded under Clause 4.3 as they directly affect product conformity.

That level of specificity gives the organisation a clear basis for corrective action and leaves no room for dispute about what was found. For more on writing findings that hold up, see our article on how to write a nonconformity report that actually gets fixed.

Practical Audit Questions for Clause 4.3

Use these questions during your interviews and document review to gather meaningful evidence on scope and exclusions.

• Can you show me the documented scope statement and explain what it covers?
• What products and services does the organisation provide, and are all of them reflected in the scope?
• Are there any sites, functions, or activities that are deliberately excluded from the QMS? Why?
• Has the scope changed since the last audit? If so, how was the QMS updated to reflect that?
• For each claimed exclusion: can you walk me through why this clause does not apply and how you determined that?
• Are there any outsourced processes that affect product or service conformity? How are they controlled?
• Can you show me how the context analysis and interested party requirements influenced the scope?

Red Flags That Warrant Deeper Investigation

Certain situations should prompt you to look more closely at the scope rather than accepting it at face value.

• The scope statement is very broad or very generic, using language that could apply to almost any organisation
• The organisation has grown significantly since certification but the scope has not been reviewed
• Multiple exclusions are claimed without documented justification
• Clause 8.3 is excluded but the organisation clearly makes technical decisions about its products or services
• The scope mentions only one site when the organisation operates several
• Frontline staff describe activities that are not mentioned anywhere in the scope documentation

Building Scope Auditing Into Your Programme

For internal auditors, scope should be reviewed at least annually, not just at the start of the certification cycle. As the business changes, the scope must keep pace. A good internal audit programme treats scope as a living document and schedules a dedicated review each year, particularly before external surveillance audits.

If you are building or improving your internal audit programme, this is one of the foundational elements to get right early. An accurate, well-maintained scope makes every subsequent audit more focused and more credible.

Developing Your Skills in Auditing Clause 4.3

Auditing scope and exclusions well requires a combination of standard knowledge, process understanding, and interviewing skill. You need to know what the clause requires, understand how the organisation's processes work, and be able to ask questions that surface the truth rather than the rehearsed answer.

These skills are developed through structured training and practice. At Audit Workshop, our ISO 9001 Internal Auditor and Lead Auditor courses cover Clause 4.3 in depth, including how to assess scope boundaries, evaluate exclusion justifications, and write findings that are specific and defensible. The courses are built around real audit scenarios, not just theory, so you leave with practical skills you can apply immediately.

Whether you are preparing for your first internal audit or working toward lead auditor certification, understanding how to audit QMS scope is one of the foundations you need to get right.