Scope decisions for ISO systems with multiple sites and outsourced operations
Head offices, factories, warehouses, remote teams and service providers create different scope questions. Identify activities and responsibilities before mapping them to the subject of the selected management system standard.
Questions for your situation
Does our head office certificate also cover our factory?
Read the scope statement, organisation name and covered sites together. Purchasing managed at headquarters and manufacturing at a factory require different evidence. The factory's activity and address need to be included in the assessed scope before they are represented as covered; sharing a company name is insufficient.
What should we prepare for ISO 9001 if all manufacturing is outsourced?
Explain who specifies the product, selects the manufacturer, controls acceptance and manages nonconforming output. Use a completed order to connect specifications, supplier approval, acceptance checks and customer feedback. Record the responsibilities your organisation retains for the work performed externally.
How do ISO 14001 and ISO 45001 boundaries work in rented premises?
Separate the building manager's duties from your activities for shared boilers, waste areas, emergency exits and maintenance. Identify where you control or influence environmental impacts, worker exposure and contractor activities. Review records of actual site practice alongside the lease agreement.
Can we use the same file for ISO 27001 and ISO 20000-1 with cloud services?
Information security addresses access, data, risks and security controls; service management addresses service boundaries, service levels and operation. A provider contract can support both. However, an access review and the handling of a service outage answer different questions, so map shared records to their respective purposes.
Are electricity bills enough for ISO 50001?
Bills provide initial data. Also define the site boundary, significant energy uses and variables such as production or weather that affect consumption. Explain the conditions of periods used in a savings comparison, and identify measurement gaps, data sources and calculation assumptions.
Can ISO 22301 address supplier failures and software outages together?
Examine activities that depend on both materials and information systems. Assess impacts over time and connect alternative supply, data recovery, staffing and customer communication. Exercises should test restoration of the priority service at an acceptable level, as well as restarting the system.
Does outsourcing production justify excluding design from ISO 13485?
Establish who holds design responsibility in contracts and actual practice. Outsourced production is distinct from design responsibility. Consider product specification, change approval and the regulatory role in the target market together. Any justification for non-applicability must reflect the actual activities.
Can we use our existing certificate after adding a branch or activity?
Notify the certification body of the activity, address, staffing and start date. Obtain written clarity on its effect on scope. Show how the change affects the process map, risks, internal audit and management review, and plan the scope extension assessment accordingly.
Practical example
Imagine a fictional business designing products in İzmir, using a contract manufacturer in another city and shipping from a separate warehouse. Assign responsibility for design approval, supplier control, acceptance and dispatch, then map addresses and records. This explains why an office-only quotation differs from one covering all operations. The example does not establish a certification decision or eligibility for multisite sampling.
This is a fictional example, not an actual client case or conformity decision.
Share the subject, organisation or product, target market, current evidence and target date. The team can then separate consultancy, official fees, independent evaluation and realistic timing.