Developing the Scope and Exclusions in ISO 9001 Certification & AS9100 Certification | My ISO Consultants
Updated: Sep 18
Defining the scope of an ISO 9001 or AS9100 quality management system determines what products, services, processes, locations, and organizational activities are covered by the QMS and, ultimately, by the certification. A clear scope helps employees, auditors, customers, and certification bodies understand exactly what the organization is claiming its management system controls.
The term “exclusions” is still commonly used, but ISO 9001:2015 and AS9100 Rev D are better understood in terms of applicability and non-applicability. An organization can determine that a requirement does not apply to its QMS, but that decision must be justified and cannot undermine the organization’s ability or responsibility to provide conforming products and services.
2026 Standards Note
As of September 2026, ISO 9001:2015 remains the current published ISO 9001 edition, with the sixth edition scheduled for publication on September 16, 2026. AS9100 Rev D / 9100:2016 remains the current published aerospace quality management standard. Organizations should continue working to the current published requirements and verify any updated wording or transition guidance when the new ISO 9001 edition and future IA9100 revision are formally released.
QMS Scope, Certification Scope, and the Scope of the Standard Are Different
One common source of confusion is that ISO 9001 uses the word “scope” in more than one way. Clause 1 describes the scope of the ISO 9001 standard itself. Clause 4.3 requires the organization to determine the boundaries and applicability of its own quality management system. The certification scope is the portion of that QMS the organization chooses to have independently certified.
For most organizations, the scope should clearly identify the types of products and services covered and make the operational boundaries understandable. Depending on the organization, that may also involve specific sites, departments, divisions, service locations, or other organizational boundaries.
What Should an ISO 9001 or AS9100 Scope Include?
A useful scope statement should accurately reflect the organization’s real activities and should be specific enough that it is not misleading. When developing the scope, consider:
The products and services covered by the quality management system.
The physical sites, departments, divisions, or organizational units included.
The operational processes needed to provide the covered products and services.
Relevant customer, statutory, regulatory, contractual, and interested-party requirements.
The organization’s context, risks, opportunities, and business considerations.
Externally provided or outsourced processes that affect the conformity of covered products and services.
A company should not use wording that implies certification covers products, services, or activities that fall outside the actual QMS. For example, a business certified for a specific type of manufacturing should not describe its certification so broadly that customers could reasonably believe unrelated products or services are also covered.
How Non-Applicability Works in ISO 9001 and AS9100
ISO 9001:2015 moved away from the older approach that limited formal exclusions to a specific part of the standard. Under the current approach, the organization evaluates whether individual requirements are applicable to the scope of its QMS.
A requirement can be treated as not applicable only when doing so does not affect the organization’s ability or responsibility to ensure the conformity of its products and services and support customer satisfaction. The organization should be able to provide a clear justification for the decision.
For the current 9100-series standard, IAQG clarification material states that non-applicability can be determined down to a clause, “shall” statement, or portion of a requirement when justified with documented information. The justification does not have to appear specifically in the scope section of a quality manual, but it needs to be documented somewhere appropriate within the QMS.
Can Design and Development Be Listed as Not Applicable?
Design and development is one of the most common applicability questions. An organization may determine that design and development requirements are not applicable when it truly has no responsibility for specifying or developing the products or services it provides.
For example, a build-to-print manufacturer working entirely from customer-controlled engineering may have a basis for treating some design requirements as not applicable. However, the actual responsibilities need to be evaluated carefully. If the organization designs tooling, develops product requirements, modifies customer designs, or performs another activity that falls within design responsibility, simply calling the business “build-to-print” does not automatically make all design requirements non-applicable.
Organizations that are unsure whether a requirement legitimately applies can use ISO 9001 consulting services to evaluate the QMS scope and applicability before certification documents are finalized.
Outsourcing Does Not Automatically Remove a Requirement From the Scope
An organization cannot make a requirement non-applicable merely because the related activity is outsourced. When an external provider performs a process that affects products or services covered by the QMS, the organization still has responsibility for controlling the externally provided process to the extent required by the management system.
This is especially important when companies outsource manufacturing, special processes, calibration, testing, design activities, warehousing, logistics, or other work that directly affects the certified products or services.
Scope Considerations for Multiple Sites and Complex Operations
Scope decisions become more complicated when an organization operates across multiple sites, provides services at customer locations, relies heavily on centralized support functions, or uses significant outsourced processes. The scope should make the boundaries of the QMS understandable without implying that excluded locations or activities are certified.
Which locations perform activities covered by the QMS?
Are support functions such as purchasing, engineering, quality, or administration centralized at another location?
Are any products or services intentionally outside the certification scope?
Do outsourced activities still affect the conformity of products or services within the certified scope?
Would a customer reading the certification scope understand what is and is not covered?
AS9100 Scope and Non-Applicability Considerations
AS9100 follows the same basic scope and applicability principles while adding aerospace-specific requirements. Aerospace organizations should be particularly careful when determining that a requirement is not applicable because some aerospace controls are expected to have relevance across a broad range of aviation, space, and defense organizations.
IAQG clarification material notes, for example, that it would be unusual for an aerospace organization to have no applicable controls related to operational risk management, configuration management, product safety, or prevention of counterfeit parts. Any claimed non-applicability should therefore be based on the organization’s actual activities and supported by a defensible documented justification.
Aerospace organizations preparing for certification can use AS9100 consulting services to review scope, applicability, documentation, and certification readiness before the external audit.
Common Scope and Exclusion Mistakes
Writing a scope that is broader than the products, services, locations, or activities actually controlled by the QMS.
Using the word “excluded” without documenting why a requirement is legitimately not applicable.
Assuming outsourced processes no longer fall under the organization’s QMS responsibilities.
Treating design and development as not applicable without reviewing the organization’s actual design responsibilities.
Leaving a location, support function, or process outside the scope even though it directly affects certified products or services.
Using a certification scope that could reasonably mislead customers about what the certificate covers.
Frequently Asked Questions
Can we exclude design and development from ISO 9001 or AS9100 if our customers provide the drawings?
Possibly, but customer-provided drawings do not automatically make all design and development requirements non-applicable. The organization needs to evaluate its actual responsibilities. If it only manufactures to customer-controlled requirements and does not develop or modify product requirements, there may be a justified basis for non-applicability. If the organization performs design-related work, those responsibilities still need to be addressed.
Can we leave one of our locations out of our ISO 9001 or AS9100 certification scope?
Potentially, if the selected certification scope accurately reflects the QMS being certified and the excluded location does not perform activities that must be controlled to support the covered products or services. The final scope cannot be misleading, and the certification body will evaluate whether the proposed boundaries are appropriate.
Can an outsourced process be excluded from our ISO or AS9100 quality system?
Not simply because it is outsourced. If an externally provided process affects products or services covered by the QMS, the organization remains responsible for applying appropriate controls to that external provider and process.
Who decides which ISO 9001 or AS9100 requirements are not applicable?
The organization determines the scope of its QMS and identifies requirements it believes are not applicable, with documented justification. During certification, the certification body reviews the scope and applicability decisions to determine whether the organization can legitimately claim conformity to the standard.
Conclusion
A well-defined scope should tell customers, employees, and auditors exactly what the quality management system covers without overstating the organization’s certification. Non-applicability can provide appropriate flexibility, but it must reflect the organization’s real operations and cannot be used to avoid requirements that affect product or service conformity.
If your organization needs help defining its QMS scope, evaluating non-applicable requirements, or preparing for certification, My ISO Consultants provides ISO 9001 consulting services and AS9100 consulting services to help develop a practical, defensible management system that reflects how your organization actually operates.
