ISO 9001 certificate scope: does it cover your part?
An ISO 9001 certificate covers only what its scope statement names: the products or activities, and the sites. If the process your part needs, or the factory that will make it, is not in that statement, the certificate tells you nothing about it. Read the scope line against your drawing before you read anything else, then confirm it on IAF CertSearch.
This is the check most buyers skip. The earlier guide to a supplier's certificate covered edition, expiry and accreditation mark. All three can be correct on a certificate that does not cover your job.
What the scope statement actually limits
ISO 9001:2015 clause 4.3 makes the certified company decide the boundaries of its quality system: which products and services, which sites, and which requirements do not apply. The certification body audits inside those boundaries and prints them on the certificate. Everything outside was never audited.
Glocert, a certification body, puts the buyer's problem plainly in its scoping guide:
"If the certificate covers 'widget assembly' but the customer buys 'widgets including design, assembly, and after-sales support,' the certificate misses the mark." — Glocert, Scoping ISO 9001 Certification
Three limits matter most for a machined or fabricated part.
- Activities. The scope names what is done, not what is sold. "Trading and distribution of steel components" certifies buying, storing and shipping. It says nothing about how the part was cut.
- Sites. Each certified address is listed. A group with several plants may certify one. On a multi-site certificate, the certification body audits a sample of sites on each visit, not every one.
- Exclusions. The most common is design and development (clause 8.3), which is legitimate for a shop that only makes parts to customer drawings. If you are asking the supplier to design the part, that exclusion matters to you.
How to read it against your part
Write down the route your part takes, then look for each step in the scope. For a turned, heat-treated and plated shaft with a welded bracket, it looks like this:
| Step on your drawing | What to look for in the scope | If it is missing |
|---|---|---|
| CNC turning and milling | "Machining" or "manufacture of machined components", not only "supply" or "trading" | The supplier may be buying the part in. Ask who makes it. |
| Welded bracket | "Fabrication" or "welding" named as an activity | Ask how welders and weld procedures are qualified. The certificate does not answer it. |
| Heat treatment and plating | Usually absent; most shops send these out | Normal. Ask how the subcontractor is controlled (see below). |
| Design changes you want the supplier to make | Design and development not excluded | Keep design with you and send a finished drawing. |
| The plant that will make it | That address on the certificate or its site annex | The certified site is not the one making your part. |
"General manufacturing" or "all products" gives you nothing to check against. Treat a scope that vague as a question to ask, not an answer.
What about the steps the supplier sends out?
An outsourced step does not have to appear in the scope, but it cannot fall outside the quality system either. Clause 8.4 requires the certified company to control external providers whose work affects conformity. So when heat treatment or plating goes to another shop, the question is not "is that shop certified?" but "how do you control it?" A good answer names the approved subcontractor, how the supplier checks the result (hardness test, coating thickness), and what paperwork travels with the batch. Ask for that paperwork with your order.
How to confirm the scope is real
Ask for a copy of the certificate, including any site or scope annex, then look it up on IAF CertSearch. It is the database ISO itself points buyers to. For each accredited certificate it shows the status, the scope, the certified locations, the certification body and its accreditation body, with the data supplied by those bodies rather than by the supplier. Search by company name or certificate number; the free service covers occasional checks.
The scope check is the same on 2015 and 2026-edition certificates. ISO's certification page now notes that Global ACI has taken over the IAF's former roles; CertSearch is still where to look.
CertSearch holds accredited certificates only. If a certificate is not there, ask the supplier which accreditation body stands behind its certifier, and check that body's own list.
Send the part and the requirement together
Put the scope question into the RFQ rather than asking it after the order: name the processes on your drawing and ask the supplier to confirm which of them its certificate covers and which it sends out. The RFQ checklist shows the rest of what to send. To quote a part with its quality requirement attached, send your drawing to Vesprr Workshop.
Sources
- Scoping ISO 9001 Certification: Products, Services, Sites, and Exclusions, Glocert International: clause 4.3 scope, the design-and-development exclusion, clause 8.4 outsourcing, multi-site sampling.
- Certification, ISO: verifying accredited certification through IAF CertSearch, and Global ACI assuming the IAF's former roles.
- IAF CertSearch FAQ: General, IAF CertSearch: what each certificate record shows, accredited certificates only, watch lists and the free service.
- Earlier on this site: Is your supplier's ISO 9001:2015 certificate still valid?