Certificate scope · Qatar buyers
How to Read the Scope on an ISO Certificate
A valid certificate only proves something useful if its scope covers what you are buying. This guide explains how to read the ISO certificate scope: what the certification scope statement covers, how to check the sites and activities listed, how applicability works, and the scope mismatches that buyers and procurement teams in Qatar most often miss.
About QAC Qatar. We are an ISO certification body: we audit, assess, certify, issue, surveil and renew certificates. QAC conducts independent management-system audits and certification assessments.
What a certification scope statement is
The certification scope statement is the part of an ISO certificate that describes exactly what was audited and certified. The name of the standard tells you which requirements were assessed; the scope tells you where and to what those requirements were applied. Two certificates for the same standard can cover very different things, so the ISO certificate scope is usually the most important line for a buyer to read.
ISO/IEC 17021-1, the standard for bodies that audit and certify management systems, sets out what certification documents must identify. These include the name and geographical location of the certified client (or of the headquarters and sites within a multi-site certification), the effective and expiry dates, a unique identification code, the standard used including its issue status, the name, address and certification mark of the certification body, and the scope of certification “with respect to the type of activities, products and services as applicable at each site”. The same standard requires that scope wording is not misleading or ambiguous.
The legal entity named on the certificate and its location.
The activities, products and services that were certified.
The sites, with addresses, that fall within the certification.
The standard and its edition used for the audit.
Activities, products and services covered
A clear scope statement reads like a short description of the certified work, for example “design and manufacture of steel storage tanks” or “provision of facility cleaning services”. Each word matters. “Supply” is not the same as “manufacture”, “installation” is not the same as “design and installation”, and a scope limited to one product family does not cover another product the same company sells.
When a certification body audits an organisation, the audit team assesses whether the management system operates effectively for the activities in the proposed scope, and the scope wording is confirmed in the certification decision. If the organisation later starts new activities, the certificate does not stretch to cover them; an extension of scope has to be requested, audited and decided before it appears on a revised certificate.
Sites and locations listed
The certificate also tells you which locations are covered. A single-site certificate names one address. For multi-site organisations, the international rules in IAF MD 1:2023, now reissued without substantive change as Global ACI-TECH-3-001 (M), require certification documents to contain the name and address of all the sites covered. Where a site carries out only part of the organisation’s scope, its sub-scope is shown, and temporary sites shown on the documents are identified as temporary.
In practice this means the ISO certificate sites covered are those listed on the certificate or its annex. A branch, warehouse or workshop that is not listed should not be assumed to be certified, even if it belongs to the same group. Our article on multi-site ISO certification audits in Qatar explains how sites are assessed and sampled before they can appear on one certificate.
Same company name, different legal entity
Groups often trade under one brand through several legal entities. A certificate issued to one entity does not cover a sister company with a similar name. Match the legal name and address on the certificate with the entity on your contract or purchase order.
Exclusions and applicability
Buyers sometimes look for a list of exclusions on the certificate. Under ISO 9001:2015, an organisation may determine that a requirement cannot be applied within its scope, for example design requirements for a business that only produces to customer drawings. That decision has to be justified, and conformity can only be claimed if it does not affect the organisation’s ability to ensure conforming products and services. The certification body reviews the justification during the audit.
Guidance from European Accreditation notes that non-applicable requirements are recorded in the certification body’s client file and do not appear on the certificate; the certificate is a full certification to the standard. What the reader should look at instead is the activity wording. If the scope says “manufacture of” rather than “design and manufacture of”, design is simply outside the certified activities. For ISO/IEC 27001, the controls that apply are set out in the organisation’s Statement of Applicability, which certificates commonly reference by version.
Scope vs the standard named
The standard named and the scope answer different questions, so read them together. ISO 9001 relates to quality management, ISO 14001 to environmental management, ISO 45001 to occupational health and safety and ISO/IEC 27001 to information security. A broad ISO 9001 scope says nothing about environmental or safety performance.
Check the edition as well. ISO 9001:2026 was published on 16 September 2026, and certificates to ISO 9001:2015 remain valid during the transition period, which ends on 30 September 2029. During that period you may see either edition on genuine certificates; what matters is that the certificate is valid and that the edition stated matches the one referenced in your requirement, where your requirement specifies one.
| Certificate element | What to check | Why it matters |
|---|---|---|
| Standard and edition | The standard and issue status match your requirement. | A different standard assesses different requirements. |
| Legal entity | The name matches your supplier’s contracting entity. | A group name does not extend cover to sister companies. |
| Activities | The verbs and products describe what you buy. | “Supply” and “manufacture” are different scopes. |
| Sites | The delivering site is listed with its address. | Unlisted locations are outside the certificate. |
| Dates and status | Valid now, not suspended, withdrawn or expired. | Scope only counts while the certificate is valid. |
Common scope mismatches in supplier checks
When procurement teams check supplier ISO scope, the same patterns appear again and again. None of them means a certificate is false; they mean the certificate does not cover the work being tendered. The examples below are generic.
The certificate covers trading or distribution, but the tender requires manufacture or installation.
The certificate lists a head office, while the work is delivered from an unlisted workshop or yard.
The certificate belongs to a parent or sister company, not the bidding entity.
An ISO 9001 certificate is offered where the requirement asks for ISO 45001 or ISO 14001.
The scope fits, but the certificate has expired or was reduced at a later audit.
Very broad phrases such as “general services” that do not identify specific activities.
Vague or very broad scopes deserve particular care, because accredited certification documents are required to describe the scope without ambiguity. A scope that cannot be matched to real activities is a reason to ask questions, and our guide to the warning signs of a fake or unaccredited ISO certificate in Qatar covers other red flags to look for.
Confirming scope with the issuing body
The certificate in your hands may be an old copy, so confirm the current ISO certificate scope at the source. ISO/IEC 17021-1 requires a certification body to provide, on request, the status of a given certification and the name, normative document, scope and geographical location of a specific certified client. Many accredited certificates can also be checked on IAF CertSearch, which shows the standard, scope, certified locations, status, certification body and accreditation body. Our step-by-step guide on how to verify an ISO certificate in Qatar explains both routes.
If a certificate does not appear in a database, that is not by itself proof that it is invalid; ask the issuing body directly. Quote the certificate number and ask three questions: is the certificate currently valid, which activities does the scope cover, and is the site delivering your contract included.
Frequently asked questions
Does a certificate cover every branch of a company?
No. Only the sites named on the certificate or its annex are covered. Branches, workshops and sister companies that are not listed fall outside the certification.
Why does the certificate not list excluded ISO 9001 requirements?
Non-applicable requirements are justified and recorded in the certification body’s file rather than printed on the certificate. Read the activity wording to see what is and is not certified.
Can the scope change during the certification cycle?
Yes. A certification body can extend a scope after auditing the new activities, or reduce it where requirements are no longer met. A revised certificate is then issued, so always check the current version.
Contact QAC to discuss your organisation’s certification scope
Tell us which activities, products, services and sites you want assessed, and we will explain how the audit is planned against that scope. Explore our ISO certification services in Qatar, learn how to verify an ISO certificate, and see how multi-site certification audits work.
