Changing Your Scope AFTER ISO Certification

So you're ISO certified, but you want to make some changes to the scope of your certification, can you do it? Do you have to wait until the certification review three years down the road? In this video, we're going to talk about some of the considerations when clients or organizations want to make changes to the scope of their certification.

Hi, I'm Danny Manimbo, I'm a principal with Schellman and one of the co-directors of our ISO certification practices. So you want to make changes to the scope of your certification, but you're not sure how. We often get asked this question by our clients. Now that I'm certified, I want to add some products or some applications or services, or maybe even some different locations or sector-specific standards, such as 27017, 27018, or 27701 to the scope of my management system. But I'm just not sure how, are we able to do that now? Or do we have to wait three years during our recertification review and do it then?

The good news is you have multiple options when it comes to modifying or expanding the scope of your management system. You can do it during your scheduled annual surveillance or recertification review, whichever audit is coming next, and your certification term. Or you can do a one-off scope expansion review if you say don't want to wait another 12 or 6 months before your next scheduled audit. But what are the things you need to consider when modifying the scope of your ISMS? It depends on the actual change you're making to your management system, but generally, the things you want to look at are:

• Your scope statement
• Revisiting your risk assessment to consider those changes to your scope
• Ensuring that your internal audit is also ensuring any of those changes to scope are being incorporated into the scope of your internal audit and that all of those things are being reported through your management review process.

This will give us confidence that your management system has been appropriately updated to reflect those changes in scope, and that will allow us following the completion of either that scope, expansion, your surveillance, or your recertification when that new scope was assessed to issue an updated certificate reflecting those changes.

So now that you understand how to incorporate changes to the scope of your management system, reach out through our website and we'd be happy to help.