An ISO certificate is evidence for the activities named in its scope statement, carried out at the sites listed on the certificate. Those words set the boundary of what the audit examined. A certificate can be genuine, accredited and in force, and still say nothing about the contract in front of you, because its scope describes a different activity from the one you are buying. Reading the scope takes about a minute, and it is the check most supplier assurance files skip.
The scope is settled before the audit begins. The questionnaire we send before any proposal collects the standard, the headcount, the number of sites and the processes in scope, and the audit duration is derived from those answers. The audit plan issued in advance names the sites, shifts and processes the team will visit. The certificate that follows records what was examined, and our register publishes that wording verbatim for every certificate we have issued, alongside the standard edition, the sites, the status and the validity dates.
What the scope words tell you
Read the verbs first. A scope that says "trading and supply of construction materials" describes an organization that buys, stores and sells. A scope that says "design, supply and installation of structural steel" describes an organization that carries engineering responsibility for what it delivers. ISO 9001:2015 requires this precision: clause 4.3 obliges the organization to state the products and services its management system covers, and to justify any requirement it determines does not apply. Design is the usual case. A company that performs no design can determine that clause 8.3 does not apply, and its scope will read "manufacture to customer specification" rather than "design and manufacture". Both are accredited ISO 9001 certificates. They are evidence about different capabilities, and a buyer procuring design work needs the certificate that names it.
The site list is the second boundary. Certification is granted for named locations, and the audit plan behind the certificate visited those locations. Work run from a branch that opened after the audit, or from a facility the organization chose to leave out of scope, sits outside the certificate. The organization's name at the top is the least informative line on the document; the site list below it is the part that was audited.
For ISO 14001 and ISO 45001 the same reading matters more, because the risks are physical and local. An environmental or occupational health and safety management system certified at a head office says little about a yard, a workshop or a live construction site that was never in scope, and those are the locations where ISO 45001 evidence is usually wanted.
A valid certificate for the wrong work
The document that causes trouble in a tender file is usually a genuine certificate whose scope stops short of the work. A bidder attaches a current ISO 9001 certificate. The scope reads "trading of building materials". The contract is for supply and installation. Everything printed on the certificate is true, and the audit behind it examined purchasing, storage and delivery. An installation process was never audited, because the certified organization never put one in scope. Treating that certificate as evidence of certified installation capability is a reading error, and it is one a tender evaluator can be held to.
The check is two readings, side by side. Read the scope statement against the scope of work in the contract, activity by activity. Then read the certificate's site list against where the work will be managed and delivered from. Where either reading fails, the question to the bidder is specific: which certificate covers this activity, at this location?
Scope can also change during the three-year cycle. It can be extended when a new activity or site is added and audited, and reduced where part of it can no longer be supported. The register carries the current wording; a PDF in a supplier file carries the wording from the day it was printed. That is the same reason the register, rather than the document, is where a certificate's status is read.
If you hold one of our certificates and the business has outgrown its words, with a new activity or a new site, raise it with us before the certificate goes into a tender. The scope can be extended only after we have audited the added activity or site, and the time to run that audit is before a bid depends on it.