Determining the scope of the BCMS
Fix and document which parts of the organization, which products and which services sit inside the BCMS, and justify every exclusion in writing.
01What applies
Fix and document the boundaries of the BCMS. Decide which parts of the organization and which products and services fall inside it, and justify whatever is left outside. The scope statement is documented information, so it carries a version, an approval and a date. The justification has to be substantive: an exclusion because the activity is hard to recover is a finding, while an exclusion because another certified system covers it, with the interface defined, is a defensible boundary. The clause also expects the scope to reflect the context analysis, not to be drawn to fit the audit.
02Why it matters
Scope is where a BCMS is most often weakened quietly. Excluding the activity most likely to fail makes the certificate easier and the organization less resilient. The clause forces the boundary into a document a customer, an auditor and a board can read, and it makes the exclusions visible. For a draft that introduces a process reference model, the scope statement is also the list of processes the model has to cover.
03What good looks like
Draw the scope as a matrix: entity, site, product or service, and a yes or no. For every no, write the reason and the system that covers it, if any. Check the boundary against the context issues and the interested party requirements. Have top management approve it, and revisit it when a product, a site or an outsourced service changes.
04Evidence an auditor asks for
Ask which activity would hurt most if it stopped for a week, then check whether it is inside the scope. If it is outside, the justification is the first thing the auditor will read.
| Evidence | The record |
|---|---|
| Scope statement | Approved scope as controlled documented information, with version and date |
| Rationale | The reasoning for the boundary drawn, tied to the context analysis |
| Exclusions | Every exclusion with its justification and the system that covers it, if any |
05Where it commonly fails
- Scope written to fit the audit rather than the business
- No version or approval trail on the scope statement
- Boundary silent on outsourced or shared service functions
06What to do before the estimate
List every product and service, mark it in or out, and write one sentence for each exclusion. Take the list to the executive who signs the certificate.