Changing Your Scope AFTER ISO Certification

June 23, 2022 Danny Manimbo

Video Transcript:

So you're ISO certified, but you want to make some changes to the scope of your certification, can you do it? Do you have to wait until the certification review three years down the road? In this video, we're going to talk about some of the considerations when clients or organizations want to make changes to the scope of their certification.

Hi, I'm Danny Manimbo, I'm a principal with shell and company and one of the co-directors of our ISO certification practices. So you want to make changes to the scope of your certification, but you're not sure how. We often get asked this question by our clients. Now that I'm certified, I want to add some products or some applications or services, or maybe even some different locations or sector-specific standards, such as 27017, 27018, or 27701 to the scope of my management system. But I'm just not sure how, are we able to do that now? Or do we have to wait three years during our recertification review and do it then?

The good news is you have multiple options when it comes to modifying or expanding the scope of your management system. You can do it during your scheduled annual surveillance or recertification review, whichever audit is coming next, and your certification term. Or you can do a one-off scope expansion review if you say don't want to wait another 12 or 6 months before your next scheduled audit. But what are the things you need to consider when modifying the scope of your ISMS? It depends on the actual change you're making to your management system, but generally, the things you want to look at are:

  • Your scope statement
  • Revisiting your risk assessment to consider those changes to your scope
  • Ensuring that your internal audit is also ensuring any of those changes to scope are being incorporated into the scope of your internal audit and that all of those things are being reported up through your management review process.

This will give us confidence that your management system has been appropriately updated to reflect those changes in scope, and that will allow us following the completion of either that scope, expansion, your surveillance, or your recertification when that new scope was assessed to issue an updated certificate reflecting those changes.

So now that you understand how to incorporate changes to the scope of your management system, reach out by our website and we'd be happy to help. 

About the Author

Danny Manimbo

Danny Manimbo is a Principal with Schellman based in Denver, Colorado. As a member of Schellman’s West Coast / Mountain region management team, Danny is primarily responsible for co-leading Schellman's ISO practice as well as the development and oversight of Schellman's SOC practice line as well as specialty practices such as HIPAA. Danny has been with Schellman for eight years and has over 11 years of experience in providing data security audit and compliance services.

More Content by Danny Manimbo
Previous Video
So You Have ISO Nonconformities, Now What?
So You Have ISO Nonconformities, Now What?

Next Video
ISO 27001 Readiness Assessment or Consultant? When to Contract
ISO 27001 Readiness Assessment or Consultant? When to Contract