When a tender dossier requires ISO certification, the tendering party reads the scope page of the certificate, not only the name of the standard or the logo. A certificate that lists a different business line, a different site, or a different legal entity, even if the company does “have a genuine ISO certificate”, does not match the requirements of the specific tender. Reading this page early helps the enterprise add what is missing before the bid closing date.
Quick answer: the certification scope is the mandatory part of an ISO certificate, stating the certified legal entity, the site(s) assessed, and the products, services or processes within the scope. When using a certificate for a tender dossier, a contract or a partner registration, check these three items against the actual requirements. Do not infer them from the company name or the ISO logo printed on packaging.
What does the certification scope include?
Under the general principles of ISO/IEC 17021-1, the standard for bodies auditing and certifying management systems, the certificate must state the scope that was assessed. Three parts usually appear on ISO 9001, ISO 14001, ISO 45001 or other management system certificates:
- Certified legal entity: the name and registered address, matching the enterprise registration certificate. A subsidiary is a different legal entity and has a different certificate.
- Site(s): the place where the management system was actually assessed: head office, factory, workshop, or warehouse. For several sites, each site is listed or an annex lists them; vague wording such as “and all branches” is not used.
- Products, services or processes: a specific description of the activities within the scope, for example “manufacturing and mechanical processing” or “design consultancy for construction works”, rather than general business line names from the business registration certificate.
The standards ISO 9001, ISO 14001, ISO 45001 and others set the requirements for the management system; the wording of the specific scope on the certificate is the responsibility of the certification body, based on the actual assessment at each site and for each activity, not a standard template applied to every client.
Why checking the scope matters in tendering
ISO certification is a criterion only when the tender dossier sets it; once it is set, the requirement usually relates to the specific type of work and the specific place where the tender package will be carried out. Three situations are common:
| Situation | Problem | How to handle it |
|---|---|---|
| The certificate lists the head office, but the package will be carried out at another factory | The site does not match the assessed scope | Inform the certification body so the site can be assessed before the bid; do not use the head office certificate for a site that has not been assessed |
| The certificate covers trading activities, but the tender requires manufacturing or processing | The process does not match the scope | Assess the extension of the activity scope; do not assume that “having ISO 9001 covers everything” |
| New business lines are added, or the head office moves after the certificate was granted | The old scope does not extend automatically to changes | Notify the certification body of the change; this is different from a periodic surveillance audit and should be done before the bid closing date |
This check takes place when the tendering party evaluates the dossier against the criteria stated in the tender dossier. A dossier that does not match the scope is easily assessed as non-compliant at this step. Having a certificate with a clear scope and site information ready allows the enterprise to answer quickly if the tendering party asks for clarification.
Subcontractors: the scope is tied to the legal entity and cannot be borrowed
An ISO certificate is tied to the legal entity that was assessed. Some situations are easily misunderstood:
- The parent company has ISO, but the subsidiary or subcontractor does not. If the tender dossier requires a subcontractor to hold ISO, the subcontractor, as a separate legal entity, needs a certificate in its own name, not the parent company’s or the contracting party’s.
- Outsourcing a stage to an external workshop. If the workshop does not have a matching certified scope, the enterprise must either extend the scope to that workshop under the certification body’s procedure, or not accept a stage that requires certification for that part of the work.
- The tender dossier attaches the certificate of Factory A, but the goods are actually made at Workshop B. This is a scope mismatch with the actual place of performance. When the tendering party checks the site, the dossier is easily assessed as non-compliant.
The scope does not extend on its own over time or with growth
A common misunderstanding is: “the company is growing, more factories have been added, so the old ISO certificate should still cover everything.” In practice, the certification scope only reflects what was assessed at the time of granting or at the most recent assessment, and it does not update automatically with the enterprise’s real changes. Some common changes should be notified to the certification body rather than assumed to be “still within the scope”:
- Opening a new factory or branch, even when it is in the same business line as a certified site.
- Moving the head office or the main production site to an address different from the one on the current certificate.
- Adding a product line, production line or new service not described in the scope.
- Changing the company name: notify the certification body so the information on the certificate can be updated.
- Merging or splitting enterprises: notify the certification body so it can consider the assessment approach suited to the organisational change.
For each of these changes, the certification body will consider the level of impact and decide the form: an additional audit at the new site, an extension of the scope audit, or consolidation into the nearest surveillance or recertification audit. What matters is that the enterprise notifies the change in advance, before it needs to use the certificate for the new work, rather than discovering the scope mismatch only after the tender has been rejected.
Common misunderstandings
- Treating the standard name (ISO 9001, ISO 14001, etc.) as sufficient, without reading the scope. Two companies that both hold ISO 9001 may have completely different scopes: one “manufacturing”, the other “trading, no manufacturing”. When a tender requires a specific type of activity, check against that specific type, not just the standard number.
- Using photos or old photocopies with no clear date. The copy submitted with a bid should be currently valid, with a clearly readable issue date, expiry date and certificate number; many tendering parties require an online check for verification.
- Assuming the parent company’s certificate automatically applies to a subsidiary. These are two legal entities with different business registrations, so they have different certification scopes, unless the subsidiary was included in the same scope from the start and is clearly stated on the certificate.
- Requesting a scope extension close to the bid closing date. A scope extension takes time (scheduling, on-site assessment, handling nonconformities if any); leaving it until the last minute before submission may not be feasible.
Reading the certificate correctly
- Read the scope page printed on the original certificate, not a “ISO 9001 certified” poster or the logo on packaging or business cards. These do not replace the scope page.
- Check the standard code and the year edition stated on the certificate (for example ISO 9001:2015 or ISO 9001:2026). Two editions with different years have different requirements, and a tender dossier may specify which edition is required.
- Check the accreditation mark of the accreditation body (for example the mark of the Bureau of Accreditation (BoA) in Vietnam, or a foreign accreditation body that belongs to the IAF MLA mutual recognition arrangement) printed on the certificate, if the tender dossier requires an “accredited” certificate. This is a separate mark from the general ISO logo. For how to look it up, see the article How to check whether an ISO certificate is genuine or fake.
- Check the expiry date, and whether the certificate is currently suspended. Tender dossiers usually require a certificate that is valid at the bid closing date. For the surveillance and recertification schedule, see the article ISO 3-year certification cycle.
What Thái Tín supports
We receive the request and, together with the enterprise, compare the existing ISO certificate scope against the specific requirements of the tender dossier or partner contract: the right legal entity, the right site, and whether the activity is covered. When the scope needs to be extended (adding a site or a business line) or a separate certificate is needed for a subcontractor, we connect the enterprise with a suitable consultancy and certification body to carry out the additional assessment. The assessment and the decision to grant or extend the certification scope are made by the certification body; we act as the coordinating point. See also ISO 9001 certification: what an enterprise needs to prepare and ISO, standards and certification services.
Questions and answers
What does the scope of an ISO certificate include?
At least three parts: the name and address of the certified legal entity, the site(s) where the management system was assessed, and the products, services or processes within the scope. The specific wording is recorded on the certificate by the certification body, based on the actual assessment results.
If a company has several branches, can one certificate be used for all of them?
Only if each location has been included in the assessed scope and is clearly stated on the certificate (or in a site annex). A branch or factory that has not been assessed is not within the scope, even if it belongs to the same parent legal entity.
If a company adds a product line or moves production, is the old certificate still usable?
The old scope does not automatically extend to a new product line or a new site. The company must notify the certification body so that it can assess the scope extension, or reassess the new site, before using the certificate for that work.
Can a subcontractor use the ISO certificate of its parent company or the party that awarded the subcontract?
No. A certificate is tied to the legal entity that was assessed, and cannot be transferred or lent between different legal entities, including a parent company and its subsidiary, or a contracting party and its subcontractor. If the tender dossier requires a subcontractor to hold ISO, the subcontractor needs a certificate in its own name.
Where in the certificate should you check the scope against a tender dossier?
Read the scope page printed on the certificate directly (not posters or advertising logos), and compare it with the specific requirements in the tender dossier regarding business lines and the location where the package will be carried out. For further verification, look up the name of the certification body on the website of the accreditation body that has accredited it.
Legal basis · verification date
Verified 2 October 2026 · next review 29 December 2026. The content is general guidance and does not replace advice for a specific case.
- ISO 9001:2026 Quality management systems: Requirements, published 16/9/2026, replacing ISO 9001:2015 (iso.org; dnv.com, release notice 2026, accessed 29–30/9/2026).
- ISO/IEC 17021-1:2015 Conformity assessment: Requirements for bodies providing audit and certification of management systems, Part 1 (competence, consistency and impartiality requirements for audit and certification bodies, including the requirement to determine and record the certification scope) (iso.org/standard/61651.html). The 2015 edition is the current edition; no replacement had been issued as of 02/10/2026.
- Law on Standards and Technical Regulations No. 68/2006/QH11 (Luật Tiêu chuẩn và quy chuẩn kỹ thuật), amended and supplemented by Law No. 70/2025/QH15 (adopted by the National Assembly on 14/6/2025, in force 01/01/2026): a standard is a voluntary document for application.
- boa.gov.vn, Functions and tasks page (accessed 30/9/2026): the Bureau of Accreditation (BoA, Văn phòng Công nhận Chất lượng Quốc gia) is a full member of APAC, ILAC and IAF, and signs mutual recognition arrangements (MLA/MRA) for the accreditation of certification bodies for management systems and products.
