- Home
- Certification
- Services
- Scope extension.
Scope extension.
An extension is always a review of the application plus a determination of what audit activity is needed. Combining it with surveillance is a permission, not a default.
What actually happens.
- Review of the application to extend, against the certification already granted
- Determination of the audit activity necessary to decide whether the extension can be granted
- A threshold check first: whether the new scope falls inside our own accredited scope
- Whether the addition introduces processes or activities that have never been audited at all
- Recalculation of audit time for the extended scope — added personnel, sites, processes or risk category
- Multi-site sampling recalculated where the extension adds sites
- Audit team competence reviewed, since a new technical area may need a competence the surveillance team does not hold
- The wording of the certified scope reviewed for accuracy and for what it implies to a reader
- Certificate reissued only after an independent review and a certification decision
The rules this runs under.
| The rule | What it requires | Reference |
|---|---|---|
| It is a review plus a determination | In response to an application to extend a certification already granted, the certification body reviews the application and determines the audit activities necessary to decide whether the extension may be granted. | ISO/IEC 17021-1:2015, 9.6.4.1 |
| Combining with surveillance is permitted, not automatic | The extension audit activity may be conducted in conjunction with a surveillance audit. That is a permission conditional on the determination above — not the default route. | ISO/IEC 17021-1:2015, 9.6.4.1 |
| Audit time is recalculated | An extension that adds effective personnel, sites, processes or risk category requires the audit time to be recalculated. Where the planned surveillance duration cannot absorb the addition, separate audit activity is required. | IAF MD 5:2023, Issue 4 Version 3 |
| New process families need Stage 2 equivalent coverage | Where the extension introduces activities never previously audited, the coverage required of a Stage 2 audit must be achieved for those elements. | ISO/IEC 17021-1:2015, 9.3.1.3 |
| Multi-site sampling changes with the sites | Where sites are added, the sampling basis is recalculated rather than carried over. | IAF MD 1:2023 |
| The decision follows the normal route | The certification decision on an extension follows the standard process, including the separation between the persons who audited and the persons who decide. | ISO/IEC 17021-1:2015, 9.5 · 9.5.1.1 |
| Our accreditation is the first gate | If the requested addition falls outside the accredited scope of the certification body, no amount of audit activity makes it grantable as accredited certification. | ISO/IEC 17021-1:2015, 9.6.4.1 |
What you will be asked to produce.
- The proposed new scope wording, written as you want it to appear on the certificate
- The activities, processes and sites being added, and when they became operational
- Updated effective number of personnel, including the added activity
- Evidence that the added activity has been through your internal audit and management review
- Applicable statutory and regulatory requirements specific to the added activity
- Any outsourced processes inside the addition and how they are controlled
- Where sites are added: the control arrangements between the central function and the new sites
Where this goes wrong.
The usual assumption is that an extension can always be picked up at the next surveillance visit. Clause 9.6.4.1 permits that, but only after the determination it requires — and three things routinely defeat it. The addition falls outside the certification body's own accredited scope, in which case it cannot be granted as accredited certification at all. The recalculated audit time does not fit inside the planned surveillance duration. Or the added activity is a process family never audited before, which needs Stage 2 equivalent coverage rather than a surveillance sample. Ask the scope question before you contract for the new work, not after.
How the audit time is determined.
Audit time is not extended by a fixed increment. The calculation is redone with the new effective number of personnel, the added sites, the added processes and any change in risk category, and the result is compared with the time already planned for surveillance. The difference determines whether the extension rides on that visit or requires separate audit activity.
The rest of the certification route
Describe the claim — not the service.
Tell us what must be relied on, who will rely on it and by what date. We will confirm the correct programme, evidence requirement and responsible entity — or tell you it is outside our scope.