A certificate tells you a supplier was assessed. The scope statement tells you what, specifically, that assessment covered. These are not the same question, and treating a certificate as covering everything the supplier does, when the scope statement says otherwise, is one of the most common and most avoidable mistakes a buyer can make.
What a scope statement is, and where to find it
Every accredited certificate carries a scope statement: a specific description of the activities, sites, products, or services the certification actually applies to. It sits alongside the standard name and the certificate's validity dates, usually as a distinct field on the certificate document itself, and it is also shown when you verify the certificate using the public register. If you are only looking at the standard name and the certificate number, you are missing the part that tells you what is actually covered.
A worked example
Consider a fictional example: an ISO 9001 certificate issued to "Aldervane Precision Components", a fictional company, with the scope stated as: "The design and manufacture of precision-machined metal components for the automotive sector, at the Portland, Oregon facility."
Read line by line, this scope tells you three things. First, the activity covered is design and manufacture, not distribution or after-sales service, so if your relationship with this supplier involves logistics or support, that is outside this certificate's scope. Second, the sector is automotive components specifically, so if this same company also supplies a different sector under a different process, this certificate says nothing about that work. Third, the location is the Portland, Oregon facility, so if the company has a second site elsewhere, that site is not covered by this certificate unless it appears in its own scope statement or an extended one.
None of this means the certificate is weaker or less trustworthy. It means it is precise, and precision is the point. A scope statement that said simply "manufacturing" would tell you almost nothing useful.
The opposite problem is the scope that reads like a long list of keywords: dozens of products, services and technologies strung together. A scope statement describes what was assessed, and the longer the list, the harder that is to stay true to. Length is not strength. Where certification covers an organization's entire operation, a summary of that operation is an accurate scope. A buyer reading a very long scope should do exactly what this page describes: find the specific activity, sector and site being relied on, and check that each is there.
Common scope-reading mistakes
The most common mistake is assuming a certificate for one site or product line extends to the supplier's whole organization. The second is skipping the scope statement entirely and treating the standard name alone as sufficient. The third is reading the scope once at onboarding and not checking whether it has changed when the certificate is renewed, since a scope can narrow or expand between certification cycles.
If the certificate doesn't cover what you need
If the scope statement does not cover the specific site, product, or activity you are relying on, do not assume it applies anyway. Ask the supplier directly whether the activity you need is covered under this certificate, a different one, or not certified at all. A supplier operating multiple sites or product lines may hold separate certificates, or an extended scope, that a first look did not find. Verifying the certificate directly will show you the full scope as currently recorded, which is the most reliable way to settle the question.
Common questions
What does the scope of a certificate cover?
Only the activities, sites and standard named in its scope statement, which can be narrower than the organization's full operations.
Where do I find the scope?
On the certificate itself and on the register entry for it.
The certificate does not cover what I need. What now?
It cannot be relied on for activities outside its stated scope; ask the certification body or the organization whether the relevant activity is covered by a separate certificate.