Defining the CMS Scope for a Mixed Hospital Group

ISO 37301 Clause 4.3 requires the scope to be determined in the light of the external and internal issues in 4.1, the compliance obligations, the interested parties in 4.2, and the organizational units, functions, physical locations and activities to be covered. The scope must be documented and available. The CEO's 'all activities worldwide' statement fails that test in two ways. It claims control over the 49%-owned joint venture, where Cura does not manage clinical decisions or operations, so the group cannot implement or monitor controls there as if it were a wholly controlled entity. It also ignores that Cura Digital has a separate board and its own privacy management system, and has just suffered a breach affecting 12,000 patients. A scope that overstates control is not ambitious; it is inaccurate, and it will mislead investors and auditors. The joint venture can still be addressed through governance rights, contractual compliance requirements, information rights and monitoring, but it should be described as an influence or interface relationship, not as fully in scope unless control is genuinely established.

A defensible scope would cover group-level compliance governance and support functions, the three hospitals, and the activities over which group management has authority. Cura Digital should be either included as a controlled subsidiary - with its privacy system integrated into the CMS or explicitly recognised as a specialised control set - or excluded with a documented interface and contractual controls. Given the data breach, exclusion without oversight would be hard to justify. The joint venture should be outside the operational scope but inside the context and risk assessment: Cura should identify the compliance obligations it can influence through board representation, shareholder agreement, tender conditions and audit rights, and set expectations for the majority partner. The scope statement should list included entities, sites, functions and activities, and state the boundaries and interfaces for the joint venture and Cura Digital. That gives the auditor a clear basis for sampling and prevents the CMS from being credited with controls it does not operate.

The scope decision should be supported by a context analysis (4.1), an interested-party register (4.2), a compliance obligations register, an organization chart showing ownership and control percentages, a list of sites and activities, and a description of interfaces with the joint venture and Cura Digital. The rationale for inclusion, exclusion or partial coverage should be recorded, and the final scope statement approved by top management and made available as documented information (7.5). This matters for audit because Clause 4.3 is auditable: the auditor will test whether the scope is appropriate, whether boundaries are clear and whether the CMS actually covers the activities claimed. A vague 'worldwide' statement gives the auditor no sampling frame. A precise statement with documented reasons allows the auditor to test the high-risk interfaces - especially the joint venture and Cura Digital - and to see whether the group is monitoring what it says it monitors. It also protects the organization if a regulator asks why a particular entity was or was not covered.