Scope Creep in a Group Innovation Management System
Helio Systems is a software group with three organizational units: Cloud Services (120 staff), Devices (80 staff) and a 49%-owned joint venture that Helio does not control. Helio outsources software quality assurance to an external contractor. The group wants an ISO 56001 certificate for 'the design and delivery of cloud-based software solutions'. It plans to exclude Devices, the joint venture and the marketing function from the scope. The marketing director objects, saying marketing generates most customer insight and launches new services. The quality manager proposes to exclude marketing because 'marketing does not perform innovation projects' and to exclude outsourced QA because 'the contractor is responsible for quality'. Helio's corporate innovation policy, however, applies to all units. The certification body has asked for a scope statement and a description of interfaces with excluded parties.
1. Evaluate Helio's proposed exclusions against ISO 56001 scope requirements. Which exclusions are likely acceptable and which are not, and why?
Read the worked answer
The scope must be documented and must state the boundaries and applicability of the innovation management system. Exclusions are not automatically prohibited, but they must not affect Helio's ability to achieve the intended outcomes of the system, and the justification needs to be credible. Excluding Devices may be acceptable if the certificate is deliberately limited to Cloud Services and interfaces are managed. Excluding the joint venture may also be acceptable because Helio does not control it, but Helio still needs to describe interfaces and any dependence on the JV for cloud innovation. Excluding marketing is much harder to justify. Marketing generates customer insight and launches services, both of which feed exploitation of insights and realization of value. If marketing is part of the cloud unit's innovation process, excluding it would carve out a process that affects the system's intended outcomes. The quality manager's argument that marketing 'does not perform innovation projects' confuses projects with innovation processes. Excluding outsourced QA is also not acceptable as a way to avoid responsibility: Helio may outsource the process, but it cannot outsource accountability for conformity. The outsourced process must be controlled and monitored. Helio also needs to reconcile the scope with its corporate innovation policy, which currently applies to all units.
2. What should Helio document to make the scope credible, and how should it treat the outsourced QA process?
Read the worked answer
Helio should document a scope statement naming the cloud-based software solutions, the organizational and physical boundaries, and the applicability of ISO 56001 requirements. It should include a justification for each exclusion and show that the exclusion does not undermine the system's ability to achieve intended outcomes. A process map should identify innovation processes, interfaces with Devices and the joint venture, and dependencies on marketing and other functions. Responsibilities and decision rights at the interfaces must be clear. For the outsourced QA process, Helio should treat the contractor as an external provider whose process affects innovation conformity. That means defining the required outputs, evaluating and selecting the contractor, setting contract terms for quality and confidentiality, monitoring performance, and retaining responsibility for the results. The contractor's own quality system can be used as evidence, but it does not replace Helio's control. If Helio wants a group certificate covering several units, it should agree the multi-site or group arrangements with the certification body rather than writing a narrow scope that hides shared processes.