Clause 4.3: Determining the scope of the MSR
The organization must define the boundaries of the records system and state where it applies, then keep that scope available as documented information.
What clause 4.3 asks
The organization must define the boundaries of the records system and state where it applies, then keep that scope available as documented information. Scope is a decision about business activities, functions, sites, legal entities, systems and record types, not a sentence written for the certificate. Anything excluded has to be named and the reason understood, because an exclusion that hides a high-risk activity weakens every later decision about what gets captured and kept.
Scope decides what the certificate covers and what the system must control. It is a decision about activities, functions, sites, entities, systems and record types. An exclusion is legitimate only when its risk is understood and owned.
Reading it in practice
A scope that lists only sites usually hides the systems. Business applications, shared drives, email and collaboration platforms often hold the authoritative record, and a scope that leaves them out will fail at the first system question. Write the boundary in the same terms as the inventory: activity, site, entity, system and record class, with the exclusions named.
The third edition is at stage 50.00 and its clause text is not public. The public record does not show a draft scope clause. The 2019 text removed the 2011 wording about outsourcing from the scope; the scope itself remains a required documented decision.
Status: not shown in the public record. The 2019 requirement above is the one a certificate is issued against. No draft requirement is asserted.
Evidence for clause 4.3
The auditor will read the scope statement against the organization's real activities. Expect a question about an entity, site or system that holds records but sits outside the stated boundary.
- Scope Approved scope statement naming functions, sites, entities, systems and record types
- Scope Scope diagram or boundary map with exclusions and their rationale
- Scope Scope review record when a merger, divestment or new system changes the boundary
Where clause 4.3 commonly fails
- Scope written as a marketing sentence with no exclusions
- An excluded legacy system that still holds records the organization relies on
What to do about clause 4.3 before the revision
Draw the boundary on one page: functions, sites, legal entities, systems, record classes. Name every exclusion and its reason. Check it against the last audit report and the current system inventory.
Read across from clause 4.3
Open the full index. The revision record shows the public stage record and the proven 2011 to 2019 changes.
Source for clause 4.3: ISO 30301:2019, ISO 30301:2019, Clause 4.3, retrieved 22 October 2026. The requirement, evidence and gaps are written from our clause record; the draft status rests on the ISO/PRF 30301 page 89772. Every source.