Multi-Site Certification

Some organizations end up with separate management system certificates across their multiple sites due to business demands, site readiness, process variations, or company mergers. Individual certificates might have been the best solution at the time, but if these organizations qualify, they should consider merging their multiple certificates into a single scope of certification.

If the activities across the multiple sites are carried out in a similar manner, under the organization’s authority and control, the organization may qualify for a single multi-site certificate with these benefits:

  • Single audit of shared services
  • Sampling plan for remote sites
  • Reduced audit visits and costs
  • More uniform system over time

Of course, the remote sites might fear the loss of their autonomy. The central site may be concerned about the weakest link placing the single certification at risk.

Multi-Site Certification

The criteria for multi-site certification are explained in the International Accreditation Forum (IAF) Mandatory Document for the Certification of Multiple Sites Based on Sampling.

A multi-site organization is defined as one with an identified central function at which certain activities are planned, controlled, or managed, along with a network of local offices or branches (sites) at which such activities are fully or partially carried out. The eligibility requirements for site sampling include:

  • Sites have a contractual or legal link with the central office
  • Sites are subject to a common management system
  • Processes at the sites are substantially of the same kind
  • Sites operate to similar methods and procedures
  • Sites are under surveillance and internal audit by the central office
  • Central office has the right to require site corrective actions
  • Central office has authority to initiate organizational changes

Organizations that conduct their business through linked processes in different locations may also be eligible for multi-site certification. For example, fabrication in one location and assembly of those components in another location of the same company would qualify as linked processes.

Examples of possible multi-site organizations are:

  • Company that operates franchises
  • Manufacturing company with network of sales offices (multi-site is the network)
  • Service company with multiple sites offering a similar service
  • Company with multiple branches

Sampling Method 

According to ISO 17021:2006, where multi-site sampling is used for the audit of a client’s management system covering the same activity in various locations, the certification body must develop a sampling program to ensure proper audit of the management system.

Not all multi-site organizations are eligible for sampling. The certification body makes that determination based on site sizes and process variations.

At least 25% of the sample must be selected at random. The remainder of the sample is selected based on factors such as:

  • Internal audit results
  • Variation in size and shifts
  • Customer complaints
  • Differences in procedures
  • Changes since prior audit
  • Differences in language
  • Geographic dispersion

The central site must be audited during the initial certification and recertification audits, and at least annually during the surveillance audits. The sample selection can be postponed until after the central audit. Sampling is for the remote sites.

Sample Size

The initial certification audit sample of remote sites is the square root of the number of remote sites, rounded up. For example:

  • For 3 remote sites, it would be 2 of 3, with 1 random
  • For 4 remote sites, it would be 2 of 4, with 1 random
  • For 5 remote sites, it would be 3 of 5, with 1 random
  • For 10 remote sites, it would be 4 of 10, with 1 random
  • For 25 remote sites, it would be 5 of 25, with 2 random
  • For 50 remote sites, it would be 8 of 50, with 2 random
  • For 1000 remote sites, it would be 32 of 1000, with 8 random

For surveillance audits at remote sites, it is 0.6 times the square root, rounded up.

  • For 3 remote sites, it would be 2 of 3 each year, with 1 random
  • For 4 remote sites, it would be 2 of 4 each year, with 1 random
  • For 5 remote sites, it would be 2 of 5 each year, with 1 random
  • For 10 remote sites, it would be 3 of 10 each year, with 1 random
  • For 25 remote sites, it would be 3 of 25 each year; with 1 random
  • For 50 remote sites, it would be 5 of 50 each year, with 2 random
  • For 1000 remote sites, it would be 19 of 1000 each year, with 5 random

For recertification audits, the sample size should be the same as for the initial audit. However, if the management system has proven to be effective over the three years, the sample size could be reduced by a factor of 0.8, or 0.8 times the square root of the number of remote sites, rounded up.

  • For 3 remote sites, it would be 2 of 3, with 1 random
  • For 4 remote sites, it would be 2 of 4, with 1 random
  • For 5 remote sites, it would be 2 of 5, with 1 random
  • For 10 remote sites, it would be 3 of 10, with 1 random
  • For 25 remote sites, it would be 4 of 25, with 2 random
  • For 50 remote sites, it would be 6 of 50, with 2 random
  • For 1000 remote sites, it would be 26 of 1000, with 7 random

The guidance states the cumulative days for a multi-site certificate must at least equal the number of days if the functions were all part of a single organization at the same site.

Single Certificate

The single multi-site certificate is issued with the central office name and address. The remote sites are listed on that certificate or an attachment. The scope will clearly state that the certified activities are performed by the listed network of sites. If desired, sub-certificates can be issued for the remote site, with a sub-scope and reference to the main certificate.

For more information on multi-site certification, see the MD1:2007 document at the IAF web site. Select “Publications” on the left-hand menu at the home page and then select the entry titled “Mandatory Documents (MD Series)”.