Where your organization runs several sites under one management system, we audit a sample of them at each visit rather than all of them. Sampling decides which sites an auditor travels to. It does not decide which sites the certificate covers: every site in scope is named on the certificate and in its register entry, and each one is certified. The rules that set the sample are in IAF MD 1, a mandatory document every accreditation body in the IAF arrangement applies, so the method is the same whichever accredited body you use.
What makes a group eligible for sampling
Sampling is available where the sites do substantially the same work, to the same procedures, under one management system that a central function controls. That central function has to hold the authority to require a change at any site, and it is audited every time we come: at certification, at each surveillance, and at recertification. Where a head office collects reports from its branches and cannot direct any of them to do anything differently, there is no central function in the sense MD 1 means, and the sites are separate certifications.
The condition that most often stops an application at Stage 1 is the internal audit history. Your own internal audit program must have covered every site in scope, and a management review must have covered the whole system, before our initial certification audit. An organization with eleven branches that has internally audited head office and the two nearest ones is not ready for a multi-site audit, and no sample we set will make it ready.
Where the work differs materially between sites, those sites are not interchangeable and sampling does not reach them. A group of six branch offices and one fabrication workshop is a sample drawn from six offices, plus a workshop audited on its own account. The same reasoning narrows sampling under ISO 45001, where two sites running different hazards are not performing substantially the same activity whatever the organization chart says. For contractors we schedule at least one audit on active works, because an audit confined to a head office cannot verify that the system operates where the risk is.
How the sample is set
The minimum at initial certification is the square root of the number of sites in scope, rounded up to the next whole number, with the central function audited in addition to that sample. Surveillance and recertification draw smaller samples from the same root, set in the same clause of MD 1. These are floors, and most plans sit above them. Risk raises the number: results from your internal audits, incidents and complaints, the size and shift pattern of a site, how recently it opened, and what has changed since it was last seen. Audit duration follows from the sites actually visited, so the sample and the fee move together.
Part of the sample is drawn at random and the rest selected for stated reasons, and the composition changes from year to year, so a site left out of one surveillance is a candidate for the next. The audit plan names the sites, the dates and the team before the audit, which gives you the chance to tell us that the site we picked is shut for a holiday or that the project we chose finishes next week.
A finding does not stay at the site where it was raised
This is the part of multi-site certification clients are least prepared for. A nonconformity raised at one sampled site is evidence about a system that every site operates. MD 1 requires the corrective action to be evaluated at the central function and at the other sites, not only at the one that was audited. Where the evidence indicates the control failed across the group, we can extend the sample, and certification covering all the sites can be withheld or suspended until it is resolved.
The failure mode is the branch that has quietly built its own version of a procedure because an auditor has never been there. It survives one surveillance, sometimes two, and then arrives in the random half of a sample in the recertification year. The finding it produces is usually written against the central function rather than against the branch, because what the evidence shows is a system that did not know one of its own sites had drifted. A group that treats the unsampled sites as unaudited sites has misread what it bought.
The quieter failure is the site that is not on the certificate at all. A branch or a project office opened mid-cycle joins the scope when it has been reported to us and added, and until then the certificate and the register entry list the sites we audited. Read your own site list against the addresses on your current contracts once a year, and tell us about the difference before a client finds it.
For anyone checking a supplier's multi-site certificate, the site list is the operative part of the document. A certificate covering a group carries no conclusion about an address missing from it, and a scope that reads as though it covers a whole network is still bounded by the sites named underneath it. Our register returns that list, along with the standard edition, the validity dates and the current status, for every certificate we have issued.