Key takeaways
- 1One management system across all sites. §5.1. Sites that run separate systems are each audited as a single-site organization (§1.3). One system can meet several standards (note to §1.1).
- 2A legal or contractual link between every site and the central function. One legal entity is not required. §3.3.1.
- 3An identified central function, inside the organization. It is not necessarily the headquarters (§2.4), is not subcontracted to an external organization (§5.2), and need not be located at a single site (note to §5.6).
- 4Authority to define, establish and maintain the system, held by the central function. §5.3.
Two questions decide it. Is the organization a multi-site organization as Global ACI TECH-3-001 (formerly IAF MD 1) defines one? And can its sites be sampled? The document separates them: not every organization that fits the definition is eligible for sampling (§6.1.1.2).
Part 1: one organization, one system
- One management system across all sites. §5.1. Sites that run separate systems are each audited as a single-site organization (§1.3). One system can meet several standards (note to §1.1).
- A legal or contractual link between every site and the central function. One legal entity is not required. §3.3.1.
- An identified central function, inside the organization. It is not necessarily the headquarters (§2.4), is not subcontracted to an external organization (§5.2), and need not be located at a single site (note to §5.6).
- Authority to define, establish and maintain the system, held by the central function. §5.3.
- A centralised management review. §5.4.
- Every site in the internal audit programme. §5.5.
- Data collected and analysed from all sites, and demonstrable authority and ability to start organizational change on matters including system documentation and changes, management review, complaints, evaluation of corrective actions, internal audit planning and results, and statutory and regulatory requirements. §5.6.
- The right to require corrective action at any site. Where applicable, this should be set out in the formal agreement with the sites. §3.3.1.
- Not a group assembled by an outside party. Independent organizations gathered under one system by another independent organization are outside the document. §1.4.
Part 2: sites that can be sampled
- Very similar processes or activities at each site. §6.1.1.1. Other sites are audited under §6.2; a network with both kinds uses both methods (§6.3).
- A standard that allows it. Sampling is unsuitable where the standard requires the audit of variable local factors, and some schemes set their own rules (§6.1.1.3). For ISO 22000 and ISO 50001, the specific requirements of ISO 22003-1 and ISO 50003 take precedence (§1.2). For ISO 45001, the decision rests on the OH&S risks at each site (TECH-3-004, formerly IAF MD 5, §10.1).
- Within the certification body's restrictions. Its procedures restrict sampling by sector or activity risk and complexity, size of sites, local variations in the system, and temporary sites (§6.1.1.4).
What the certification body will ask
At application it confirms that one system is deployed, and seeks to understand each site's legal and contractual arrangements, "what happens where", what is centralised, the interfaces between sites, and which sites may be sampled (§7.1.1). So the application needs each site, its processes and its link to the central function.
If the sites cannot be sampled
Without sampling, certification is still possible: every site at the initial and recertification audits, 30% of sites, rounded up, in each calendar year of surveillance, and the central function every time (§6.2.1).
CAS — An EGAC accredited MS certification body No. 012418. Accredited scope: ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO 50001 and ISO 22301. Certificates accredited for ISO 9001, 14001, 45001, 22000 and 50001 fall within EGAC's IAF MLA scope; ISO 22301 is accredited by EGAC and sits outside that scope.
Verify any certificate: cas.com.eg/certsearch
Read next