Key takeaways
- 1a single management system (§5.1);
- 2an identified central function, part of the organization and not subcontracted to an external organization (§5.2);
- 3organizational authority, held by the central function, to define, establish and maintain the system (§5.3);
- 4a centralised management review (§5.4);
When one management system runs across several sites, an accredited certification body may audit a sample of the sites instead of every one, under Global ACI TECH-3-001 (formerly IAF MD 1). The organization needs a central function controlling a single system, a centralised management review, an internal audit programme covering every site, and sampled sites performing very similar activities. The sample is partly random, its minimum size comes from the square root of the number of sites, and a nonconformity at one site is checked across the others.
The document
TECH-3-001 version 1.0 was issued on 10 July 2026, with an implementation date of 28 August 2026. It is based on IAF MD 1:2023, reformatted without substantive change (§0.1). Where a scheme or standard has its own multi-site requirements, such as ISO 22003-1 for food safety or ISO 50003 for energy, those take precedence (§1.2).
The eligibility conditions
A multi-site organization need not be one legal entity, but every site has a legal or contractual link with the central function, which can require corrective action at any site (§3.3.1). Section 5 sets the conditions:
- a single management system (§5.1);
- an identified central function, part of the organization and not subcontracted to an external organization (§5.2);
- organizational authority, held by the central function, to define, establish and maintain the system (§5.3);
- a centralised management review (§5.4);
- every site in the internal audit programme (§5.5);
- data collected and analysed from all sites, with the central function able to show its authority and ability to start organizational change on matters including system documentation and changes, management review, complaints, evaluation of corrective actions, internal audit planning and results, and statutory and regulatory requirements (§5.6).
An organization that fits the definition is not necessarily eligible for sampling (§6.1.1.2). Sampling is permitted where the sites each perform very similar processes or activities (§6.1.1.1). Where it is not appropriate, every site is audited at the initial and recertification audits, and 30% of sites, rounded up to the whole number, in each calendar year of surveillance, with the central function in every audit (§6.2.1). A network with both kinds of sites uses both methods (§6.3).
How the sample is chosen
The sample is partly selective and partly random, gives a representative range of sites, and ensures that every process in the scope is audited (§6.1.2.1). At least 25% is selected at random (§6.1.2.2). The rest is chosen so that the sites selected over the certificate's validity differ as much as possible (§6.1.2.3).
The aspects considered include internal audit, management review and earlier certification audit results; complaints and corrective action records; differences in size, shifts and work procedures; complexity; changes since the last certification audit; system maturity; culture, language, regulation and geographical dispersion; and whether sites are permanent, temporary or virtual (§6.1.2.4). The central function is told which sites are sampled, in time to prepare (§6.1.2.5).
How many sites: the rule as printed
§6.1.3.3 sets the minimum number of sites to be audited per audit, where y is the number of sites to be sampled and x the total number of sites:
- Initial audit: y = √x, rounded up to the next whole number.
- Surveillance audit: each year, y = 0.6 √x, rounded up to the next whole number.
- Recertification audit: the same as the initial audit. Where the management system has proved effective over the certification cycle, the sample could be reduced to y = 0.8 √x, rounded up to the next whole number.
Where x is 10, √x is about 3.16. The minimum is 4 sites at the initial audit, 2 at each surveillance (0.6 × 3.16 ≈ 1.90), and 4 at recertification, or 3 (0.8 × 3.16 ≈ 2.53) if the reduced sample is used.
The central function is audited at the initial certification, at every recertification and at least once a calendar year in surveillance (§6.1.3.4). The size or frequency of the sample is increased where the certification body's risk analysis shows special circumstances, in factors such as site size and number of employees, complexity or risk level, shift working, varied processes, complaints, multinational aspects, or internal audit and management review results (§6.1.3.5).
Where branches are organized in levels, the initial-audit model applies to each level (§6.1.3.6). The document's example: 1 head office, audited at every audit; 4 national offices, sample 2, at least 1 at random; 27 regional offices, sample 6, at least 2 at random; 1,700 local branches, sample 42, at least 11 at random. The regional sample should include at least one office under each national office, and the branch sample at least one branch under each regional office.
When one site has a nonconformity
A nonconformity found at any site, by the organization's internal audit or by the certification body, is investigated for its effect on the other sites. The organization reviews whether it indicates an overall system deficiency. If it does, corrective action is performed and verified at the central function and at the affected sites. If not, the organization justifies to the certification body limiting its follow-up (§7.7.1).
The certification body requires evidence of these actions, and increases the frequency or size of the sample until it is satisfied that control is re-established (§7.7.2). If any site has a major nonconformity when the decision is taken, certification is denied to the whole organization of listed sites pending satisfactory corrective action (§7.7.3). Excluding the "problematic" site from the scope to get past the nonconformity is not admissible (§7.7.4).
What this means for you
If you are applying with several sites: the certification body asks what happens at each site and how it links to the central function (§7.1.1).
If you run the central function: a finding at one site is reviewed for the whole network, and the certification body asks for the evidence (§7.7.1, §7.7.2).
If you are a buyer: a listed site not visited at the last audit is covered all the same (§0.2, §7.8.2). If any site fails the provisions for maintaining certification, the certification documentation is withdrawn in its entirety (§7.8.4).
This is generic information about the requirement, not advice on any particular management system.
CAS — An EGAC accredited MS certification body No. 012418. Accredited scope: ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO 50001 and ISO 22301. Certificates accredited for ISO 9001, 14001, 45001, 22000 and 50001 fall within EGAC's IAF MLA scope; ISO 22301 is accredited by EGAC and sits outside that scope.
Verify any certificate: cas.com.eg/certsearch
Read next