Multi-site ISO certification: how to scope the audit

One plant is a scope. Three plants, a warehouse, and a sales office is a programme. Mid-market teams that send “ISO 9001, about 400 people, a few locations” collect unlike day counts and then argue about price. The argument was never about price. It was about which buildings, shifts, and processes the certificate will actually cover.

This page is the scope chapter. It is written for operations, quality, IT, and compliance leads at manufacturers and professional-services firms that already run — or are about to run — more than one site under ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001, and/or ISO/IEC 42001.

It does not republish the 9001 → 27001 → 42001 path or the combined programme. It does not dump IAF sampling legalese. It does not invent prices, day-rate totals, or accreditation identifiers. You already have what a quote should include for the commercial anatomy. This page is what has to be true before anyone is allowed to count days.

1. When multi-site applies — and when an exclusion is the honest product

A multi-site certificate is the right product when more than one location does work the certificate will claim, and those locations are under one management system that can actually reach them. Plants, warehouses, distribution hubs, design offices, professional-services floors, and field depots all count if certified work happens there.

What does not make a location disappear:

• It is “just a warehouse.” If it receives, stores, ships, or kitted product that sits in the QMS (or chemicals that sit in the EMS), it is a site.
• It is a small office. Headcount is a band, not a moral category. A ten-person design office that owns drawings is often more material than a sixty-person overflow line that only runs the same process already sampled elsewhere.
• It is a sister company “on the same campus.” Legal entity and management-system reach are different questions. If the second badge on the door does not follow your documented information, internal audit, and management review, it is not in this system.
• People work from home some days. Remote work is a control and a sampling problem for an ISMS. It is not, by itself, a second plant. Name where the work is governed.

A single-site certificate is still common and still honest: one legal entity, one address, the work happens there, and other locations are either not yours or not in the system. Do not invent a multi-site programme to look thorough. Do not invent a single-site programme to look cheap.

Exclusions are a different tool. An exclusion is a written decision that a process, product line, or location is out of the certificate. Typical mid-market examples: a fabrication cell you do not sell as certified work; a country office that only does bookkeeping; a 3PL that stores inventory but is not under your system. Exclusions have to survive Stage 1. “We left the Dallas warehouse off the RFQ because travel is annoying” is not an exclusion. It is under-scoping.

Use this test before you write the pack:

Situation	Usually treat it as	Why
Second plant making the same or related product	Site in the programme	The certificate will be shown against that output
Warehouse or DC that handles certified product	Site in the programme	Storage, traceability, and dispatch are processes
HQ that owns the QMS / ISMS / AIMS	Central function (still a site)	Governance is audited on a different cadence
Sales office that only takes orders	Site or exclusion — decide in writing	Order handling can be in scope; a brochure stand often is not
Contractor or 3PL you do not control	Supplier / exclusion, not a sampled site	You cannot sample what you do not govern
New overflow building not yet in the system	Scope change when it does certified work	Sampling only covers sites that were in the design

Temporary or project sites (a shutdown crew, a customer location, a pop-up warehouse) belong in the notes. Some programmes treat them as temporary sites rather than permanent sample points. The certification body (CB) cannot guess which. If you do not say so, one quote will invent a permanent site and another will invent zero.

Holding companies sometimes want one certificate for five legal entities that do not share a system. That is usually several certifications, or a lot of implementation, not a sampling discount. Conversely, one legal entity with three addresses is often one multi-site programme. Write the entities and the addresses. Let the CB propose the legal shape. Do not let the salesperson collapse five companies into “the group.”

2. Central function versus sampled sites

Accreditation rules for multi-site programmes (buyers usually meet this as an IAF sampling scheme, commonly discussed as MD 1) rest on a simple idea: someone owns the system, and the other locations are similar enough that not every one of them is visited every year.

Plain language:

• The central function is the place that can make the system real at the other sites. It keeps the documented information, runs or directs internal audit, holds management review, and has the authority to correct a plant that drifts. It is often headquarters. It is sometimes the largest plant, a quality office on a campus, or — for 27001 / 42001 — the IT or risk floor that actually owns the Statement of Applicability or the AI governance records. Name the building. “Corporate” is not an address.
• Sampled sites are the locations that do the work. In a homogeneous network — three machine shops running the same process book — a CB can visit a subset each year and still support one certificate. In a mixed network — a foundry, a warehouse, and a professional-services office — those locations are not interchangeable sample points. Different processes are different sites even when the badge on the door is the same.

What sampling is not:

• A raffle. The CB designs a programme: which sites this year, which next year, what happens when you add a location, how temporary sites are treated. Ask for that design in the proposal. Quote anatomy is where the days should appear. This page is why the site list has to precede the days.
• A reason to hide the awkward site. The plant with the oldest calibration, the warehouse with no internal audit, and the office that never joined the last management review are the locations a competent programme will not skip forever.
• Permission to visit only the conference room. Shop-floor and practitioner interviews still happen at sampled sites. Second shift still exists if you declared it — and it still exists if you did not.

Homogeneous enough to sample usually means: same management system, similar processes and risk, and a central function that can actually reach the site. Heterogeneous means: write each location as itself. A heat-treat line is not “like” a sales office. An ISMS development floor is not “like” a coating plant. CBs that quote one blended day count for unlike sites are transferring risk onto you.

The central function is typically in the programme every cycle year, because that is where the system is steered. Sampled sites rotate. Recertification is a fuller look; it is not “visit HQ and call it done.” If a proposal never visits a producing plant in three years, it is not a sampling scheme. It is a brochure.

Remote versus on-site is a constraint on how a visit happens, not a substitute for naming the site. A document review at the central function can often be remote when the CB’s rules and your risk allow it. A coating line, a warehouse dispatch desk, and worker interviews for 45001 usually cannot. Write the constraint (“no remote Stage 2 at plants,” “Stage 1 remote at HQ is acceptable”) instead of hoping every CB guesses the same split. The buying chapter for that split is remote vs on-site ISO audits.

3. What belongs on the RFQ

Write one pack. Send that pack to every body on the shortlist. The outbound pack is the one-pager; multi-site is where that page goes vague.

Minimum site table (copy into a sheet):

Field	What to put	Why CBs need it
Legal entity at the site	The company on the lease and the payroll, not the group brand	The certificate names entities
Address / country	Enough to staff language, travel, and which accredited legal entity can issue	A global group is many companies
Headcount band	A range per site, plus contractors who do the work if they are in the system	Days start from effective personnel, not a LinkedIn about-page
Processes at this site	What is actually done there (machine, receive, design, SOC, model approval)	Unlike processes are unlike sample points
Shifts	First only, two-shift, continuous, seasonal peak	An auditor who only met first shift has not sampled second shift
Central function?	Yes / no / shared (and which site leads)	Sampling schemes steer from here
In scope or excluded	In / out, with one line of reason	Silent omissions are not exclusions
Language of work	The language of the floor or the ticket queue	Interviews happen in the language of the work
Remote vs on-site constraint	What you will and will not allow at this site	Otherwise every proposal invents a different split
Temporary or seasonal?	Permanent, project, peak overflow	Temporary sites are a different sampling conversation

Also put on the one-pager, not only in a follow-up email:

• Standards and editions you want on this certificate or this integrated programme.
• Which site owns documented information, internal audit, management review, and — if in play — the SoA or AI governance records.
• Integrated versus separate certificates, and whether 27001 or 42001 is this cycle or a later add.
• Existing certificates and expiry, if any (transfer if the fit is already wrong).
• Constraints: customer-named marks, “ANAB only,” shutdown weeks, inventory week, no remote Stage 2, union or visitor rules, IT access for evidence walkthroughs.

Headcount is a band per site, not a company total. A 400-person firm with 280 in one plant and 40 in a warehouse is not the same programme as 400 in one building. Do not average. Do not use “corporate headcount” that includes a division you already excluded.

Processes per site are the difference between a homogeneous sample and a list of one-off visits. “Manufacturing” is not a process. “CNC and assembly,” “receiving and kitting,” “application development,” and “model monitoring” are.

If two CBs receive different site lists, you will not have a bake-off. You will have folklore. The send is one intake at the end of this page.

4. Integration across standards — same campus, not always the same map

A plant that already thinks in 9001, 14001, and 45001 can often share one operations map: same buildings, same shifts, one internal-audit programme, one management review. That is the operations stack. The integrated path is the sequence page; when to stack those three on one CB programme is the buying page. This page is only the site consequence.

What usually stays aligned:

• The producing sites and warehouses.
• The central quality / EHS function.
• Sampling logic for similar plants, if the IMS is real and not three binders with one cover.

What often does not stay aligned when you add 27001 or 42001 later:

• The ISMS may treat headquarters, a cloud estate, a development office, and remote workers as the material “locations,” while a coating plant is mostly a physical-security and supplier footnote.
• An AIMS may live where models are approved and monitored — frequently not the largest factory.
• Competence needed to sample an ISMS or AIMS is not the same competence needed to sample a heat-treat line. Dual-CB programmes (operations stack with one body, trust stack with another) are a common mid-market design. They are not a failure to pick a winner. They do mean two site lists, not one list reused by habit.

Do not write “add 27001 onto the 9001 week” as a site plan. Integrated audit rules (buyers usually meet this as IAF MD 11 plus scheme competence) decide which clauses are visited once. They do not let you hide an information-security office that was never on the 9001 map. If 42001 is twelve to twenty-four months out, say so, and put a live-scope recheck on the calendar. The path and the recheck rules live on the quality → security → AI guide. Here, only write the buildings those later standards would actually touch.

If you are buying one CB for the full stack, the pack still names where quality work happens and where information or AI work happens. If those are the same campus, say so. If they are not, do not let a single address stand in for both.

5. How under-scoping bites at Stage 2 and surveillance

Under-scoping is quiet at the RFQ and loud when someone walks the floor.

Stage 1 is a design review of readiness. One of the first questions is whether the scope is sane: sites, processes, exclusions. A pack that omitted the warehouse, named no central function, or excluded a process that still ships customer product should die here — as written findings, not as a shrug and a Stage 2 date next week. What that visit is for sits in Stage 1 versus Stage 2.

Stage 2 tests whether the system works where the work is. Auditors sample processes and interview the people who do them. In a plant that includes receiving. In a multi-site programme it includes at least the central function and the sites in this year’s sample. Typical bites:

• A second building across the parking lot that “isn’t really a site” but ships the same part numbers.
• A night shift that owns a process the day-shift procedure never mentioned.
• A design office that owns specifications the plant cannot change — excluded on the RFQ, inescapable in the interviews.
• An ISMS SoA that claims cloud and a third-party SOC the site list never named.

The CB then has to add days, add a site, or write a finding. All three are more expensive than an honest pack. None of them is a surprise if you look at how days are supposed to be justified.

Surveillance is designed sampling of a live system, not a courtesy coffee. Multi-site sampling only covers sites that were in the design. A new overflow warehouse, a headcount band that moved, or an AI system that left the pilot corner is a scope change. Tell the CB before the next visit. Surveillance and recertification is the after chapter; the rule on this page is simpler: the wall certificate and the site list you send have to stay the same object.

Customers who store a certificate number will notice a missing plant before your reception sign does. So will a transfer review, if you later move. Do not wait for either.

6. How this changes the shortlist and the scorecard

The scorecard does not need new columns with fake points. Two existing criteria get heavier when you have more than one site.

Scheduling honesty is High for plants for a reason. A body that cannot name a planning window, a change lead-time, or what happens when inventory week cannot move will not staff four locations and a second shift either. Ask who travels, which language they can interview in, and whether the same lead auditor can see the central function and a producing site in one programme year. “We’ll fit you in” is a no-bid on a multi-site pack.

Sector competence includes multi-site competence. A registrar that is excellent in single-office professional services can still be a poor fit for three plants and a DC. A factory-dense body can still be a poor fit if the material 27001 locations are a development office and a cloud estate. Ask for anonymized programmes like yours: how they treated the central function, how they sampled unlike sites, how they handled a mid-cycle warehouse. If they describe your homepage back to you, they have not run this.

Also watch the quote-transparency Must: the proposal should restate your site list, the headcount bands they used, how sampling was applied, and the remote versus on-site split. If two replies used different buildings, stop scoring and send the same pack back.

Build the set from the directory the same way you would for a single site — accreditation, codes, marks — then let geography and sampling honesty kill names early. Do not invite a body you already know cannot staff the third country.

7. Decision checklist (paste into the scope pack)

Copy. Fill. Attach to the one-pager you send every CB.

Programme
- Standards and editions this cycle:
- Integrated certificates or separate:
- 27001 / 42001 later? Recheck date for live scope:

Legal shape
- Legal entities in this certificate:
- Customer-named mark or AB constraint:

Central function
- Site name and address:
- What it owns (documented information, internal audit, management review, SoA, AI governance):
- Language of the system records:

Site table (one row per location)
- Name / address / country:
- Entity:
- Headcount band (plus in-scope contractors):
- Processes:
- Shifts / seasonal peak:
- In scope or excluded (reason):
- Temporary or permanent:
- Remote vs on-site constraint:
- Language of the work:

Exclusions we are willing to defend at Stage 1
-

Constraints the CB must not “fit in”
- Shutdown / inventory weeks:
- No-remote rules:
- Visitor / union / IT access:

What we are asking them to return
- Restated site list and headcount they used
- Sampling design (central function vs which sites which year)
- Days by stage and year, not Stage 2 only
- On-site vs remote split per site type
- What happens when we add a site mid-cycle

Independence
- Who implemented the system:
- Confirmation they are not the certifier:

If a row is blank, you are not ready to collect day counts. Fill the row. Then send the same pack once.

8. Send the pack, then compare

Multi-site programmes only compare when every CB sees the same buildings, bands, and central function. Submit that pack with the Get quotes button below. Then open the directory and select up to three profiles while you score scheduling honesty and multi-site competence.

Do not send a shorter site list to the body you already like. Do not treat a company-wide headcount as a scope. Do not treat this site’s editorial tags as a live accreditation feed — verify the legal entity you intend to award.

If you are still deciding how to choose, start with the selection method. If you need the scorecard, use shortlist and score 3–5. If you already hold a certificate and the site list on the wall is already wrong, that is transfer or a scope change, not a quieter RFQ. This page is the pack, not a substitute for competence and independence.