Recommended Reading | Reflections on Multi-Site Sampling in Management System Audits

　　It is common for certification bodies to conduct management system audits for multi-site organizations. Because enterprises involve various types of multi-site organizations, sampling multi-sites can sometimes present tricky issues even when the relevant certification and accreditation rules are understood and audit sampling methods are mastered.

　　Therefore, how to understand certification and accreditation rules and analyze multi-site organizations is a frequently encountered practical problem. The author combines theoretical understanding with case analysis to propose methods for sampling multi-site organizations, providing some thoughts and references for certification bodies and auditors conducting management system audits of multi-site organizations.

　　1. What is a "Multi-site Organization"

　　To accurately understand "multi-site organization," it is necessary to understand basic concepts such as site, multi-site, permanent site, and temporary site.

　　First, consider what a site is. This concept is explained in CNAS-CC 11 "Management System Audit and Certification of Multi-site Organizations" 3.1.1: A site can include all land where specific locations controlled by the organization carry out processes and activities, including any associated or affiliated warehouses used to store raw materials, by-products, intermediate products, final products, and waste, as well as any fixed or mobile equipment or facilities involved in these processes and activities. Additionally, if required by law, the definition of a site should conform to the relevant national or local registration system definitions. It can be seen that a site needs to have a specific location where corresponding processes and activities are carried out, possibly with related infrastructure, raw materials, and finished products; at the same time, this site location needs a clear address description, which should comply with the relevant national or local registration system definitions.

　　Second, understand the definition of "multi-site organization." CNAS-CC 11 "Management System Audit and Certification of Multi-site Organizations" 2.4 defines it as: an organization covered by a single management system, consisting of an identified central function and multiple sites. The central function (not necessarily the organization's headquarters) plans and controls certain processes and activities, which are fully or partially implemented at multiple sites (permanent, temporary, or virtual). From this definition, two key terms need to be understood: "single management system" and "central function." "Single management system" means the organization's operations follow a unified management system, which may be based on one or multiple management system standards. Therefore, certification bodies will accept multi-site organizations that have established one or more management system standards. CNAS-CC 11 2.5 defines "central function" as: "the function responsible for the management system and centralized control of the management system." Thus, a multi-site organization is led and controlled by the central function and establishes a unified management system according to the central function's requirements.

　　Third, since it is a multi-site organization, multiple sites exist at multiple locations, each possibly having all or part of the activities or processes, naturally including permanent and/or temporary sites. CNAS-CC 11 2.2 and 2.3 state: a permanent site is a site where the client organization continuously performs work or provides services (tangible or virtual). A temporary site is a site established by the client organization to perform specific work or services for a limited period (tangible or virtual) and is not intended to be a permanent site.

　　Based on the above analysis, we can understand that a multi-site organization has a central function and establishes one or more unified management system standards, with multiple locations where each location may have all or part of the activities or processes. These sites may be permanent multi-sites, temporary multi-sites, or both permanent and temporary multi-sites simultaneously.

　　CNAS-CC 11 "Management System Audit and Certification of Multi-site Organizations" mentions: a multi-site organization may include more than one legal entity, but all sites of the organization should have legal or contractual links with the organization's central function and be subject to a single management system; this management system should be developed, established, and subject to ongoing supervision and internal audits by the central function, which has the authority to require any site to take corrective actions when necessary. Therefore, certification bodies need to fully understand "multi-site organizations" during business negotiations with client organizations and first determine whether the applicant organization is a "multi-site organization."

　　The three basic conditions for initially determining that an applicant organization is a multi-site organization are: the existence of a central function; the central function uniformly plans the management system; centralized management reviews are conducted, and the organization’s internal audit procedures are followed. When these three conditions are met simultaneously, the following nine principles are used to understand the current status of the multi-site organization:

　　The central function is part of the organization and should not be subcontracted to an external organization;

　　Whether the central function is located at a single site or operates across multiple sites;

　　The activities and processes of the central function, business scope and locations, effective personnel numbers, corresponding legal status, and qualification requirements;

　　The relationship between each site and the central function, such as whether it is a parent company and subsidiary relationship or a parent company and branch relationship, etc.;

　　The activities and processes, business scope, locations, effective personnel numbers, shift patterns, legal status, and qualification requirements of each site;

　　Whether each site is a permanent site or a temporary site;

　　The activities and processes of the central function and each site, identifying which have very similar processes and which do not.

　　2. Multi-site Sampling

　　The premise of multi-site audit sampling is based on a limited sample of available information and must confirm that the management system is capable of enabling all participating sites to achieve the expected results. Therefore, considering the actual situation of the multi-site organization, first consider which sampling method applies and determine the site audit sampling method:

　　(1) Sampling in Three Situations

　　The first situation: when each site of the multi-site organization implements very similar processes and activities, multi-site sampling can be conducted.

　　The minimum number of sites to visit during each audit is as follows:

　　Initial certification audit: the sample size (Y) should be the square root of the number of sites (x), rounded up to the nearest integer, i.e., Y=√x;

　　Surveillance audit: the annual sampling size should be the square root of the number of sites multiplied by 0.6, rounded up to the nearest integer, i.e., Y=0.6√x;

　　Recertification audit: the sample size should be the same as the initial audit. However, if it is proven that the management system is effective during the certification cycle, the sample size can be reduced by multiplying by a factor of 0.8, rounded up to the nearest integer, i.e., Y=0.8√x.

　　The second situation: when the multi-site organization has the following conditions, multi-site sampling cannot be conducted:

　　All sites implement processes and activities related to the scope of the management system but have significant differences;

　　Customer requires auditing of each site;

　　There are specific plans or regulatory requirements that mandate systematic auditing of each site. For example, in food safety management system audits, sampling is not allowed; every multi-site must be audited.

　　In the above cases, initial certification audits and recertification audits should include all sites. During surveillance audits, 30% of the sites should be covered each calendar year (rounded up to the nearest whole number). Each audit includes central functions. The sites selected for the second surveillance audit are usually different from those selected for the first surveillance audit. The design of the certification body's audit program should ensure that all processes covered by the certification scope are audited within each cycle. If a certified enterprise adds a new site during the validity period of the certification, besides planning surveillance in the audit program, the new site should be audited before being added to the certificate; after the new site is included in the certificate, the certification body should cumulatively consider the new site with previous sites when determining the timing of subsequent surveillance or recertification audits.

　　The third situation involves multi-site organizations that fall between the above two cases. Some of their sites operate similar processes and activities, while other sites are special and do not have similar processes or activities (such as different products or services). In this case, sites with similar processes and activities can be sampled according to the first case described here; sites with dissimilar processes and activities can be considered according to the second case.

　　(2) Factors to consider when selecting samples

　　Samples should be selected from representative different sites to ensure that all processes covered by the certification scope will be audited. At least 25% of the samples drawn should be randomly selected. Within one certification cycle, the differences between sites selected for each audit should be as large as possible. When determining the number of samples and which sites to sample, the following factors can be considered:

　　Results of internal site audits, management reviews, or previous certification audits;

　　Sites with many complaints or problems, or with weak management foundations;

　　Significant differences in scale among sites;

　　Differences in shift arrangements and work procedures. If producing the same product, sites with shifts may be prioritized over those without shifts;

　　The complexity of the management system and the processes implemented at the site;

　　Changes at the site since the last certification audit; new sites may be prioritized;

　　For environmental management systems, consider the degree of environmental issues, factors, and their related impacts;

　　For occupational health and safety management systems, consider the degree of occupational health and safety risks related to activities and processes;

　　Differences in culture, language, and laws and regulations; sites with greater differences may be prioritized;

　　The degree of geographical dispersion; during each audit, sites geographically close may be considered for sampling;

　　Whether the site is permanent, temporary, or virtual. If permanent multi-sites include temporary sites, sampling should be done on permanent multi-sites according to sampling principles, and for any selected permanent multi-site, its temporary sites should also be sampled according to sampling principles for temporary multi-sites.

　　3. Typical Case Analysis of "Multi-site Organizations"

　　After correctly understanding the definition of "multi-site organizations" and mastering their sampling methods, it is more important to determine samples based on the enterprise's multi-site situation. To better understand the definition and sampling methods of "multi-site organizations," this article explains the understanding of the definition and the application of sampling methods through four scenario cases.

　　 Case 1

　　A concrete group company has 6 subordinate mixing stations and 1 mortar station. The certification scope covers the production of ready-mixed concrete and mortar, each with its own site, not located in the same place. The group company, the 6 mixing stations, and the mortar station are all independent legal entities with their own business licenses. Administratively, the group company manages the subordinate units, and they have established a unified management system. Therefore, the concrete group company is considered a multi-site organization. Within one certification audit cycle, according to sampling principles, the mortar station and the group company's functional departments must be audited each time; during the initial certification audit, 3 mixing stations are sampled; during annual surveillance audits, 2 mixing stations are sampled. Usually, all 6 mixing stations are sampled within one certification cycle.

　　 Case 2

　　A chemical company has two workplaces located in the same city, i.e., two work locations: one in the urban area mainly housing some functional departments of the company; the other in the chemical park, which is the company's production department, power department, and production base. Although there are two sites, because the production base and the company's functional departments are not subsidiaries or branch companies, but two departments at the same level within the enterprise undertaking different roles, this is not a true multi-site organization. The certification body needs to understand the work content and involved departments of the two locations and cannot sample departments from the two sites. When calculating audit man-days, the multi-site organization audit man-day calculation method should not be used. The departments and business activities related to the certification scope at the two sites are within the audit scope, and the audit addresses of the two workplaces should be reflected on the certification.

　　 Case 3

　　A power switch manufacturing company produces four products: A, B, C, and D. It has 4 branches and 2 work locations. The first and second branches are located in the east of the city, producing product A; the third and fourth branches and the company's functional departments are located in the west of the city, producing product B. Each branch is essentially a workshop, each with a branch manager, and each has a technician for process equipment production and a production team. According to the definition of multi-site organizations, this is not a true multi-site organization. When calculating audit man-days, the multi-site organization audit man-day calculation method should not be used. The departments and business activities related to the certification scope at the two sites are within the audit scope, and the audit addresses of the two workplaces should be reflected on the certification.

　　In the above scenario, if instead of 4 branches, there are 4 subsidiaries, and the products and production locations of the 4 subsidiaries are the same as in the above scenario, the only difference being that each subsidiary has departments and production workshops, and the company and the 4 subsidiaries have established a unified management system, this can be considered a multi-site organization. When calculating audit man-days, the multi-site organization audit man-day calculation method should be used. The departments and business activities related to the certification scope at the two sites are within the audit scope, and the certification should reflect the products, addresses, and related information of the 4 subsidiaries. Within one certification audit cycle, according to sampling principles, the company's functional departments must be audited each time. During the initial certification audit, the subsidiaries involved in products A and B need to be sampled. Each product is produced by two subsidiaries, and according to the principle of taking the square root of the number of multi-sites, all 4 subsidiaries need to be sampled. During the first annual surveillance audit, one subsidiary for each of products A and B is sampled; during the second annual surveillance audit, the subsidiaries not sampled in the first surveillance audit are sampled.

　　 Case 4

　　A certain machinery manufacturing group enterprise produces 4 products, with each subsidiary company producing one product. Each subsidiary operates in different locations; the group headquarters and one subsidiary share the same location, while the other three subsidiaries are located at three separate sites. The group and its subsidiaries have established a unified management system. The group company and its subsidiaries constitute a multi-site organization, but since the subsidiaries produce different products and do not have similar processes or activities, sampling among subsidiaries is not allowed. In this case, every audit must include the group headquarters. During the initial certification audit, all subsidiaries must be audited. For surveillance audits, 30% of the subsidiaries (rounded up) are sampled, meaning 2 subsidiaries are sampled. The subsidiaries sampled in the second surveillance audit must be different from those sampled in the first surveillance audit.

　　In the above scenario, if there are not 4 subsidiaries but 12 subsidiaries, each located at 13 different sites including the group headquarters, where 9 subsidiaries produce the same product and 3 subsidiaries produce three different products respectively, the calculation of auditor days follows the multi-site organization audit day calculation method. Some sites can be sampled while others cannot. Within one certification audit cycle, according to the sampling principle, the company's functional departments must be sampled in every audit. During the initial certification audit, 3 of the 9 subsidiaries producing the same product are sampled, and all 3 other subsidiaries are sampled; during annual surveillance audits, 2 of the 9 subsidiaries producing the same product are sampled, and 1 of the 3 other subsidiaries is sampled, with the subsidiaries sampled in the two surveillance audits being different.

　 　Conclusion

　　In summary, the key points for sampling in management system certification audits of multi-site organizations include: accurately determining whether it is a multi-site organization based on the definition of multi-site organizations; understanding the audit scope, management boundaries, effective personnel, addresses, organizational structure, products, legal status, and qualification licenses of each site; understanding the organizational structure of the central functions, the management authority of the central functions over each site, the legal status and qualification licenses of the central functions; confirming with the client the required representation of each site in the certification certificate; and based on the situation of multiple sites, determining which multi-sites can be sampled and which cannot. Sampling for both can be conducted according to the methods described in this document.