A common policy does not automatically create common control across plants, offices or distribution centres. This diagnostic guide identifies the governance failures that remain hidden in consolidated dashboards and shows how to test site level accountability.
Head office may report that an ISO programme is complete while a remote site cannot explain who approves supplier deviations or controls local training. That contradiction is not simply a documentation gap: It is often an authority, resourcing or assurance failure. Multi site governance must balance shared principles with sufficient local competence, and the chosen certification arrangement does not remove site level operating responsibility.
01The Symptom: Corporate Green, Local Red
A consolidated status report shows approved procedures, trained staff and closed actions, yet a site audit finds local workarounds. The discrepancy suggests that head office milestones are measuring distribution rather than implementation. Select real transactions at two contrasting sites before concluding that the system is uniform.
Early warning signs include undocumented delegations, different definitions of the same KPI, site exceptions that never reach the sponsor and local risk registers disconnected from enterprise decisions.
Diagnostic signal. A consolidated green dashboard is unreliable when locations use different thresholds or escalate incidents differently. Compare a similar recent exception at two sites and determine who approved the disposition, which control was applied and whether the central team could see the variance.
02Diagnose Authority and Escalation
A central policy may say that only headquarters approves process changes while site managers are expected to resolve urgent deviations. If no temporary authorization route exists, the practical system becomes informal. Interview the people who actually make time sensitive decisions.
Governance warning signs and diagnostic tests
Use the criteria below as an evidence led management decision aid; adapt the thresholds and responsibilities to the actual process, scope and consequences.
| Observed symptom | Probable mechanism | Test evidence |
|---|---|---|
| Conflicting local approvals | Delegation undefined | Deviation and change authorizations |
| Incomparable KPIs | Definitions differ | Source data and calculation rules |
| Actions closed without effect | Weak verification | Later transactions and review records |
| Central forms ignored | Control not fit for local work | Site interviews and actual work method |
An authority matrix needs to cover ordinary approvals, exceptional situations and the requirement to escalate beyond a site. Evidence includes signed decisions, shift handovers, change records and cases that demonstrate when an issue moved to enterprise level.
What to compare. Obtain local authority matrices, common KPI definitions and escalation records from several sites. Differences can be justified by operational exposure, but the organization should know which differences are deliberate adaptations and which reflect uncontrolled local practice.
03Find the Hidden Data Definition Problem
Different sites may report on time delivery, incidents or audit closure using incompatible denominators. A consolidated average then obscures poor performance and misdirects resources. Treat metric definitions as a governance control with a named owner.
Check source system extracts against the stated calculation, compare the same sample across sites and document permissible local differences. Normalization is not manipulation: It establishes whether reported outcomes are genuinely comparable.
Local accountability. A corporate ISO function can define common methods; site leaders still need authority and competence to implement controls in their own operations. Document who may suspend work, accept a deviation, change a supplier or request corporate intervention.
04Separate Common Rules from Local Risk
Central management should define shared minimum controls where risks and obligations justify them; local managers need authority to address specific machinery, languages, laws and customer requirements. Standardizing every form can increase bureaucracy without improving control.
A defensible architecture identifies which controls cannot vary, which can be adapted and who approves exceptions. The decision must be retrievable when the site changes a method or corporate teams issue a new template.
Test the common rule. Select a corporate procedure that several sites claim to follow. Ask local employees to demonstrate the live process and trace any site level variance to an accepted change decision. If the corporate form exists but staff work elsewhere, correct the process design before duplicating the document.
- Test shared services through end to end samples
- Make exception approval visible to both locations
- Audit inter site interfaces as well as local controls
05Follow a Cross Site Failure to Its Cause
Illustrative scenario: A spare component approved by one plant is transferred to another, where a different acceptance criterion applies. Both sites claim to follow the group purchasing procedure, but the central document does not define who validates the receiving site requirement.
The corrective response is to clarify interfaces and review the procurement control, not to demand another round of generic awareness training. Test the new rule on a later inter site transaction and review supplier and stock records.
Practical Decision Check
Interview decision makers beyond central quality staff. Require dated evidence and an accountable follow up owner.
Review beyond averages. Leadership should examine outliers and repeated themes, not just the consolidated mean. A poor performing site can disappear in portfolio reporting; require commentary on exceptions, local corrective action effectiveness and cross site lessons that actually changed operations.
Illustrative scenario: Two plants use different acceptance rules for transferred material. A cross site trace reveals no receiving site authorization, leading to an interface change and subsequent verification. To verify the proposed change, the management team should inspect a subsequent transaction, interview its competent owner and compare the actual result with the original decision criteria. It should retain any residual exposure and review date, rather than treating completion of the project action as evidence of lasting effectiveness.
06Audit the Connections, Not Only the Sites
A site audit can be locally satisfactory while the enterprise oversight process fails to notice systemic issues. ISO 19011:2026 supports a risk based auditing approach; IAF MD 1:2023 addresses audit and certification arrangements for multi site organizations, which are not interchangeable with internal governance requirements.
Select horizontal traces such as a shared supplier, central design change, common competency standard or transferred incident. Determine whether both ends have agreed criteria and whether enterprise review identifies recurring failures.
Audit connection. Sample interfaces where one site supplies another or central decisions affect local practice. A conforming local record is not enough if central approval, shared services or an escalation handoff can fail without leaving a reliable trail.
07Triage the Governance Breakdown
Classify the failure as unclear decision right, inconsistent data, ineffective communication, inadequate capacity or an unsuitable central control. The response should address the mechanism. Rewrite only the portion of documentation that actually drives the behavior.
Assign a corporate owner and a site level verifier; define an observable completion test. Corrective action closure is unconvincing when no subsequent operating sample supports the claim.
A workable sequence for the accountable team:
- Sample contradictory site results
- Identify central and local decision rights
- Trace evidence through shared interfaces
- Correct root causes and clarify exceptions
- Retest operations and compare across sites
Escalation route. Assign a central process owner for each common control and a local owner for its execution. The escalation rule should state what remains local, when an issue becomes enterprise wide and which sponsor may resolve a resource or policy conflict.
- Interview decision makers beyond central quality staff
- Compare KPI definitions before ranking sites
- Test shared services through end to end samples
08Sustain Assurance Through Shared Learning
Build a recurring cross site forum to compare exceptions and transfer lessons. Maintain explicit escalation thresholds and use site performance data to challenge central assumptions.
The strongest indicator is not identical language in every procedure. It is that different locations can explain and demonstrate how they achieve equivalent intended outcomes under their actual conditions.
Keeping it effective. Revalidate governance whenever sites are added, merged, reorganized or given new products. Use periodic cross site calibration of definitions and decision rights so differences remain understood rather than accumulating as undocumented exceptions.
05Diagnostic Triage and Confirmation
The next management conversation should convert this analysis into a controlled, time bound decision. Specify what would count as disconfirming evidence and make sure the person with authority can act on it. A pragmatic implementation normally begins with a well selected process sample and a clear owner, not with a campaign to complete every document simultaneously.
- Interview decision makers beyond central quality staff
- Compare KPI definitions before ranking sites
- Test shared services through end to end samples
- Make exception approval visible to both locations
- Audit inter site interfaces as well as local controls
For assurance, use normal business records wherever possible and compare what a manager says should happen with a recent transaction, an exception and the recorded follow up. That approach also reduces dependency on individual consultants, temporary project staff and rehearsed audit examples.
06Closing Perspective
A common multi site system earns confidence through consistent decisions and locally verifiable control, not identical documents alone.
A sensible next step is to select one material decision described in this article, examine its current evidence and assign an explicit owner to improve the weakest control. The resulting record should make the choice understandable to another manager and establish when the outcome will be reviewed again.