One management system can span many sites, but common governance, differing activities and certificate boundaries require separate decisions.
A group managing six facilities wants one ISO certificate. Its chief executive sees a unified brand, the finance team sees lower administration, and local managers worry that specialist work will disappear into corporate averages. The decision is not settled by the number of addresses. Leaders must distinguish the organizational management system boundary from certification eligibility and determine whether processes truly operate under one accountable system.
01Decision in Focus: What Should Be Common and What Must Remain Local?
The core question is whether the enterprise has a coherent management system with central governance capable of managing relevant site processes and differences. A single set of corporate policies is not sufficient if operating decisions, internal audit and management review are fragmented.
The alternative is not necessarily ten entirely independent systems. Different certification scopes or staged arrangements may be appropriate when activities, legal entities and readiness differ materially. Leadership should select the arrangement that can be explained and verified.
Ask leadership to articulate the reason for its chosen configuration.
02Separate Management System Scope from Certificate Configuration
The organization may manage multiple locations through one process architecture while seeking different accredited certification arrangements. Conversely, listing several sites on a document does not establish that multi site certification sampling rules can apply.
For accredited management system certification, IAF MD 1:2023 addresses specified conditions for a multi site organization with a single management system. Discuss planned configurations with an appropriately accredited certification body rather than assuming sampling entitlement.
Separate organizational governance from certification conditions.
Executive discussions should begin by naming the desired customer and organizational outcomes, not by asking how to minimize audit days. A unified system can improve consistency and shared learning, but it does not eliminate technical variation. The configuration decision should make those trade offs explicit.
Governance Distinction
An enterprise system can be shared even when the certification arrangement requires separate conditions; leadership should not present a desired certificate layout as an approved fact. The evidence should be assessed within the organization’s actual boundary and commitments.
03Choose the Governance Model Before the Audit Calendar
Assign a central function with defined authority over common system controls and identify competent site owners. Specify who approves policies, reviews performance, investigates systemic findings and authorizes deviations. Centralization without genuine control produces a façade.
Site level accountability remains important for legal obligations and operating outcomes. A plant manager cannot avoid local responsibilities by pointing to a corporate quality office; equally, a local manager should not bypass enterprise controls without an authorized rationale.
Demand evidence of real central authority across the proposed sites.
The central function must show authority through operating examples. Can it require a site to stop a nonconforming activity, fund a shared corrective action or change an enterprise method? If not, a nominally centralized policy structure may conceal locally independent management systems.
Sequence for the steering committee:
- Map all legal entities, sites, activities and common interfaces.
- Demonstrate central authority and site level responsibilities.
- Compare control similarities, variation and technical competence.
- Assess coordinated internal audit and management review capability.
- Consult an accredited certification body about the intended scheme.
- Record the selected scope and changes that trigger reconsideration.
04Compare Site Activities and Material Differences
Map which locations design, manufacture, distribute, provide remote support or perform testing. Identify sector specific controls and different regulatory environments. This activity comparison informs whether processes are sufficiently similar for common methods and how audit coverage should be planned.
A homogeneous sales office network differs from a group with a laboratory, chemical plant and software platform. The latter may still share governance but may require distinct technical competence, specialized audits or separately defined scope details.
Document which processes and legal duties vary by location.
05Illustrative Board Decision: A Regional Manufacturing Group
In a fictional group, four similar assembly plants share purchasing and engineering controls; a fifth site performs specialized hazardous processing. Leaders initially seek one simple scope description. Mapping shows that the fifth site has additional controls and more complex competence requirements.
The group retains common governance but prepares a more precise scope and audit design, seeking certification body advice on the appropriate configuration. This hypothetical example demonstrates decision diligence, not a guarantee of eligibility.
Use a hypothetical divergent site scenario to test assumptions.
A technically specialized site changes the assurance calculation. Competent auditors and appropriate sampling are needed to assess what differs, not just what is common. The certification body’s own assessment of eligibility is therefore an input to planning, not a conclusion leaders should pre announce.
One common tension occurs when an enterprise management representative coordinates policy centrally but local technical managers retain independent authority over design and release. This can be sound if responsibilities, common review and escalation are genuinely integrated. It becomes problematic when the central function cannot resolve systemic findings or even obtain records from a site that is expected to operate within one group wide management system.
A board discussion should therefore request a demonstration of the same control at two different sites and explain any variation. Use a customer complaint, supplier change or safety event as the practical test. If sites cannot identify the central decision authority and their local responsibilities, pause public claims about a unified scope until the governance model is demonstrated. Certification configuration questions should be resolved with the certification body.
06Evaluate Assurance and Resourcing Trade Offs
Consolidation can reduce duplication of policies and reviews, but it creates cross site coordination, data harmonization and audit planning needs. Separate certificates can clarify distinct activities but may multiply administration and obscure systemic problems.
Single System Decision Criteria
Read each row as a decision test: The evidence and control should be proportionate to this article’s specific operating context.
| Management question | One centrally managed system | Separate or staged arrangements |
|---|---|---|
| Common process authority | Demonstrably effective across sites | Material governance independence |
| Site activities | Comparable with justified local controls | Distinct outputs and technical safeguards |
| Assurance evidence | Coordinated audit and management review | Different maturity or assurance arrangements |
| Certification design | Subject to scheme and IAF criteria | Scope/site specific certification decisions |
Consider how serious incidents propagate across sites and whether central resources can detect and respond. The comparison must include internal audit competence, legal duties and the costs of keeping evidence accessible across jurisdictions.
Include internal resources and assurance costs in the comparison.
The governing team should avoid promising that one certificate always costs less. The full cost includes internal audit travel, coordination, site readiness, data alignment, specialized expertise and remediation. A staged approach sometimes reduces disruption and clarifies evidence even if the final certificate structure is broader.
Operational verification checklist
- Distinguish system design from certification arrangements
- Test central function and site responsibilities
- Assess material differences in local activities
- Check IAF MD 1 multi site eligibility where relevant
07Questions for the Next Steering Committee
Can central leadership demonstrate authority to require corrective action across all proposed sites? Are common procedures actually used and assessed? How do site differences alter competence, process controls and customer promises? Which entities and locations will the scope statement name?
Ask the certification body which conditions govern multi site audit design and which activities may require more extensive review. Record assumptions and decisions before setting a promotional certification date.
Bring specific eligibility questions to the certification body.
Boardroom Question
Which real site would disprove our claim that centralized governance operates consistently? The evidence should be assessed within the organization’s actual boundary and commitments.
A practical check for the accountable management team:
- Never infer certification sampling eligibility from a group structure alone.
- Maintain precise activity descriptions for different sites.
- Require central processes to demonstrate real authority.
08Approve the Configuration and Maintain Evidence
The selected model should be supported by site maps, process ownership, applicable legal obligations, a coordinated audit programme and management reviews capable of identifying group wide trends. Establish rules for additions, removals and changed activities.
The stronger configuration is the one that makes governance credible under pressure. Scope clarity, risk relevant local control and honest audit coverage matter more than the visual simplicity of a single certificate.
Monitor acquisitions and scope changes under formal review.
An acquisition or new location should trigger a structured entry decision. Confirm central control, map activities, establish competence and perform a baseline review before adding it to an externally stated scope. The same discipline applies to sites closing or transferring activities.
Practical Review and Next Decisions
Prepare a concise configuration brief for the board setting out the legal entities, activities, central authority, site differences and assumptions about accredited assessment. It should compare a unified scheme with staged or distinct arrangements without treating lower audit cost as the only objective. Identify precisely who is accountable for selecting and defending the final scope.
Before authorizing a single group wide claim, challenge two sites with different services. Ask them to demonstrate the same relevant policy, actual process control and escalation route, then inspect evidence of any justified local difference. This reveals whether the organizational architecture is genuinely shared and prepares management for a productive discussion with its certification body.
A final challenge for the executive team is to sample one cross site corrective action. Inspect which site identified the issue, how the central function decided whether it was systemic, who funded the response and where later verification took place. If the sequence cannot be shown, a unified management system claim may be premature regardless of the attractiveness of one certification scope.
- Never infer certification sampling eligibility from a group structure alone.
- Maintain precise activity descriptions for different sites.
- Require central processes to demonstrate real authority.
- Keep local legal accountability visible in enterprise governance.
- Validate changes in sites and scope before external assessment.
Illustrative Board Decision, a regional manufacturing group distinguishes shared governance from differing hazardous processing controls when selecting a multi site arrangement.
Closing Perspective
One scope or several is ultimately a governance choice tested by site specific evidence, accreditation conditions and organizational control. The configuration is defensible when its public description matches competent people and real operations.