This appendix provides instruction to auditors on sampling requirements for multi-site facilities.
The definition of a multi-site organization is an organization having an identified central function at which certain activities are planned, controlled or managed and a network of sites at which such activities are fully or partially carried out. The organization’s quality management system is centrally administered under a centrally controlled plan and subject to central management review.
When auditing organizations with multiple sites the goal is to verify that the quality management system conforms to the Standard, while maintaining the economic and operational feasibility.
The processes used at multi-sites must be substantially the same and conducted fundamentally according to the same methods and procedures. The ASP must conduct a document review prior to assessment to verify the similarities between sites and determine the complexity and scale of the activities covered by the QMS. Factors to be taken into consideration may include:
If any non-conformances are found at an individual site (either through internal or external audit), an investigation should take place to determine whether other sites may be affected. If they are, corrective action (both centrally and at the site(s)) should be performed and evidence provided to the audit team. The team must be satisfied that control is re-established and may increase its sampling until it is assured of that.
Sampling should result in a range of different sites being selected, without excluding the random element of sampling.
At least 25% of the sample should be selected at random. The remainder should be selected so that the difference among the sites selected over the period of validity of the certification is as large as possible.
Site selection may include, among others, the following aspects:
The selection does not have to be done at the start of the audit, but may be done once the central office audit is completed. The central office will be notified of the sites to be part of the sample, with sufficient notice to prepare. The central office will be audited during every certification and surveillance audit.
In a low to medium risk activity with less than 50 employees at each site, the minimum number of sites visited per audit would be:
Implementation audit:
Surveillance audit:
Recertification audit:
Sampling size will be increased where the risk analysis of the activity/facility indicates special circumstances in respect of factors such as:
On the application of a new group of sites to join an already certified multi-site network, each new group of sites will be considered as an independent set for the determination of the sample size. After inclusion of the new group in the certification, the new sites will be cumulated to the previous ones for determining the sample size for future surveillance or recertification audits.