ISO 45001 Multi-Site Audit and Certification Guide

Many multinationals and industrial groups hold ISO 45001 certificates for dozens of plants, warehouses and offices. Some certify each site separately; others certify a group of sites under one management system and one certificate. The second route is called multi-site certification. It is governed not by ISO 45001 itself, but by the rules that accredited certification bodies must follow, mainly IAF MD 1:2023 from the International Accreditation Forum and, for occupational health and safety, IAF MD 22.

This guide summarizes those rules for group EHS and compliance leaders. It is general information; your certification body applies the details and may set stricter conditions.

What multi-site certification is

IAF MD 1:2023 (Issue 3, application date 18 October 2023) defines a multi-site organization as one covered by a single management system with an identified central function, the function that "is responsible for and centrally controls the management system", and a number of sites. Sites can be permanent, temporary or virtual. Every site must have a legal or contractual link with the central function, and the central function does not have to sit in a single location.

The practical benefit is that the certification body may audit a sample of sites rather than every site every time. The trade-off is that the whole certificate depends on the whole system: a serious problem at one site can affect them all.

Who is eligible

IAF MD 1:2023, clause 5, sets the conditions. In plain terms:

Clause	Requirement	What it means for a group
5.1	A single management system	One set of procedures, forms and criteria, not a federation of local systems.
5.2	An identified central function, part of the organization, not subcontracted	The group or regional EHS function owns the system; a consultant cannot be the central function.
5.3	Authority to define, establish and maintain the system	The central function can require sites to adopt changes.
5.4	A centralized management review	One management review covering all sites.
5.5	All sites in the internal audit programme	Every site is audited internally, not only the ones the certification body will visit. See our multi-site internal audit programme guide.
5.6	Data collected and analyzed from all sites; ability to initiate change	The group can see every site's data and act on it.

How site sampling works

Under IAF MD 1:2023, clause 6.1.3.3, the number of sites visited is based on the square root of the number of sites (x):

Audit	Minimum sample	Example: 20 sites
Initial certification	√x, rounded up	√20 = 4.47 → 5 sites
Each surveillance audit	0.6 × √x, rounded up	2.68 → 3 sites
Recertification	√x, or 0.8 × √x if the system has proven effective	5 sites, or 3.58 → 4 sites

Three further rules matter:

Random selection: at least 25% of the sample is chosen at random (6.1.2.2). The rest is selected by the certification body, so a group cannot steer auditors to its best sites.
Central function every year: the central function is audited at initial certification and recertification, and at least once a calendar year during surveillance (6.1.3.4).
Risk can increase the sample: the size or frequency of sampling is increased where the certification body's risk analysis shows special circumstances (6.1.3.5). Clause 6.1.1.4 also requires certification bodies to set documented restrictions based on factors such as sector, process risk or complexity, site size and local variation.

Note that these are minimums for the number of sites. How many audit days are needed is a separate calculation; for OH&S, IAF MD 22 points to IAF MD 5 for audit time.

Extra rules for occupational health and safety

IAF MD 22 explains how certification bodies apply ISO/IEC 17021-1 to OH&S management systems. For multi-site organizations it adds important conditions (guidance G 9.1.5, read with G 9.1.4):

Sampling is only possible after the certification body has evaluated the OH&S risk level of the activities and processes at each site.
Sampling is not appropriate when sites do not cover the same activities, processes and OH&S risks. A cement plant and a sales office are not interchangeable samples.
The sampled sites must be representative of the processes, activities and OH&S risks in the organization. Even sites with similar processes are checked for differences, such as technology or the quantities of hazardous materials.
When choosing sites, the certification body considers factors such as OH&S risks, contracts, accident and near-miss statistics, and internal audit results.

MD 22 also shapes what happens on site. Audit teams interview management legally responsible for OH&S, employee representatives for OH&S, health-monitoring personnel, and managers and permanent and temporary employees (G 9.4.4.2), and should consider contractor personnel. Legal compliance is evaluated on what is actually implemented, not only on plans (A.1.3). And the certified organization must inform its certification body without delay of serious incidents or regulatory breaches that involve the regulator (G 8.5.3); a special audit may follow (G 9.6.4.2).

When one site has a nonconformity

This is where multi-site certification differs most from single-site certificates. Under IAF MD 1:2023, clause 7.7:

When a nonconformity is found at one site, the organization must investigate whether other sites may be affected. If it reflects an overall system deficiency, corrective action is verified at the central function and at the affected sites (7.7.1).
The certification body increases sampling frequency or sample size until it is satisfied that control is re-established (7.7.2).
If any site has a major nonconformity, certification is denied to the whole listed organization until corrective action is satisfactory (7.7.3).
Removing a problem site from the scope to get past a nonconformity is not acceptable (7.7.4).
If any site fails to meet the requirements for maintaining certification, the certification documentation is withdrawn in its entirety (7.8.4).

In other words, the certificate is only as strong as the weakest site, and the group needs to see problems before the auditor does.

Evidence the central function needs

Map the IAF conditions to the ISO 45001:2018 clauses you already work with, and decide where each piece of evidence lives:

Need	ISO 45001 clause	Evidence to keep, for every site
Worker consultation and participation	5.4	Safety committee members, minutes and actions; hazard reports from workers
Hazards, risks and legal requirements	6.1	Risk assessments using one group risk matrix; register of legal and other requirements
Competence	7.2	Training matrix: required versus completed, with refreshers due
Emergency preparedness	8.2	Response teams, drill schedule and drill reports
Monitoring and compliance evaluation	9.1	Inspections, KPIs and compliance checks, comparable across sites
Internal audit of all sites	9.2	Audit programme showing coverage of every site, findings and follow-up
Centralized management review	9.3	One review using consolidated data from all sites
Incidents and corrective action	10.2	Investigations, root causes and CAPA, with a record of whether other sites were checked

Comparable data is the hard part. If sites use different incident categories or injury-rate bases, the central function cannot honestly claim to "analyze data from all sites". Our playbook for standardizing HSE reporting across countries covers how to fix that.

Preparation checklist

#	Check	Done?
1	Central function named, with written authority over all sites	☐
2	Every site listed, with its legal or contractual link and its activities and OH&S risks	☐
3	Sites grouped by similar activities and risk, so sampling can be justified	☐
4	One set of procedures, forms, risk matrix and KPIs used everywhere	☐
5	Internal audit programme covers every site in the cycle	☐
6	Rule for checking other sites when a nonconformity or serious incident occurs	☐
7	Process to inform the certification body promptly of serious incidents	☐
8	Worker representatives, temporary staff and contractors ready to be interviewed	☐
9	One management review with consolidated data from all sites	☐

ISO is revising ISO 45001. When the new edition is published, ask your certification body for its transition timetable before changing your documentation. For the basics of building the system, see our ISO 45001 implementation checklist.

Running it in one system

Multi-site certification rewards groups that can show one system, live, at every site. AccelSafety keeps all sites in one hierarchy from group to region, country, cluster and site, with access scoped to each user's part of it. Work is grouped by ISO 45001 clause; incidents and investigations, hazards and near misses, risk assessments, actions and CAPA, audits and inspections, training, emergency drills and the safety committee use the same workflows everywhere; and group dashboards drill back to auditable source records with their history. See how it works for large groups on our enterprise HSE software page, or book a free demo.

ISO 45001 multi-site certification: sampling, the central function and the evidence auditors expect