How do we scope and certify an ISMS across several sites or legal entities?

Start

Our ISMS has to cover more than one site or legal entity

One certificate can cover several sites or companies, but only if they are run under one management system. When they are, a certification body may audit a sample of sites at each visit. When they are not, each part needs its own audit or its own certificate. The decisions are what is in the scope, whether one system really runs it all, and what the body will accept.

• Then: List every site and entity and what each does for the services

Step

List every site and entity and what each does for the services

Include offices, data centres, home working and temporary sites, and each legal entity. For each, note the services it delivers or supports, who manages it, and how it is linked to the head office by ownership or contract. Home working is included in practice in almost every scope.

• Then: Does each site or entity deliver or support an in-scope service?

Decision

Does each site or entity deliver or support an in-scope service?

A site that does no work for the in-scope services can be excluded, with the reason stated and its access to in-scope systems controlled. A site that does is in. Not known takes the in branch until you have looked.

• Yes, or not known: Will one management system, run centrally, cover them all?
• No: Exclude the others, state why and control any access they have

Step

Exclude the others, state why and control any access they have

Write the exclusion into the scope statement with its reason, which must not amount to not being ready. If the site can reach in-scope systems, that access stays under your controls.

• Then: Will one management system, run centrally, cover them all?

Decision

Will one management system, run centrally, cover them all?

Sampling requires a single management system with a central function that has the authority to define and maintain it. A separate business with its own management is not part of that. Name it as an interface with an agreement, or give it its own system.

• Yes: Set up the central function and the shared routines
• No: Scope them separately, or name the other as an interface

Outcome

Scope them separately, or name the other as an interface

A separate business with its own management is an interface, covered by an agreement, or it holds its own certificate. Decide which with top management. Do not stretch one scope over parts you do not manage, and do not say the certificate covers them.

Step

Set up the central function and the shared routines

The accreditation forum's rule expects a central function that is part of the organisation, with authority to define the system, one management review for all sites, an internal audit programme covering every site, data collected from all sites, and corrective action at any site. Every site needs a legal or contractual link to the centre.

• Then: Do the sites carry out very similar activities?

Decision

Do the sites carry out very similar activities?

Sampling is meant for sites that do much the same work under the same system. A head office, a data centre and a call centre are not alike. Sites with different activities, risks or laws need to be grouped or audited separately.

• Yes: Ask each certification body how it would audit your sites
• No, or not known: Group like with like and expect each group to be audited

Step

Group like with like and expect each group to be audited

Put sites that do the same work together and treat other sites as separate groups. The body decides how many of each to visit. A site doing work that nowhere else does may be audited every time.

• Then: Do sites work under different laws, languages or customer contracts?

Step

Ask each certification body how it would audit your sites

Ask in writing whether it allows sampling for your scope, how many sites it would visit at each audit, how it chooses them, what it adjusts for risk, and what it audits at the centre. Compare the answers in the quotes, and the audit days for every year of the cycle.

• Then: Does the body allow site sampling for your scope?

Decision

Does the body allow site sampling for your scope?

The accreditation forum's published rule sets the minimum sample as the square root of the number of sites, rounded up, with a smaller sample at surveillance. Bodies may increase it for size, differences in practice, past findings or complaints, and may refuse sampling for some scopes. Not known: ask.

• Yes: Plan for the central function at every audit and a sample of the sites
• No, or not known: Plan for every site to be audited and budget for it

Step

Plan for the central function at every audit and a sample of the sites

Expect the central function to be audited each year and a part of the sample to be chosen at random, with the rest chosen to cover the differences between sites over the cycle. Every site must still follow the system, because any site may be chosen.

• Then: Do sites work under different laws, languages or customer contracts?

Step

Plan for every site to be audited and budget for it

If the body does not allow sampling, each site is audited, with the audit days adding up. Compare this with narrowing the first scope and adding sites later, as the pack advises when part of the scope cannot yet show records.

• Then: Do sites work under different laws, languages or customer contracts?

Decision

Do sites work under different laws, languages or customer contracts?

Local legal and contractual requirements change what a site must do. They also change how far sites are alike. Each needs its place in your register of requirements, and local procedures where needed.

• Yes, or not known: Add the local requirements to the register and to local procedures
• No: Plan the internal audit to reach every site over the cycle

Step

Add the local requirements to the register and to local procedures

Record local laws and customer terms by site or entity, with an owner, and make sure the central procedures allow the local variation. Ask counsel in each country, as the rules differ.

• Then: Plan the internal audit to reach every site over the cycle

Step

Plan the internal audit to reach every site over the cycle

The central function runs one programme that visits every site, with more attention to the riskiest and the newest. Report the results to one management review. The body will read these records to decide how much to sample.

• Then: Do you plan to add sites or entities later?

Decision

Do you plan to add sites or entities later?

Adding a site changes the scope. Tell the certification body before the change, and expect it to assess the new site under its own rules. Plan the timing so the new site has records before it is assessed.

• Yes: Tell the body and add each new site under its rules
• No: Sites and entities scoped, run as one system, agreed with the body

Step

Tell the body and add each new site under its rules

Raise it at the planning of the next audit, with the site's activities and size. Bring the site under the central function, the internal audit and the review first, and ask the body when it will assess it.

• Then: Sites and entities scoped, run as one system, agreed with the body

Outcome

Sites and entities scoped, run as one system, agreed with the body

Keep the scope statement, the list of sites with reasons, the central function's mandate and the body's written answer on sampling. Do not say one certificate covers all your companies, or that every site is audited, unless the scope and the body say so.