If an organization applies for certification from an accredited certification body, it must be determined how much time must be spent on the audit. One of the components of the audit time calculation is the number of sites of the applicant organization. With the earlier arrival of the Amendment-1:2020 to ISO 27006, there has been a lack of clarity about how to calculate the audit time of organizations with multiple sites. The European Accreditation has now taken a formal position on calculating the number of FTEs per location. This position is followed by the Dutch Accreditation Council:

Since the publication of ISO/IEC 27006 AMD-1: 2020, the state requirements for multi-site organisations have changed, leading to possible confusion with regard to audit time calculation. 

Question: Can the audit time for a multi-site organisation be calculated as if it was a single site?
No, Audit Time has to be calculated on the basis of the characteristics of each specific site that is part of the sample. For each site the audit time must be coherent with consideration based on the indication of § 9.1.5.1.2 and the number of people that has access to each specific site. What the amendment states is that this number cannot be less than if it was calculated on the basis of a single site, when and if such situation could be. 

The statement above may have an impact on the earlier time calculation that applied to an organization. 

When is one organization with multiple locations the case?

This is the case when the entire organization falls under one management system, consisting of a central function with several locations (permanent, temporary or virtual) where the processes/activities from the scope of certification are fully or partially performed.

Application

To determine whether there are one or more locations, it is examined per organization which locations fall under the scope of certification. The basic principle is that all formal locations are considered in relation to the scope.

Audit time calculation

In order to arrive at a correct time calculation, an audit time calculation is made for each location based on the number of FTEs that are employed per location. The calculation of the audit time is based on the locations to be visited per year. In some situations, this is based on a sample.

Certification

Each year, the central function and several sites of a multi-site organization will be audited based on the applicable requirements. See also the links under ‘more information’.

Costs of certification

Depending on the situation, the method above may result in an increase in the required audit time. As a result, the costs of the certification process may increase, due to the extra time we need to carry out the work. Are you a customer with multiple locations and would you like an indication of the financial consequences for your audit? Please contact our customer and project coordinators via planning@brandcompliance.com or telephone number +31 73 220 20 30.

More information

In the resources below you will find more information about the requirements that Brand Compliance must meet regarding organizations consisting of multiple locations: