IAF MD 1 multi-site sampling: how many sites to audit
IAF MD 1 sampling explained: eligibility, the square root formulas, random selection, audit time per site and a worked example for planners.
Under IAF MD 1 sampling, an eligible multi-site organisation is audited on a sample of sites: the square root of the number of sites at initial audit, 0.6 times the square root at each surveillance, and the square root again at recertification (0.8 times if the system has proved effective). Results are rounded up, at least 25% of the sample is random, and the central function is always audited.
Key takeaways
- IAF MD 1 sampling only applies when sites run very similar processes under one management system with a central function.
- Sample sizes are the square root of the site count at initial audit, 0.6 times it at surveillance and the full or 0.8 times figure at recertification, always rounded up.
- At least a quarter of the sample must be picked at random, and the rest chosen to cover differences between sites.
- A major nonconformity at any site holds back certification for the whole organisation until corrective action is accepted.
What is IAF MD 1 sampling?
IAF MD 1 sampling lets a certification body audit a representative sample of sites, instead of every site, when a multi-site organisation runs one management system across similar locations. The rules sit in IAF MD 1, Audit and Certification of a Management System Operated by a Multi-Site Organization, currently Issue 3 (IAF MD 1:2023), issued and applicable from 18 October 2023. Check the IAF website for the current issue.
MD 1 also covers organisations that cannot be sampled, and allows a hybrid of the two. Where MD 1 and IAF MD 5 conflict for a multi-site organisation, MD 1 takes precedence. For the planning side of multi-site work, see multi-site audit scheduling.
Which organisations are eligible for sampling?
Before any formula, the organisation has to qualify as a multi-site organisation, and its sites have to be similar enough to sample.
- 1Single management systemOne system covers every site in scope
- 2Central functionIdentified, not subcontracted, with authority
- 3Central review and auditManagement review and internal audits cover all sites
- 4Similar processesSites perform very similar activities
- 5No scheme barSector or regulatory rules allow sampling
Sampling is not appropriate where sites carry out significantly different processes, where the client asks for every site to be audited, or where a sector scheme or regulator requires every site to be audited. Sector schemes such as IATF 16949 and the AS 9100 series have their own multi-site rules, which take precedence. The certification body must have documented procedures to restrict sampling in those cases.
How many sites must be sampled under IAF MD 1?
The sample size (y) comes from the number of sites (x). Every result is rounded up to the next whole number.
- Initial audit: y = √x.
- Surveillance: y = 0.6√x each year.
- Recertification: y = √x, the same as the initial audit. Where the management system has proved effective over the cycle, the sample can be reduced to y = 0.8√x.
- Central function: audited at the initial audit, at every recertification and at least once a calendar year during surveillance.
| Sites (x) | Initial (√x) | Surveillance (0.6√x) | Recertification (√x) | Recertification, effective system (0.8√x) |
|---|---|---|---|---|
| 4 | 2 | 2 | 2 | 2 |
| 10 | 4 | 2 | 4 | 3 |
| 25 | 5 | 3 | 5 | 4 |
| 50 | 8 | 5 | 8 | 6 |
| 100 | 10 | 6 | 10 | 8 |
| 200 | 15 | 9 | 15 | 12 |
These are minimums. MD 1 requires the sample size or frequency to be increased where the certification body's risk analysis shows special circumstances, for example large differences in site size, complex processes, complaints or multinational operation.
How are sampled sites selected?
The sample is partly selective and partly random. At least 25% of the sample must be chosen at random. The rest should make the selected sites as different from each other as possible.
Selection criteria in MD 1 include internal audit results, complaint records, differences in site size, shift patterns, process complexity, recent changes, system maturity, environmental issues, cultural and regulatory differences, and geographic spread. For the organisations it cannot sample, MD 1 expects the sites chosen for the second surveillance to be different from those chosen for the first.
A good sample is planned across the whole cycle, so that the sites nobody has seen for a while come up next.
A worked example: 50 retail branches
A retailer holds ISO 9001 for a head office (the central function) and 50 branches running the same processes. Branches range from small high-street units to large out-of-town stores, and three had complaints last year.
√50 is 7.07, rounded up to 8. At least 2 of the 8 are drawn at random (25% of 8). The other 6 are chosen to cover the large stores, the complaint sites and the regions. Surveillance needs 0.6 × 7.07 = 4.24, rounded up to 5 branches a year, plus the head office. At recertification the sample returns to 8, or 6 if the system has proved effective over the cycle.
MD 1 includes its own example with a layered structure: 4 national offices give a sample of 2, 27 regional offices give 6 and 1,700 local branches give 42, with at least 1, 2 and 11 random sites respectively.
How is audit time set for multi-site audits?
Audit time for each selected site is calculated with the applicable IAF documents, such as IAF MD 5 audit time for QMS, EMS and OH&S. MD 1 then limits how far that time can be cut: the reduction of audit time per sampled site shall not be greater than 50%, and 20% is the maximum reduction for the management system processes performed by the central function.
For planners, this means a sampled site is a real booking with a minimum length. Five small branches at half a day each still need five site visits, travel between them and an auditor competent for the scope. Cluster sampled sites by region where the selection allows, so the random share does not dictate a week of driving. Our guide on reducing auditor travel time covers clustering in detail.
What if a site cannot be sampled?
Under MD 1's non-sampling approach, the audit programme covers every site at the initial audit and at recertification. During surveillance, 30% of sites, rounded up, must be covered in each calendar year. A hybrid approach, sampling similar sites and auditing the rest in full, is also allowed.
New sites need a decision before they go on the certificate. For sampled organisations, the certification body decides what activities are needed before inclusion and recalculates future samples. For non-sampled organisations, the new site is audited before inclusion, on top of planned surveillance.
Common IAF MD 1 sampling mistakes
MythThe head office counts as one of the sampled sites.
RealityThe central function is audited at the initial audit, every recertification and at least once a calendar year in its own right. MD 1's example treats the head office separately from the sampled offices.
MythA site with a major nonconformity can be removed from scope to protect the certificate.
RealityMD 1 says certification is denied to the whole multi-site organisation pending satisfactory corrective action, and excluding the problem site to get round it is not admissible.
MythThe random share can be picked by the client.
RealityAt least 25% of the sample is random, chosen by the certification body.
Keep a record of which sites were audited in each year and why they were selected. It is the first thing an assessor asks for in a scheduling audit trail.
For certification bodies, audit scheduling software that checks competence, rotation and windows on every audit takes most of this work off the planning team.
ScheduleAI books sampled sites as individual audits with their own days, auditor competence and travel, and keeps the site history on the client so planners can see which branches are due for selection.
Book a demo Estimate your savingsQuestions
What is the current issue of IAF MD 1?
Issue 3, IAF MD 1:2023, issued and applicable from 18 October 2023. Check the IAF website for later issues.
How do you calculate the IAF MD 1 sample size?
Initial audit: the square root of the number of sites. Surveillance: 0.6 times the square root. Recertification: the square root, or 0.8 times it if the system has proved effective. Always round up.
How much of the sample must be random?
At least 25% of the sampled sites must be selected at random. The rest are selected to cover differences between sites.
Is the central function included in the sample?
It is audited in addition, at the initial audit, at every recertification and at least once a calendar year during surveillance.
Can audit time per site be reduced for multi-site audits?
Yes, within limits. MD 1 caps the reduction per sampled site at 50%, and at 20% for the management system processes of the central function.
Does IAF MD 1 apply to ISO/IEC 27001?
For ISMS audit time, European co-operation for Accreditation guidance says ISO/IEC 27006-1 applies, as stipulated in the scope of IAF MD 1; see ISO/IEC 27001 audit duration.