Multi-Site Audit Sampling under ISO 22003-1: Rules and Eligibility

Regulatory Background, Central Function Rationale, and Affected Roles

Under DS/ISO 22003-1:2022, third-party certification bodies may apply multi-site audit sampling only under strictly defined regulatory conditions. Compliance leads, quality managers, and internal auditors must understand that site sampling is a conditional privilege rather than an automatic entitlement. The rationale behind Clause 9.1.5 is to ensure that sampling never undermines audit integrity or obscures systemic food safety risks across networked operations.

A multi-site organization is defined in Clause 9.1.5.2 as an entity with an identified central function that plans, controls, or manages specific food safety management system activities, alongside a network of sites where activities are fully or partially executed. Affected structures include franchise networks, producer groups in farming, companies with central headquarters and sales branches, and multi-location service providers. The central function exerts operational authority over every site, though it need not be located on a single physical site.

Eligibility Criteria and Mandatory Central Function Oversight

Clause 9.1.5.3 establishes ten mandatory conditions that an organization must fulfill before a certification body can justify multi-site sampling. The organization must operate under a single, centrally administered food safety management system where all sites share legal or contractual ties to the central function. Crucially, the central function must be an internal component of the client organization and must not be subcontracted to an external party.

To ensure systemic consistency, sampled sites must display operational similarity across food chain subcategories, processing technologies, hazard profiles, and statutory obligations. Under Clause 9.1.5.3, the central function must hold organizational authority to establish and maintain the system, enforce corrective actions, collect performance evaluation data, and execute central management reviews. Internal auditors must audit every site within the network annually under Clause 9.1.5.5, ensuring pre-certification internal audit coverage for all sites within one year prior to initial certification.

When auditing the network, the certification body must perform an audit of the central function at least annually prior to auditing sampled sites under Clause 9.1.5.6. Under Clause 9.1.5.7, site selection must combine random sampling with selective targeting, requiring at least 25% of the sample to be chosen at random. The remaining 75% must be selected selectively based on internal audit findings, management review outputs, complaint records, product recalls, and operational variations.

Under Clause 9.1.5.8, if a major nonconformity is identified at any individual site and is not satisfactorily resolved within agreed time frames, the certification body must not grant or maintain certification for the entire multi-site organization. Auditors evaluate whether site findings indicate systemic deficiencies that apply to other un-sampled locations across the group.

Category Exclusions, Sampling Formulas, and Selection Rules

Clause 9.1.5.4 strictly limits which food chain categories are eligible for site sampling, excluding high-risk processing sectors entirely. Site sampling is explicitly prohibited for Category C (food, ingredient, and pet food processing), Category D (feed processing), Category H (services), Category I (packaging material production), Category J (equipment manufacturing), and Category K (biochemical production). High-risk operations must undergo individual on-site audits for every facility included within the certification scope.

For eligible categories defined in Table A.1 of Annex A, the standard dictates specific mathematical formulas to calculate minimum audit sample sizes. Category A and Category B primary production operations may utilize site sampling, calculating the minimum sample size as the square root of the total site count, rounded up to the next whole number. Sampling for primary production must be stratified across distinct risk categories based on operational complexity, such as indoor versus open-field livestock or crop production.

Categories F (trading, retail, and e-commerce) and G (transport and storage services) are permitted to use sampling, while Category E (catering) permits sampling only for re-heating facilities or locations with limited preparation like frying or re-heating. For these permitted categories, organizations with 20 sites or fewer must undergo audits at all sites without exception. For organizations with more than 20 sites, the minimum sample size is calculated as 20 plus the square root of the remaining sites, expressed mathematically as \(y = 20 + \sqrt\) rounded up to the nearest integer.

What to do now

• Audit the organizational structure of central functions to verify that FSMS authority is fully retained internally and not outsourced to external consultants under Clause 9.1.5.3.
• Verify that internal audit schedules cover 100% of network sites annually as mandated by Clause 9.1.5.5, maintaining full records prior to external certification audits.
• Review food chain classifications against Table A.1 to confirm whether multi-site operations fall into prohibited sampling categories such as Category C or Category D.
• Calculate site sample sizes using exact standard formulas under Clause 9.1.5.4, ensuring at least 25% random selection under Clause 9.1.5.7.
• Establish rapid nonconformity escalation pathways so that major site-level findings are corrected immediately before endangering the multi-site certificate under Clause 9.1.5.8.

Reference documents

• DS/EN ISO 22000:2018 Food safety management systems – Requirements for any organization in the food chain
• DS/ISO 22003-1:2022 Food safety – Part 1: Requirements for bodies providing audit and certification of food safety management systems
• DS/ISO 22003-2:2022 Food safety – Part 2: Requirements for bodies providing evaluation and certification of products, processes and services, including an audit of the food safety system