Functions controlled by a head or corporate office (HR, payroll, policy, governance) are audited at every audit and included in the site's certification, separately and before the site audit (ideally within the month, at most 12 months before when one office serves several sites) if they cannot be seen at the site, with a separate uploaded report, at least half a day of audit time, and the site audit confirming local adoption; the office gets no certificate but is named on the site certificate with the processes audited. A process split over two nearby sites of one legal entity and SMS in the same country (or a campus) may be one audit with combined worker numbers and floor area; off-site stores and worker accommodation of the same entity are included with at least a quarter day each, while stores serving other customers need their own certificate. Locations and their activities appear on the certificate and findings are traceable per location.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.