Multi-site certification, with sampling, is allowed only for the listed service sectors (trade, hotels and restaurants, transport and storage, employment and cleaning services, waste and pest control), under IAF MD 1 plus scheme rules: sites linked legally or by contract to a central function under one SMS; all sites audited at first, sampling only for low-risk sites with very similar activities; above 20 sites a minimum sample of twenty sites plus the square root of how many sites remain, rounded up, enlarged for risk factors and so that every site is seen within each cycle; new sites audited before being added; the central function audited every year before its sites, which follow within 12 months; one group certificate and no site certificates; one fully unannounced annual audit every three years. The central function holds the contract, is impartial from the sites, resources the system and closes site findings, and a failure anywhere stops certification for the whole group. A critical finding suspends the group within three working days, a major on an audit lasting over 28 days needs an action plan with interim controls, and closure clocks start when the last site audit ends.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.