Sampling is allowed for categories A and B, with a minimum sample of the square root of the site count rounded up, taken per production-complexity risk group. It is allowed for categories F and G, and for reheating-type facilities only in category E; there, organisations with 20 or fewer sites have every site audited, and above 20 the minimum is twenty sites plus the rounded-up square root of the sites beyond twenty, at initial, surveillance and recertification. Sampling is not permitted in any other Annex A category.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.