Last week I introduced the concept of a matrix certificate, and I thought it could be useful if I explained the approach in a little more detail. Mostly the idea is self-explanatory, but it is worthwhile to keep one or two points in mind so they don't trip you up.
When ISO first introduced its management system standards, each certificate was tied to a specific location where specific work was done. So the certificate was printed with an address and a scope statement, as in the example to the left.*
But many organizations have more than one location, and often the processes are identical from one site to the next. There is not a lot of variety, for example, between this McDonald's and that one. So organizations began asking their Certifying Bodies** if there were any way to group multiple locations under a single certificate. Since the CB's, for their part, had to manage a lot of redundant information for all of these sites, they were keen to agree. And so CB's began to introduce the "matrix certificate."
A matrix certificate works just like a standalone certificate, except that the address and scope are replaced by a matrix: Site 1 does this kind of work, Site 2 does that kind of work, and so on. There is no requirement for a literal matrix on the certificate itself, so long as the information is there. A matrix is a convenient format when there is a large number of sites to consider. When there are only two or three, the CB might simply use paragraphs, as in the example to the right immediately below.***
The other place you see a genuine matrix is in the internal paperwork that supports the certification: at the CB, and at the organization itself. These internal matrices look something like the one that I show at the bottom of this post, and they correlate the information needed to manage the audit program. This starts by listing the sites and their scopes or functions, just like on the certificate. But then the internal matrix also tracks how many people work at each site. This is because there is a formula used by all the CB's to determine how many audit-days**** they have to schedule at each location. The formula uses both number of employees and type of work as inputs to the calculation: a big plant needs more audit-hours than a small plant, and manufacturing requires more attention than HR or sales. Finally, the matrix should track how long the audit cycle is for each site. Normally with a multi-site certificate, the company headquarters is audited every year; also, manufacturing is likely to be audited every year. The example I give below has one site for each of those functions. But then it also shows three sites that mostly do engineering or product design, that follow exactly the same procedures, and that are therefore more or less interchangeable. In order to reduce the overall audit costs (and to simplify scheduling), the CB has put each of these on a three-year cycle, so that they rotate. In any given year the CB plans audits in three locations; but over the three years before recertification, they visit all five sites.
On the whole, using a matrix certificate is a good way to control your certification expenses if you are in a situation where it works for you. But of course there are risks. The main risk is that one of the critical entries in your matrix will change: for example, you might have heavy layoffs at one site, or (conversely) hire a whole new department. Either way, you have to make sure to report the change to your CB in a timely way, so that they can recalculate your audit days. One way or another, this might change your plans for the year.
Or you might move functions from one site to another. Since each function makes its own contribution to the calculation of audit days, this move might make a difference to the result even if the number of employees involved is not high. A specialized technical function, for example, might employ only a few people; but it might require a lot of Quality equipment to make sure it operates correctly, and in some cases all that infrastructure might have to be audited.
Finally, there is a risk that two different sites are supposed to be doing the same work according to the same procedures, but one site decides to implement local improvements without telling the other. I have seen this happen, where an organization had two Distribution Centers. One was more or less a glorified shipping dock at the far end of a building that did a lot of other work; the other was a pure Distribution Center with no other functions. Back when the organization first codified their written procedures, someone wrote a single set of logistics documents and told both organizations to use them. But in the intervening years, the Site Manager of the standalone Distribution Center brought in a lot of equipment to modernize his operations. It was exciting to visit, because every time I arrived they had improved something new. But somehow the word never got back to the first operation. I had workers from that one tell me with a straight face, "We have exactly the same procedures they have there," when there was no longer anything in common. And I had to explain, "No you don't. And at the very least your documentation has to be updated to reflect that reality."
Note that when changes like this take place, it can undermine the logic behind a matrix certification. The justification for auditing Site 3 in place of Site 4 and Site 5 is that they follow the same procedures in all three sites so you'll see the same evidence anyway. Once that is no longer true, it is harder to keep down the number of audits.
It is also true that breakthrough improvements on such a scale are mostly the exception rather than the rule. And if there is a chance for your organization to make breakthrough improvements, having to replan your audit program is a small price to pay!
__________
* I found this illustration online by searching for "sample iso 9001 certificate." I have no professional, personal, or financial connection to the organization in question.
** A Certifying Body (CB) is the registrar that send out your external auditor, manages the audit paperwork, and issues your certificate. There are lots of CB's in the world. If you look at the certificates that I posted above as examples, the first is from TÜV SÜD, and the second is from DEKRA. These are both well-known CB's. Just by coincidence, I have never worked with either one.
*** Again, I found this illustration by searching online and have no connection with the company.
**** One audit-day means one full day of auditing by one auditor. So four audit-days might mean one auditor for four days, or two auditors for two days, or one auditor for three days plus another who joins him for only one of those days, or any other combination that adds up to four.









