Last summer, in the middle of a podcast about something else, Kyle Chambers raised a question: how is it possible to certify a really big company to a standard like ISO 9001? His point was that really big companies have so many parts that they can't all play together. (I mention the podcast in this post here.) Kyle might have meant the question rhetorically, but of course he is right. If you have scores of locations spread across multiple continents—engaged in dozens of lines of work—how can you possibly coordinate them all into a single management system? How can you possibly certify anything so complex?
You can't. So you break it in pieces.
More exactly, you divide your really big company into sub-units of a useful size, and then make each sub-unit responsible for its own certification. Then in your sales and marketing literature you speak of the company as a unified whole, announce that "Conglomerated Enterprises has been proudly certified to ISO 9001 since ...," and follow with the date of the first certificate that came through.
How big is "a useful size"? It really depends. I've seen it done several ways.
In general, there are two competing pressures at play in determining the right size for an entity to serve as the scope of certification.
- On the one hand, you don't want the scope too narrow, or you'll have to pay for too many audits. In other words, if three offices that are all in the same city all do exactly the same kind of work, you can save some money by letting them share a certificate. You pay for less overhead at the Certifying Body, and you pay for fewer audits (because all three offices are doing the exact same thing). This all looks good on a balance sheet.
- On the other hand, you don't want the scope too broad, because there's always the risk that someone goes crazy one day. If you have a hundred locations all sharing the same certificate, and someone in a tiny office way out in Far Foodle starts violating an important policy, the next auditor might rate it as a Major Nonconformity. Then that Major might put the certificate at risk for all hundred locations!
Where you draw the line while balancing these two imperatives depends a lot on your organizational culture. I've worked for one multi-site operation whose corporate ethos was entrepreneurial, and who had created a number of sites by acquisition. So there was a distinct chance that two sites might not be on the same page. For that company, each site was strictly responsible for its own certifications. The company had a blanket contract with a CB, because they got a volume discount. But inside that blanket contract, we were on our own. I made the arrangements for my location, but not for the others; I worked with the auditor and tracked the findings for my location, but not for the others. We never had a crisis where one location risked losing certification, but the company's management took no chances.
But then later I worked for another company that bundled eight sites across the United States all into one certificate. We supported the same product line, and we were all in the same geographic region. So the company decided that was enough commonality that it made sense for us to share a certificate, and we could sink or swim together. I made the arrangements for eight locations, tracked findings for eight locations, and flew around the country a fair bit to support audits when they happened.
This meant I carried out eight internal audits a year, but not nearly so many external audits. We had a "matrix certificate," which meant that the CB did a sampling every year: they always audited headquarters, and they always audited our one factory, but then they would pick one or two other sites randomly and leave it at that. Over the years, of course, they ended up visiting every site; but every spring I had a long discussion with their scheduler to agree where they should go.
"You visited A last year, and you visited B the year before, but you've never audited C. How about seeing them this year?"
"Wait, we've never been to C? What do you even do at that site?"
"It's basically the same work as B, so I don't expect any significant findings. But you haven't been there yet, so it might be good to visit."
"Sure, I guess. How many people work there ...?"
As long as the processes and systems really are common across locations, this can be a useful way to proceed. Next week I'll say a little more about how matrix certificates work.











