Apply consistent ISO criteria across sites while allowing for different operations, legal contexts, process maturity and evidence populations.
Headquarters may present one management system gap score for six sites, but the number can conceal very different realities. One site runs a highly automated process, another relies on temporary labour and a third works under distinct permit conditions. A common standard and corporate procedure do not make these operating environments interchangeable. Multi site gap reviews need both consistent criteria and locally representative evidence, plus a defensible account of what is actually controlled centrally.
01Set a common assessment framework without flattening context
Consistent assessment means using the same applicable criteria, definitions and evidence expectations where relevant. It does not mean every location has identical hazards, products, regulatory duties or service interfaces. Corporate templates may be common while local risks and performance differ.
Prepare a scope matrix showing each site’s activities, shifts, outsourced interfaces, legal context and centrally controlled processes. Define legitimate local differences before collecting scores, then explain how they affect the assessment test.
Decision test: Ask what record would contradict this statement.
02Separate central design from local execution
Headquarters may approve procurement policy, but a local receiving team determines whether goods are actually accepted correctly. A central IT rule may be consistent while local system permissions and offline workarounds differ. Assessing policy ownership alone can overlook implementation.
Test one or more real transactions at the central control point and at each relevant operating site. Identify which approvals, records and escalation decisions are corporate versus local. A site score should not inherit conformity from headquarters by default.
03Choose samples that reflect meaningful variation
Identical sample counts are not necessarily comparable. A busy manufacturing site with three shifts, contractors and frequent changes creates a different sampling challenge from a small sales office. Risk based sampling should reflect variation and the consequence of failure, not simply the number of employees.
Record the population, location, period, shifts, process variants and adverse events represented. Where travel or remote access constrains sampling, state the limitation clearly. The report must not imply universal coverage from one scripted demonstration.
04Assess outsourced and shared services explicitly
A shared service centre may process supplier approval, payroll, calibration records or complaints for many locations. Weak governance at the shared interface can affect every site, while a site level exception can evade an otherwise sound common system.
Trace a transaction through both sides of the handoff. Verify service responsibilities, information accuracy, exception authority and monitoring. Differentiate a shared systemic cause from isolated local deviations when allocating corrective actions.
Operating test: Check the latest routine case and one abnormal event.
Decision Matrix: Evidence and Consequence
Use this comparative matrix as an editorial decision aid, not an automatic severity rule. Select and adapt the criteria for the organization’s real processes and obligations.
| Assessment layer | What is reviewed | Evidence boundary |
|---|---|---|
| Corporate | Policies and common platforms | Central decisions and controls |
| Site | Local activities and exceptions | Shifts, work types and records |
| Shared services | Handoffs and service levels | Transactions across interfaces |
| Group summary | Common causes and material outliers | Disclosed scope and limitations |
05Compare maturity without inventing comparability
A five point maturity score is tempting for executive dashboards, but “3 of 5” may mean different things if evidence populations, criteria or assessors differ. Summed percentages can hide a material failure at one site behind strong performance elsewhere.
Use consistent rating definitions anchored in operating evidence and show high consequence exceptions separately. Calibrate assessors on common sample cases before finalizing comparisons. State when insufficient evidence prevents a defensible ranking.
06Assign action at the correct governance level
Some gaps require corporate changes to master data, investment or decision rights. Others need local competence, equipment maintenance or monitoring. A centrally assigned action can remain incomplete at the sites if verification stops at policy approval.
Use a two level ownership record: Central design owner and local operating owner. Define evidence gates for rollout and specify who authorizes exceptions. Verify later performance at a representative set of affected sites.
07Decide whether one conclusion really covers all sites
A company wide conclusion should identify its boundaries. It may be reasonable for a uniform shared process, but not for local controls with different products, personnel or regulatory conditions. Multi site certification arrangements introduce separate accreditation criteria beyond an internal gap review.
Produce a site by site annex with sampled activities, limitations, significant findings and shared cause analysis. Escalate legal or certification scope questions to qualified specialists; do not claim that every site is automatically covered by a central audit.
Closure check: Confirm the result in subsequent normal work.
Practical Decision Method: Applying the Assessment
Calibrate the assessors before comparing sites
Issue a short case containing an observed transaction, central policy and conflicting local practice to all reviewers. Compare not only their ratings but also the facts each considers sufficient. Resolve differences in criteria interpretation, sampling depth and classification before collecting production scores. This effort improves comparability without pretending that different site conditions have the same risk.
Construct a corporate: Local decision matrix
For each significant control, specify whether the central function designs the rule, grants systems access, monitors compliance or accepts exceptions, then specify who performs and verifies it at the site. Audit a handoff that crosses the boundary. Without this distinction, central functions may close a gap when a revised policy is issued while operations continue under an incompatible local workflow.
Use a proportionate site annex
A concise annex should show the site’s activities, distinctive obligations, representative samples, material exceptions and conclusions that cannot be generalized. Group level reporting then distinguishes shared cause corrections from local actions. When only selected sites were assessed, explicitly state that limitation; do not let corporate graphics imply every plant or location has been independently evaluated.
Management Questions That Turn Analysis into Action
The executive team should begin with this question: What evidence would show that the proposed response to how iso gap reviews differ across multiple sites has altered a real business decision? Ask which current records support the judgement, what is still uncertain and which qualified owner can authorize the next step. An effective discussion distinguishes a constraint created by an applicable obligation from a discretionary business improvement.
Before reporting closure, use the next representative operating event to verify the selected method. Revisit the assumptions captured during assess outsourced and shared services explicitly; if observations contradict them, reopen the decision. A carefully bounded finding and a recorded improvement test are more valuable than apparent certainty supported only by a completed checklist.
Illustrative Case: From Observation to Decision
Illustrative case: A logistics group reports centralized control of subcontractor onboarding. Interviews in head office describe a mandatory competence check, while samples at two depots reveal temporary dispatch accounts activated before approval. The group records one shared access design issue and two local execution weaknesses, applies interim restrictions, and verifies corrective results at several depots rather than only updating the corporate process.
Closing Perspective: A Decision That Can Be Tested
The central purpose of how iso gap reviews differ across multiple sites is a better controlled management decision. Define the claim, identify the operating evidence and specify the consequences of being wrong. An ISO management system becomes valuable when its controls influence normal work, not merely when the corresponding documents have been approved.
A practical next step is to select one material issue, trace the original observation and review the last live transaction with its accountable process owner. Record the decision, any residual exposure and the next effectiveness check. That traceability gives executives a basis for learning and improvement beyond the reporting date.
Related implementation resources
Editable tools for organizing controls, evidence, findings and improvement actions relevant to this assessment topic.