Multi-site certification — the central function and internal auditors
Plain-language summary
For multi-site organisations (BIII, E, F, G): a resourced central function, an annual internal audit programme covering every site, and internal auditors who meet defined experience, education and training criteria.
What the clause is really asking
When several sites sit on one certificate, the scheme relies on your internal audits to cover what the certification body only samples. The central function must provide sufficient resources and define roles for management, internal auditors, the technical reviewers of internal audits and other key FSMS personnel. It must establish an internal audit procedure and programme covering the management system, the central function and all sites at least annually or more often on risk, with auditors assigned centrally and independent of the areas they audit, and with the effectiveness of corrective actions demonstrated. Internal auditors must meet minimum criteria assessed by the CB every year: two years' full-time food-industry experience including one in the organisation; a higher-education course or five years' relevant experience; and training — a 40-hour FSMS, QMS or FSSC 22000 lead auditor course for the internal lead auditor, a 16-hour internal auditor course for the other team members, and at least 8 hours of scheme training covering ISO 22000, the sector ISO 22002-x standard and the additional requirements. Audit reports get an impartial technical review, and auditors and reviewers are performance-monitored and calibrated annually.
What auditors look for
Auditors examine the central function's audit programme against the site list, pull the internal auditors' competence files and check the course hours, and read a sample of internal audit reports for the technical review sign-off and the evidence that corrective actions worked.
Typical evidence
Central function roles and resources; internal audit procedure and programme covering every site annually; auditor independence assignments; auditor competence files (experience, education, 40 h / 16 h / 8 h training); technical review records; annual performance monitoring and calibration records; corrective action effectiveness evidence
How to comply — recommendations
Keep one competence file per internal auditor with the hours evidenced by certificates, and a calibration session each year where auditors grade the same evidence. Plan the programme from the site list so nobody is missed, and make the technical review a signed step before a report is issued.
Common nonconformities
A site not audited in the year; auditors auditing their own site; auditors without the required course hours; no technical review of reports; corrective action closed without evidence of effectiveness
Related clauses
ISO 22000 9.2 (internal audit), 7.2 (competence), 5.3 (roles); ISO 19011 (auditing guidance)
Get the free ISO 9001:2026 Readiness Scorecard
Free, instant download. We'll only email you the occasional practical quality update — no spam, unsubscribe anytime.
Qlause provides interpretive guidance only and is not a substitute for the standard. Refer to your licensed copy of the relevant standard for the authoritative text.