Multi-Site ISO 27001 Certification ✓ Scope & Audit Sampling

When a company operates from London, Warsaw, Dubai and New York while its production environment lives in AWS or Azure, what exactly will an ISO 27001 auditor audit? I hear this often from groups preparing for multi-site ISO 27001 certification. The key point is simple: certification follows the ISMS and its defined boundaries, not just a list of addresses.

A multi-site model can work when locations operate under one management system with centralized governance, management review, internal audit and authority to correct problems across the group. Sampling may be used where sites perform substantially similar activities; it is not an automatic way to keep offices outside the audit. Certification bodies also apply ISO/IEC 27006-1:2024 requirements specific to ISMS certification.

How ISO 27001 audit sampling works

A certification body builds its sample to obtain a representative view of the ISMS. Some locations may be typical; others may receive attention because they are larger, higher-risk, newly acquired or responsible for critical functions. So, “we have 20 offices, therefore only headquarters will be checked” is not a safe assumption.

When I help teams define the ISO 27001 certification scope, I recommend mapping four things first:

legal entities included in the ISMS and the authority connecting them;
offices, operational locations and remote-work populations;
differences in services, technologies, risks and local obligations;
centralized functions such as IAM, SOC, HR, procurement and cloud administration.

This quickly shows which locations are genuinely comparable. If one entity develops software, another runs a 24/7 SOC and a third provides customer support with privileged access, auditors may treat them differently even when policies are shared.

Legal entities: one scope does not mean one company

Several legal entities can potentially sit within one ISMS, but the relationships and control model must be clear. Auditors will expect evidence that the central function can set requirements, monitor performance and drive corrective action across every entity included in scope.

Cloud is an operation, not an invisible site

Cloud-heavy groups often focus too much on physical offices. Cloud services are still part of the audited operating environment. ISO guidance on cloud-service auditing also emphasizes understanding responsibilities and interactions between cloud customers and providers.

For ISO 27001 audit sampling, expect evidence around identity and privileged access, configuration management, logging, backup, incident handling, supplier assurance and the shared-responsibility model. The auditor does not need to “visit AWS” to test whether your organization controls its side of the service.

My advice is to design the scope before designing the audit schedule. A clear scope statement, site/entity register and responsibility map can prevent expensive surprises later.

If you are planning multi-site ISO 27001 certification across several countries, legal entities or cloud environments, I can help structure the scope, prepare the sampling logic and coordinate certification with the System Management team. Contact me before the certification body fixes the audit plan — it is much easier to solve scope questions on paper than during Stage 1.