Multi-Site GMP Certification: How Scope Is Defined
Scope is the sentence that decides what your certificate is worth. For a single-product, single-site operation it writes itself. For a group running three facilities across two emirates with product families that fall under different frameworks, multi-site GMP certification is the whole conversation.
- Multi-site and multi-product scopes handled as one coordinated programme
- Fixed written quotation, no later additions
- Named scheme and defined scope stated on every certificate
- Certification under IAS’s UQAS accreditation
Get it right and one document answers every buyer’s question. Get it wrong and you hold a certificate that generates more enquiries than it closes.
Running more than one site? Send IAS the list of facilities and what each one does — the scope structure is drafted before anything is planned. Talk to IAS UAE.
At a glance
- Every site is named. A certificate never quietly extends to a facility that was not assessed.
- Product families drive framework selection. Different frameworks usually mean separate scopes.
- Shared functions are assessed once. Central document control, training and management review serve every site.
- One certificate or several depends on whether one framework covers everything.
- Free zone and mainland facilities are separate addresses and are named separately.
The three structures, and when each fits
| Structure | When it fits | What the certificate looks like |
|---|---|---|
| Single certificate, multiple sites | All sites run comparable operations under one framework | One document naming every address and one scope statement |
| Single certificate, multiple product families | Several families sharing one framework at one site | One document with a scope listing each family |
| Separate certificates | Product families fall under materially different frameworks | Distinct documents, each naming its own framework and scope |
Most UAE groups approach multi-site GMP certification with a mixture: one certificate covering the sites doing similar work, and a separate one where a product family sits under a different framework entirely.
How multi-site GMP certification is actually assessed
A common misconception about multi-site GMP certification is that it means auditing headquarters and extending the result outward. It does not.
Each named site is assessed. What is assessed once are the functions genuinely operated centrally — document control, training administration, supplier approval, management review — where those functions really are central rather than nominally central.
The distinction matters. A group that has a central document register which each site then locally amends does not have central document control; it has three document systems and a spreadsheet. Assessors test this quickly, by comparing the register against what is actually at the workstations in each facility.
| Function | Assessed once if | Assessed per site if |
|---|---|---|
| Document control | One register, sites use it unmodified | Sites hold local variants |
| Training administration | One system, one competence standard | Each site trains its own way |
| Supplier approval | One approved list, applied everywhere | Sites approve their own suppliers |
| Internal audit programme | One programme covering every site | Each site audits itself in isolation |
| Management review | One review covering group performance | Separate reviews per facility |
| Production controls | Never | Always |
The right-hand column is not a failure. Plenty of groups genuinely run decentralised operations, and the scope simply reflects that. What causes difficulty is claiming central control that does not exist, because the assessment finds the gap between the claim and the practice.
Free zone, mainland, and why the certificate does not care
A facility in a free zone and one on the mainland are two addresses. Both are named on the certificate if both are assessed; neither is covered if it is not.
Multi-site GMP certification does not distinguish between them in the way local commercial arrangements do. What it records is what was assessed and where. A buyer reading the certificate wants to know whether the plant that made their goods appears on it — a question that has the same answer regardless of which jurisdiction the plant sits in.
The practical implication for UAE groups is that a facility acquired, opened or relocated needs bringing into scope explicitly. This is the most common gap in the region, precisely because expansion here is frequent.
Adding a facility this year? Scope it before it produces certified goods, not afterwards — request a quotation.
A worked example
A group operates three facilities: a Jebel Ali plant re-packing and labelling health supplements, a Sharjah facility formulating cosmetics, and a Dubai warehouse handling both plus third-party goods.
- What the scoping conversation establishes: three addresses, two product categories, one shared warehouse, centrally held document control and training, locally managed production.
- How it is structured: the supplements re-packing and the warehouse activity sit under one framework and can share a certificate naming both addresses. The cosmetics formulation falls under a different framework and takes its own certificate naming the Sharjah site.
- What is assessed once: the central document register, the training system and the group management review.
- What is assessed per site: everything physical — line clearance, segregation, storage conditions, records, equipment status.
- What the group receives: two certificates, each readable without explanation, and one coordinated audit programme rather than three unconnected ones.
What the certificate must not do
It must not imply coverage it does not have. Three failure modes recur.
Group name only
A certificate naming the parent company without listing sites invites a buyer to assume every facility is covered. If only two of four were assessed, that assumption is wrong and the certificate created it.
“And associated facilities”
Vague extensions of this kind are unhelpful. Either a site was assessed or it was not.
Product families listed loosely
“Health and beauty products” covers whatever the reader decides it covers. Naming the families removes the ambiguity.
Keeping a multi-site scope accurate
Groups change faster than certificates. A site opens, a line moves between facilities, a product family transfers, a warehouse is consolidated. Each of those changes what the certificate should say.
What keeps multi-site GMP certification aligned with a changing group is a group-level internal audit programme covering every site on a schedule, run by people trained to one method so that findings from Sharjah and Jebel Ali are comparable. Where auditors are trained differently by site, the group’s own data stops being comparable, which undermines the management review it feeds.
cGMP internal auditor training in the UAE covers that method, and the self-paced online cGMP internal auditor training suits groups training people across several sites without gathering them in one room. IAS also publishes a training schedule for the UAE for groups that would rather book a scheduled session.
What a buyer does with a group certificate
Understanding how the document gets used explains why the structure matters. A procurement analyst qualifying a supplier does four things with it, in this order.
They look for the address
Not the group name — the specific facility that will make or handle their goods. If that address is not printed on the certificate, the document has not answered their question, however impressive the rest of it looks.
They look for the product family
Then they check whether what they intend to buy falls inside the wording. “Health and beauty products” forces them to guess; a named family does not.
They check the framework
Whether it addresses the risks in what they are purchasing. A framework built around one product category tells them little about a different one.
They check the dates
Whether the certificate is still inside its cycle, and when the next surveillance falls.
| What the analyst checks | Passes when | Fails when |
|---|---|---|
| Facility address | The specific plant is named | Only the parent company appears |
| Product family | Their purchase is clearly inside scope | Wording is broad enough to require interpretation |
| Framework | It addresses their product’s risks | A single scheme is stretched across unlike categories |
| Validity | Cycle dates are current | Dates have passed or are absent |
Four checks, and a well-structured certificate passes all four without a phone call. This is the practical reason multi-site GMP certification is worth structuring carefully rather than settling quickly: the alternative is that every buyer runs the same four checks, fails one, and emails you.
There is a second-order effect worth noting. Groups whose certificates fail these checks tend to conclude that multi-site GMP certification did not help commercially. Usually the certification was fine and the scope structure was not.
Quick definitions
- Multi-site scope: a single certificate stretched across several assessed addresses in one group.
- Central function: a control genuinely operated once for every site.
- Local variant: a site-specific version of a supposedly central document.
- Scope extension: the assessment bringing a new site or family into an existing certificate.
- Product family: a group of products sharing process and framework.
- Sampling across sites: how assessment effort is distributed in a group.
- Comparable findings: findings graded to one standard across every site.
- Group management review: one review covering performance across all facilities.
Why UAE groups work with IAS
- Multi-site and multi-product scopes structured before any audit is planned.
- Central functions assessed once where they are genuinely central, and per site where they are not.
- Every address named on the certificate, so buyers can check the plant that made their goods.
- Fixed written quotation covering the coordinated programme, with no later additions.
- Internal auditor training available across sites, so group findings are graded to one standard.
Worth stating outright: IAS assesses management systems and provides training. Trade licensing and product authorisation are decisions taken by regulatory authorities, and no certificate stands in for either.
Multi-site GMP certification is scoped site by site, and that conversation begins by contacting IAS. The certification process page sets out how the programme runs, IAS accreditation explains what the certificate rests on, and the wider Emirates service list sits on the UAE service index.
Frequently Asked Questions
Can one certificate cover facilities in different emirates?
Yes, where each is assessed and named. The certificate records addresses and what was assessed at each; the emirate itself is not the deciding factor.
Do all our sites need auditing, or can you sample?
Each named site is assessed. What can be assessed once are genuinely central functions such as document control and training administration, where sites use them unmodified.
We have a central register but each site edits it. Is that central control?
No, and it will be found. Local editing means several document systems rather than one. It is workable — the scope simply reflects a decentralised structure — but claiming central control that does not exist creates a finding.
Our warehouse handles third-party goods as well as ours. Does that complicate scope?
It needs stating. Third-party handling is an activity, and whether it is inside or outside your scope should be explicit rather than inferred.
What happens when we open a fourth site?
It sits outside the certificate until a scope extension covers it. Tell IAS before it produces or handles certified goods, so there is no period where the certificate implies coverage it lacks.
Can product families be added without a full reassessment?
Often, through a scope extension, where the family falls under the framework already covered. A family under a different framework is closer to a new scope than an amendment.
Should we use one certification body across the whole group?
It makes coordination considerably easier — one audit programme, aligned surveillance dates, comparable findings. Groups split across bodies usually consolidate at recertification.
How is a relocated production line handled?
Moving between areas already in scope at a certified site is normally change control. Moving to a site not on the certificate is a scope question and needs assessment.
Does a leased facility get named like an owned one?
Yes. What matters is that it is under your control and was assessed, not the tenure arrangement.
How do we keep the certificate accurate as the group grows?
A group internal audit programme covering every site on a schedule, plus telling IAS about structural changes as they are planned rather than after they are complete.
Can a certificate name a site we plan to open next quarter?
No. Assessment precedes naming, so a facility appears on the certificate once it has been assessed, not once it is planned. What can be done in advance is scoping it, so the extension audit follows commissioning closely rather than months later.
Do our sites need identical systems to share a certificate?
Comparable rather than identical. What matters is that the shared controls genuinely are shared and that each site’s physical operation was assessed. Local variation in equipment is normal; local variation in the document register is what causes difficulty.