====== OCAP – Complexity ======

While there is //really// nothing that a company can do to alter its complexity (without major changes in how it operates), the remaining "Risk Factors" are completely in control of the business. However, if there are changes in your organization, you should immediately notify your CB (certainly prior to the next audit activity performed by your CB). The risk level for your organization should coincide with the criteria contained in the quadrant that best describes your organization.

<WRAP centeralign>**AS 9104/1A, Figure 2 - Organization complexity risk level**</WRAP>
{{ :articles:as9104-1a_organization_complexity_risk_level.png?direct&600 |AS91041A, "Figure 2 - Organization complexity risk level"}}

<WRAP center round info 80%>
The AS9104/1A, "//Figure 2 - Organization complexity risk level//" simply expands [[https://iaf.nu/en/iaf-documents-categories/|IAF MD5 Determination of Audit Time for QMS-EMS-OHS Audits]], "//Figure QMS 1 – Relationship between Complexity and Audit Time//" by adding "Risk Levels.
</WRAP>

[[https://iaf.nu/en/iaf-documents/?cat_id=7|IAF MD 1, "IAF Mandatory Document for the Audit and Certification of a Management System Operated by a Multi-Site Organization"]], defines a multi-site organization as:
<blockquote>IAF MD 1, sec. 2.4 Multi-site Organization \\ 
An organization covered by a single management system comprising an identified
central function (not necessarily the headquarters of the organization) at which
certain processes/activities are planned and controlled, and a number of sites
(permanent, temporary, or virtual) at which such processes/activities are fully or
partially carried out.</blockquote>

The remaining ambiguous descriptors (e.g., small vs. large, few vs. many) are left to the CBs to define. However, the CBs that I work with define a "large" organization as one having over 200 workers. If curious as to how your CB has made this determination, ask them.

{{page>wiki:pathforward}}