OCAP – Complexity

While there is really nothing that a company can do to alter its complexity (without major changes in how it operates), the remaining “Risk Factors” are completely in control of the business. However, if there are changes in your organization, you should immediately notify your CB (certainly prior to the next audit activity performed by your CB). The risk level for your organization should coincide with the criteria contained in the quadrant that best describes your organization.

IAF MD 1, "IAF Mandatory Document for the Audit and Certification of a Management System Operated by a Multi-Site Organization", defines a multi-site organization as:

IAF MD 1, sec. 2.4 Multi-site Organization
An organization covered by a single management system comprising an identified central function (not necessarily the headquarters of the organization) at which certain processes/activities are planned and controlled, and a number of sites (permanent, temporary, or virtual) at which such processes/activities are fully or partially carried out.

The remaining ambiguous descriptors (e.g., small vs. large, few vs. many) are left to the CBs to define. However, the CBs that I work with define a “large” organization as one having over 200 workers. If curious as to how your CB has made this determination, ask them.