Implementing SPK CSMS1000:2026 in Multinational Organisations

Quick Read

SPK CSMS1000:2026 implementation in multinational organisations requires careful upfront decisions on scope—whether to certify the entire group, only material entities, or individual subsidiaries—and a comprehensive obligations register that captures all mandatory reporting requirements and applicable laws across each jurisdiction where the group operates. Governance architecture and control mechanisms must be designed to function across complex structures with varying levels of CSMS maturity, and existing ISO certifications can be leveraged across subsidiaries to streamline the engagement. The standard treats CSMS as a whole-of-programme requirement, meaning scope definition, jurisdictional obligations mapping, and group-wide governance alignment are critical prerequisites to successful multinational certification.

Executive Summary

SPK CSMS1000:2026 is a whole-of-programme standard. For a single-entity organisation with operations in one country, implementation is relatively straightforward. For a multinational group with subsidiaries across dozens of jurisdictions, different governance structures, varying levels of CSMS maturity, and different sustainability obligations in different markets — implementation requires careful thinking about scope, governance architecture, and how the standard's requirements are applied across a complex organisational structure.

This paper addresses the implementation questions that are specific to complex organisations: how to define scope, how to build a group-wide governance architecture, how to manage obligations that differ by jurisdiction, how to leverage existing ISO certifications across different subsidiaries, and how to structure the Speeki Meridian™ engagement for a multinational group.

The standard's requirements are the same for every organisation in scope. What differs for multinationals is how those requirements are implemented across a complex structure — and who is accountable for what.

1. Defining the Scope

The most important early decision for a multinational implementing SPK CSMS1000:2026 is scope definition: which entities, geographies, and operations are included in the CSMS scope, and which are excluded.

1.1 Entity scope options

Group-wide scope: the CSMS covers all legal entities within the group. The certificate is issued in the name of the parent company with a scope statement that includes all covered entities. This is the most comprehensive approach but also the most demanding — governance, controls, and review mechanisms must function across all entities.

Partial scope — material entities: the CSMS covers entities that account for a substantial majority of the group's material sustainability footprint — typically entities that account for 80% or more of revenue, employees, or material emissions. Excluded entities must be documented with the justification for exclusion and cannot be excluded because they have poor CSMS maturity.

Entity-specific scope: individual subsidiaries seek certification separately, each with their own scope and certificate. Appropriate for groups where subsidiaries operate under materially different governance structures or where the parent company does not have operational oversight of subsidiary sustainability management.

1.2 Jurisdictional scope — the obligations challenge

The obligations register (Clause 6.1) must cover all jurisdictions of material operation. For a multinational, this means: all mandatory reporting obligations in each jurisdiction (CSRD for EU subsidiaries, SGX for Singapore-listed entities, HKEX for Hong Kong-listed entities, and so on); all applicable environmental, labour, and human rights laws by jurisdiction; and all supply chain due diligence obligations applicable to the group or its entities.

The obligations will differ by jurisdiction, and the applicable materiality type may differ as a result. A group with a large EU subsidiary subject to CSRD will have double materiality obligations for that subsidiary, even if the parent company is not directly subject to CSRD. The CSMS must accommodate this variation.

2. Group Governance Architecture

Implementing SPK CSMS1000:2026 in a multinational requires a governance architecture that defines the relationship between group-level sustainability governance and entity-level sustainability governance.

The group-level CSMS sets the framework: the sustainability policy, the obligations register, the materiality determination methodology, the controls framework requirements, and the objectives. It also provides the group-level governance structure: the group CSO, the group governing body sustainability oversight, the group-level management review.

Entity-level CSMS implementation adapts the framework to local context: local obligations are incorporated into the group obligations register; local material topics are assessed within the group IRO methodology; local controls are implemented within the group controls framework requirements; and local management reviews feed into the group management review.

The direct access mechanism (Clause 7.5) must operate at both levels: the group sustainability function has direct access to the group governing body; the local sustainability function has direct access to the local governing body or equivalent. Where subsidiaries do not have separate governing bodies, the group governing body fulfils this function.

3. Managing Existing ISO Certifications Across the Group

Multinational groups frequently have ISO certifications across different entities — ISO 14001 in manufacturing operations, ISO 45001 across the industrial division, ISO 37001 at group level. These certifications reduce the SPK CSMS1000:2026 assessment scope for the relevant clauses — but only for the entities where the ISO certification applies.

A practical approach: map all existing ISO certifications across the group by entity and by standard. Identify which clauses of SPK CSMS1000:2026 each certification addresses. Build a scope reduction matrix that shows which clauses are credited for which entities. The Speeki assessment team will validate this matrix and confirm the scope reduction before Stage 2.

4. Structuring the Speeki Meridian™ Engagement

For multinational groups, the Speeki Meridian™ assessment requires careful planning to ensure all material entities receive appropriate coverage within a manageable assessment programme.

The Stage 2 assessment typically covers the group headquarters (for governance, group-level controls, and management review mechanisms) and a selection of material subsidiary locations (for operational controls, local governance, and local management reviews). The selection of subsidiary locations is risk-based: higher-risk operations, larger footprint entities, and subsidiaries where the assessment team has identified Stage 1 concerns receive priority.

Assessment findings at subsidiary level that reflect a systemic failure of the group-level framework — rather than a local implementation gap — are typically classified as group-level non-conformities. Assessment findings that reflect local implementation gaps — a specific site that has not implemented the group environmental procedure — are typically local non-conformities. Both must be addressed through the corrective action process.

Speeki Meridian™ — Auditor Expectations

For multinational Speeki Meridian™ engagements, the scope document is particularly important. Assessors will scrutinise scope boundaries carefully — particularly exclusions of entities that appear to have material sustainability footprints. Assessors will also test whether the group governance framework actually reaches subsidiary level: does the subsidiary governing body receive sustainability information? Does the subsidiary management review connect to the group management review? Is the direct access mechanism operational at entity level as well as group level? For groups with extensive ISO certification across subsidiaries, assessors will verify that each cited ISO certificate is current, covers the relevant scope, and has been maintained through recent surveillance visits. ISO credit cannot be claimed for certificates that are expired or that cover a materially different scope.

About Speeki

Speeki is an accredited certification body operating across more than 100 countries. Speeki certifies organisations against SPK CSMS1000:2026 through the Speeki Meridian™ certification programme. Speeki is a certification body — it does not provide sustainability consulting or advisory services of any kind.

For current details of Speeki's accreditations, scope of certification, and service offerings, visit speeki.com. You can also ask Nicole AI on the Speeki website to find the information you need.