How should AOs apply the audit approach when sites are not responsible for all QMS activities?