Standardize anything that produces evidence; let the local site decide how the work gets done.
Corrective action has to look identical everywhere. Same form, same fields, same severity definitions, same closure criteria. If two sites classify findings differently, you can't compare them, and your corporate view of risk becomes fiction. Same for document control and records retention. Those are the interfaces where drift destroys your ability to see anything.
What I let vary is method. A site with different equipment, a different workforce, or a different regulatory environment will need a different work instruction, and forcing one version on everybody produces a document nobody follows. California facilities have reporting obligations that don't exist in other states, so the local procedure has to differ.
The big test, though, is if the difference is visible to a customer or an auditor as an inconsistency, standardize it. If it's just how the work happens locally, leave it alone and audit the outcome instead of the method.
What prevents drift is that the standardized parts get audited against each other. I compare corrective action closure times across sites, and outliers tell me where a system is decorative. Local flexibility doesn't cause drift. Unmeasured local flexibility does.