About Sterling · Trust centre
Sterling credentials: what you can check, and how to check it.
A consulting engagement means sharing your procedures, records and risks with people outside your organisation. This trust centre sets out Sterling credentials you can test for yourself, how to confirm any certificate with the body that issued it, and where Sterling's policies sit.
- Check, do not take on trustEvery credential on this page comes with a way for you to confirm it independently.
- Certificates confirmed at sourceThe certification body that issued a certificate is the one that can confirm it is valid.
- Policies in one placeThe privacy notice sits at /privacy/ and Sterling's other policies at /policies/.
- Client accounts on fileSigned client letters are available on request, with references in your sector.
Your information
Agree how your information is handled before you share it.
Building a management system means working with your real material: process maps, procedures, registers, internal audit results, supplier lists and, for information security or privacy work, details of your systems and the personal data you process. That material is sensitive whoever holds it, so the way it moves between your team and a consultant deserves the same care as any other supplier relationship.
Before you share anything confidential, agree with your Sterling consultant how documents will be exchanged, where working copies will be kept, who on the delivery team will see them and what happens to them when the engagement closes, and put that agreement in writing. Your own information security or privacy policy is a sensible starting point for that conversation.
- Share only what the current stage of the work needs, and keep a list of what has left your organisation.
- Use the channel your own policy approves for confidential files, not personal e-mail or messaging apps.
- Keep passwords, sensitive personal information and confidential files out of the website enquiry form; the form asks only for your goals and contact details.
Policies
Where Sterling's policies sit.
Two addresses on this site hold Sterling's policies. The privacy notice, which explains how personal data from website visits and enquiries is handled, sits at /privacy/. The other policies clients ask about during supplier due diligence sit at /policies/.
If your procurement or vendor-risk team needs a policy that is not at either address, or needs a signed copy for its supplier file, ask your Sterling consultant or write to hello@sterling-grc.com, and name the document and the questionnaire it is for.
- /privacy/: the privacy notice for website visitors and people who send an enquiry.
- /policies/: the other Sterling policies that supplier due diligence usually asks for.
- hello@sterling-grc.com: requests for a document that is not listed at either address.
Verify a certificate
Confirm any certificate with the body that issued it.
Sterling does not certify. Sterling's expert and experienced consultants help you build and run the management system; an accredited certification body carries out the certification audit, decides whether to certify and issues the certificate. That makes the certification body, not the consultant and not the certificate holder, the right source to confirm that a certificate is genuine and current.
The same check works for your own certificate, a certificate a supplier sends you and any certificate a consultant shows you. Read the certificate first: the certification body's name, the certificate number, the standard and its edition, the scope, the sites covered and the issue and expiry dates. Then confirm those details with the body directly, using contact details from its own website rather than from the document in front of you.
- Ask the certification body to confirm the certificate number, holder, scope, sites and status: valid, suspended or withdrawn.
- Check that the certification body is accredited for that standard and scope with the accreditation body whose mark appears on the certificate.
- Sterling Academy certificates are training certificates, not certification, and can be verified online.
Credentials
Sterling credentials you can test for yourself.
The figures on this page are the ones Sterling uses everywhere: 8,100+ client engagements in 60+ countries, offices in 21 countries, a group heritage in ISO implementation since 2003 and Effivity, the group's ISO and GRC software, used in 50+ countries. Behind them sit signed letters and e-mails from clients, kept on file.
The quickest test of any consultant is to speak to the people they have worked for. Ask for the original letters behind the accounts on this page, and for references from organisations in your own sector and on your own standard, before you decide.
- Signed client letters and e-mails, available on request, listed by standard on the client feedback wall.
- References from clients in your sector, on your standard and, where possible, in your country.
- The Sterling Promise, set out in writing, and the scope and timeline agreed in your proposal.
This page names a certification or accreditation only where Sterling can show you the certificate and you can confirm it with the issuing body. Sterling does not certify, accredit, attest or validate; for your certificate, an accredited body audits and decides.
Client experience
On the record: what clients say about working with Sterling.
The risk and compliance director reports that the assessment strengthened client-data handling, retention and third-party privacy controls, and that the recommendations suited a professional-services environment and were easy to prioritise.
The data protection officer writes that the team turned complex privacy requirements into workable processes for business, technology and compliance teams, with documentation that was detailed without becoming bureaucratic.
The operations director notes that the team understood both the compliance requirements and the company's day-to-day processing operations, and that the guidance and remediation plan improved how teams handle sensitive information across shifts and locations while strengthening compliance practice.
The managing director writes, on behalf of the whole organisation, that the guidance and support provided during its journey to ISO/IEC 27001:2022 certification were invaluable, and that the certificate is a direct result of that support.
Each account is drawn from a signed letter or e-mail on file and reported in our words, with the signatory's role and organisation attached; the original letters are available on request. Ask for references in your sector before you decide.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions clients ask before they share information.
Short answers on certificates, policies and client references.
Is Sterling a certification body?
No. Sterling helps you implement and maintain the management system. An accredited certification body carries out the certification audit, makes the certification decision and issues the certificate.
How can I check that a certificate is genuine?
Note the certification body, certificate number, scope, sites and dates, then ask that body to confirm them, using contact details from its own website. Check too that the body is accredited for that standard with the accreditation body shown on the certificate.
Where can I read Sterling's privacy notice and other policies?
The privacy notice sits at /privacy/ and the other policies at /policies/. For anything not listed there, write to hello@sterling-grc.com and name the document you need.
How should we share confidential documents during an engagement?
Agree the channel, storage, access and return or deletion of documents with your Sterling consultant before the work starts, record it in writing and share only what each stage needs.
Can we see the client letters behind the accounts on this page?
Yes. The original letters are available on request, and you can ask for references from clients in your sector and on your standard.
Keep exploring
More about Sterling
Talk to a consultant
Ask the questions your supplier review needs answered.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice