Logistics and supply chain · ISO and GRC consulting
ISO certification for logistics and supply chain, built around how your freight actually moves.
Shippers, tender panels and customs programmes want proof that your warehouses, fleets and forwarding desks run under control. Sterling's expert and experienced consultants build one system across your depots, lanes and subcontracted hauliers, with the records an auditor tests kept as the work happens. We ensure successful certification for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced consultants who know cross-docks, cold rooms, yards and dispatch offices, implementing management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
- Pass shipper onboardingAnswer the supplier questionnaire with certificates and records, not promises.
- Qualify for the tenderMeet the certification lines that decide who is shortlisted for a contract.
- One system, every depotThe same procedures and evidence at the hub, the satellite warehouse and the yard.
- Control what you subcontractHauliers, agents and warehouses approved, monitored and reviewed on evidence.
What logistics and supply chain is asked for
Which ISO standards do logistics and supply chain businesses need?
Most forwarders, carriers and contract warehouses start with ISO 9001, because it is the line a shipper's supplier approval asks about first, then add ISO 14001 and ISO 45001 into the same system. ISO 28000 follows when customers or customs programmes ask how cargo is secured. What you handle decides the rest: GDP for medicines, BRCGS or ISO 22000 for food, ISO 39001 where your own vehicles are on the road.
Why now
Why shippers, customs and tender panels are asking logistics providers for certification.
The request rarely arrives as a strategy. It arrives as a questionnaire, a contract clause or a lost bid. These are the six places it usually comes from.
- Shippers qualifying their carriersManufacturers and retailers that outsource storage and transport expect their logistics partners to show a working quality system, and increasingly an environmental and safety one, before volumes move.
- Tenders with certification linesContract logistics and freight tenders often score or screen on ISO 9001, ISO 14001 and ISO 45001; a missing certificate can end the bid before price is read.
- Customs and security programmesAEO authorisation, granted by customs authorities, and C-TPAT, run by U.S. Customs and Border Protection, look at how you secure cargo. ISO 28000 gives that work a managed structure; it does not grant the status.
- Claims and cargo lossAfter a theft, a damaged consignment or a temperature excursion, the shipper and your own insurer ask what controls were in place and whether anyone checked they were working.
- Group and network requirementsForwarders in international networks and subsidiaries of global groups are often told to align with the parent's certified system by a set date.
- Incidents on the road and the dockA crash, a forklift injury or a spill turns safety and environmental management from a policy into a question the board, the customer and the authorities all ask at once.
Scope and evidence
What auditors look for in a logistics operation.
A certification auditor follows the goods: from booking and receipt through storage, picking, loading and delivery, and into the contracts with the people you hand the work to. These are the areas where logistics systems are tested hardest.
| Requirement area | What it looks like in logistics and supply chain | Evidence auditors ask for |
|---|---|---|
| Scope, sites and services | Which warehouses, cross-docks, depots and lanes the certificate covers, and which services: storage, transport, forwarding, customs brokerage | A scope statement, a site and service list, and the outsourced activities named and justified |
| Subcontracted hauliers, agents and warehouses | Much of the physical work is done by partners: owner-drivers, overseas agents, bonded warehouses, last-mile couriers | Approval criteria, contracts or quality agreements, performance reviews and the action taken when a partner fails |
| Receipt, storage and dispatch | Goods checked in, located, rotated, picked and loaded as the customer specified, with shortages and damage recorded | Receipt and dispatch records, stock accuracy checks, damage and claims logs, and corrective actions that closed the cause |
| Cargo, access and information security | Who can enter the yard, who knows what is in which trailer, how seals and keys are controlled | A security risk assessment, access and seal records, security plans with exercise records, and incident reports |
| Drivers, vehicles and warehouse safety | Driving hours, journey planning, vehicle checks, forklifts, racking and loading bays, for your own staff, agency workers and contractors | Driver competence records, vehicle inspection history, hazard assessments, crash and injury investigations with actions |
| Environment and regulated goods | Fuel, emissions, refrigerant and spill risks; temperature control for medicines and food where you carry them | An aspects register, compliance obligations, fuel data, storage mapping and logger records, excursion handling |
The rows are typical of a logistics operation, not a list of clauses; the certification body sets its own audit plan. GDP is inspected by the competent authority rather than certified, and BRCGS certificates are issued only by BRCGS-approved certification bodies.
The engagement
What happens between the first call and the certificate.
Most logistics clients begin with ISO 9001, often built together with ISO 14001 and ISO 45001 as one integrated system. The same six steps apply when ISO 28000, ISO 39001 or a food or medicines scheme is added.
- 01Define what the certificate needs to cover.Confirm activities, sites, headcount, customer expectations and the intended certification scope.
- 02Gap analysis: review the current system against the requirements.The gap analysis identifies what is missing, preserves effective practice and agrees actions, owners, dates and resources.
- 03Implement and collect meaningful evidence.Put controls into use, train the relevant people and keep the records that show how the system operates.
- 04Audit, review and address the findings.Internal audit and management review evaluate implementation; findings are raised by us first and closed with evidence.
- 05Complete the independent assessment.The certification body's Stage 1 readiness review, then the Stage 2 audit; respond to any findings and await its decision.
- 06Maintain the system after certification.Monitoring, internal audits, reviews and improvement continue, alongside the body's surveillance audits and three-yearly recertification.
What you receive
Everything a working, certifiable system needs. Nothing to source separately.
- Scope and gap analysis reportThe scope of the certificate and every shortfall against the standard, with an owner and a date.
- Implementation planMilestones, responsibilities, the weekly session calendar and the target audit window.
- The documented management systemPolicies, processes, procedures, forms and records on Sterling's template sets, tailored to your operation.
- Effivity workspace, configuredDocuments, registers, audits, actions, training records and management review in one place, included at no additional cost.
- Trained peopleAwareness e-learning for everyone, practitioner courses for the people who run the system, internal auditor training for your audit team, as applicable to your standard, with Certificates of Completion.
- Internal audit and management reviewProgramme, checklists, report, corrective actions closed with evidence, and a management review record with decisions.
- Certification readinessCertification bodies compared and their accreditation checked, Stage 1 and Stage 2 preparation, and support until the certificate is issued.
- The Sustain™ calendarThe year after certification planned: surveillance dates, internal audits, refreshers, new-hire training and any transition to a revised edition.
Effivity · included with the engagement
Your system runs in software from the first workshop.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures it within the agreed scope, so evidence accumulates as people do their work and the certification auditor reviews a live system rather than a binder. Sterling consulting clients get their subscription included with the engagement, at no additional cost.
ISO & GRC softwareSterling Academy · included with the engagement
Your people learn the standard, not just the forms.
E-learning with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online, with progress by department for the certification audit. Sterling consulting clients get preferential course access and special pricing, including complimentary awareness training for their people as part of the engagement.
Contact us about Academy accessStandards
Standards for Logistics and supply chain
- ISO 9001ISO 9001 certification consulting: a quality management system built with your people, evidence prepared and support until an accredited body certifies you.
- ISO 14001ISO 14001 certification consulting: aspects, impacts and compliance obligations controlled, with support until an accredited body certifies you.
- ISO 45001ISO 45001 certification consulting to prevent work-related injury and ill health, with an OH&S system built with your people and audit-ready, in 60+ countries.
- ISO 28000ISO 28000 certification consulting: security risks assessed and treated from suppliers to customers, with plans and controls ready for an accredited audit.
- ISO/IEC 27001ISO/IEC 27001 certification consulting: an ISMS built with your people, evidence prepared, and support through Stage 1, Stage 2 and surveillance audits.
- GDPGDP compliance consulting for medicine wholesalers, 3PLs and carriers: quality kept from dock to pharmacy, every batch traceable, ready for inspection.
- ISO 22000ISO 22000 certification consulting: PRPs, a validated hazard control plan, traceability and recall readiness, built with your teams for an accredited audit.
- AEOAuthorised Economic Operator (AEO) readiness: what customs examines, who can apply and how Sterling prepares your controls and evidence for the customs visit.
Logistics and supply chain client experience
On the record: what logistics and supply chain clients say about working with Sterling.
The ISO project manager writes that every project milestone was met within the agreed timeframe and to the stated objectives, and that the team's expertise, meticulous planning and collaborative approach were instrumental in a smooth and efficient implementation.
The operations manager reports that implementation gave the company a more structured approach to its inspection activities, with better process consistency, documentation control and operational effectiveness, and a clear framework for competence management and continual improvement.
Each account is drawn from a signed letter or e-mail on file and reported in our words, with the signatory's role and organisation attached; the original letters are available on request. Ask for references in your sector before you decide.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions logistics and supply chain clients ask before they engage us.
The specific answers for your organisation come from the discovery call. These are the general ones.
Which ISO certification should a logistics company get first?
For most forwarders, carriers and warehouse operators it is ISO 9001, because it is the certificate shippers and tender panels ask for first. First-time implementers now build to ISO 9001:2026. If your customers already ask about environment and safety, building ISO 14001 and ISO 45001 into the same system from the start costs less effort than adding them one by one later, and the discovery call is where we test which order suits your contracts.
Will ISO 28000 get our shipments through customs faster?
Not on its own. AEO status is an authorisation granted by a customs authority, and C-TPAT is a voluntary partnership programme run by U.S. Customs and Border Protection; each has its own application and review. ISO 28000 is a certifiable security management system that organises the risk assessment, controls, security plans and records those programmes look at, so the evidence exists in one place when you apply. TAPA FSR and TSR are audited on their own route, by TAPA-approved independent audit bodies.
We store and move medicines. Can we be GDP certified?
There is no certification-body route for GDP. The competent authority grants the wholesale distribution authorisation and inspects; in the EU it then issues a GDP certificate or a statement of non-compliance, entered in EudraGMDP. If you are a 3PL or carrier working for a distributor, your customer must assess and audit you under a written contract. Air cargo handlers may also be asked for IATA CEIV Pharma, which is assessed against IATA's own checklist.
Can one certificate cover all our warehouses and depots?
Yes, a single certificate can list several sites, provided they run under the same management system. The certification body decides how many sites it visits and whether sampling is possible; a cold store, a bonded warehouse or a site with different activities is likely to be audited in its own right. We design the scope and the site list with that decision in mind, so the audit plan holds no surprises.
Most of our drivers are subcontracted. Are they inside the system?
They are inside it to the extent that the work is under your control or influence. ISO 9001 expects you to control externally provided processes, ISO 45001 covers workers doing work under your control, including agency staff and contractors, and ISO 39001 requires you to separate what you control on the road from what you can only influence. In practice that means approval criteria, contract terms, briefings and performance reviews for every haulier.
We store food for retailers. BRCGS or ISO 22000?
Start from your customers' supplier specifications, because they decide. BRCGS Storage and Distribution, Issue 4, is GFSI-recognised, offers storage, distribution or transport-only scopes and includes an unannounced audit at least once every three years. ISO 22000 applies to organisations in the food chain, storage and transport included, and ISO 22002-5:2025 sets the prerequisite programmes for transport and storage. Retail customers that require a GFSI-recognised scheme will not accept ISO 22000 alone.
How long does certification take for a logistics business?
Months, not days. ISO 9001 typically takes three to six months, and ISO 14001, ISO 45001, ISO 28000 and ISO 39001 typically four to eight months each; an integrated programme runs them together rather than one after another. The pace depends on how many sites and partners are in scope and on your peak season, which we plan around. Sterling does not certify; the accredited certification body audits and decides.
Talk to a consultant
Plan certification for your logistics and supply chain operation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice