Complaints and feedback: we run corrective action on ourselves.

We run corrective action on ourselves the way we implement it for clients. Any client, partner or website visitor may raise a complaint about our services, our conduct, our published content or our independence, by writing to hello@sterling-grc.com with the subject "Complaint", or through the Contact page. You may also raise it with your engagement team, who records it in the same way.

It helps us to know who you are, the engagement or page concerned, what went wrong and what outcome you are looking for, but a complaint is accepted however it is made.

• Prompt acknowledgement of receipt, with the role handling the complaint.
• Investigation by someone independent of the matter, where practicable, and never by the person complained about.
• A written response with our findings as soon as the investigation allows; if it needs longer, we tell you why and when to expect the answer.
• Where we were at fault, correction plus root-cause action, with a comprehensive corrective action so that it does not recur: the same nonconformity discipline our profession teaches.

If you are not satisfied with the response, reply and ask for a review; the complaint is then reviewed by a member of Sterling's management not involved in the first response.

A complaint about an engagement in progress is raised first in the weekly working session or with the engagement team, so that it can be corrected straight away; it is still recorded and answered as this policy describes. Under the Sterling Promise, Sterling stays engaged until the certification outcome agreed at the start is reached, and a complaint never pauses that commitment.

Complaints about published content are also handled under the correction rules of the Editorial and verification policy. Concerns about bribery, fraud or misconduct can be raised with the subject "Ethics" under the Business ethics policy. Complaints about personal information can also go to privacy@sterling-grc.com, as the Privacy notice explains, and you keep your right to complain to a data protection authority.

A complaint, and the information in it, is shared only with the people who need it to investigate and respond, and is used only for that purpose and for the corrective action that follows. We accept a complaint made without a name, and investigate it as far as we can, although without a way to contact you we cannot tell you the outcome. Personal information in a complaint is handled under the Data privacy policy.

Raising a complaint in good faith never disadvantages a client relationship. Every complaint, with its cause and correction, is recorded and reviewed regularly by Sterling's management, alongside client feedback, so that a pattern is found and fixed even when each complaint on its own looked small. Feedback that is not a complaint, including what we did well, is welcome by the same routes and reviewed in the same way.