Impartiality and independence: a consultancy, never a certification body.

Sterling is a consultancy. We never have been and never will be a certification body, and we never issue certificates. International rules, in ISO/IEC 17021-1, separate those who help build management systems from those who certify them, because a certificate is only worth the independence behind it. An accredited certification body audits and decides; that decision is never ours.

We keep that boundary absolute. Our consulting, training and certification support prepares an organisation for its audit. The audit, the findings and the certification decision belong to the certification body alone, and nothing we say or do on an engagement suggests otherwise.

Your certification body is your choice from accredited bodies. We support the selection, comparing bodies on accreditation, scope and fit, but hold no stake in it, and every certificate facilitated through our engagements is traceable through official accreditation registers. We put that traceability in writing. For attestation work, such as a SOC 2 examination, the same principle applies: the independent auditor is the client's choice, and the opinion is the auditor's alone.

Where a conflict of interest could arise, including engagements touching our own group companies, we disclose it before contract and decline where disclosure cannot cure it. Sterling's group includes Lakshy, Sterling Philippines and Cyber Vantage 360, with Effivity and Sterling Academy as the group's platforms; when we recommend one of them in an engagement, we say so, and the client remains free to choose another. The Business ethics policy sets out how our people declare personal interests.

Independence shapes how we work with every client, not only how certification bodies are chosen:

• We tell clients plainly what the standard requires and where their system falls short, including findings they would rather not hear; a gap left unspoken would only surface at the certification audit.
• The internal audit we run with a client before the certification audit is a readiness check against the standard. It is not a prediction of the certification body's decision, and we never present it as one.
• During the certification audit we attend, where agreed, as the client's advisor. We are not a party to the audit, we do not answer for the client, and we never contact the certification body to influence a finding or a decision.
• Findings raised by the certification body are answered by the client, with our support in working out the cause and the correction.

• Issuing or arranging certificates from non-accredited "certifiers".
• Shortcut or days-not-months certification schemes.
• Fabricated records.
• Any engagement whose outcome we would be unwilling to have audited.
• Promising a certification decision: we commit to the preparation and support, and an accredited body decides.

Concerns about our independence, from a client, a certification body or anyone else, are welcome at hello@sterling-grc.com and are handled under our Complaints and feedback policy, with the same independent investigation and written response as any other complaint. This statement is reviewed regularly by Sterling's management, and whenever our services change.