Sterling OS™ Sustain™: keep improving: video

A certificate records one audit

A certificate records one audit; customers expect the system behind it to keep working. Sustain™ is the part of Sterling OS™ that runs the compliance year with an organisation after its certificate or report: internal audits, management reviews, risk reviews, training, evidence and every external audit. Where the work is outsourced entirely, Drive™ has Sterling operate it under the organisation's approval.

This one-minute film introduces that approach. It applies to ISO certificates, SOC 1 and SOC 2 reports, PCI DSS, HIPAA and GDPR programmes, alone or on one integrated calendar.

Organisations that already hold a certificate, with Sterling or elsewhere, can move into Sustain™ at any point in the certificate cycle.

The aim is a system that runs between audits, not one revived for them, with each record carrying its date, owner and follow-up.

What a sustained compliance year looks like

It begins with a takeover and baseline review: the certificate or report and its scope, the last external audit report and its open findings, internal audits, management reviews, registers and the records produced since. Where documents no longer match how work is done, that is said plainly and the correction agreed. The result is a baseline report on every requirement, with open findings and overdue actions given owners and dates.

From there, the year is planned around the external audit dates. An annual compliance calendar in Effivity holds every surveillance or recertification audit, QSA assessment or SOC period, internal audit, management review, risk review, training session and policy review, so there is no audit-season scramble. Nonconformities and exceptions are closed with evidence that the fix worked, so they do not reappear at the next audit, and new sites, systems, suppliers, people and revised editions are brought into the system as they arrive.

Sterling's expert and experienced consultants carry this cycle with the organisation every year. The external audits and the decisions they lead to remain with the independent certification bodies, CPA firms and assessors.