Select the Standard™: which standards does your sector expect?

How to choose: start from who is asking

Most organisations do not choose a standard; one is chosen for them by a customer, a tender, a regulator or a risk they can no longer carry. Name that source first and the shortlist is usually short.

• Customers and tenders

  Buyers name the certificate they want to see: ISO 9001 for quality, ISO/IEC 27001 or a SOC 2 report for information security, ISO 14001 and ISO 45001 in supplier due diligence, and sector schemes where the sector has one — IATF 16949 in automotive, AS9100 in aerospace, FSSC 22000 or BRCGS in food and packaging, ISO 13485 for medical devices. Match the certificate to the words in the tender, not to the standard you find easiest.

• Regulators and licences

  Privacy and sector regulation (GDPR, the Philippine Data Privacy Act, HIPAA, PCI DSS, the UAE, Saudi and Qatari information assurance frameworks) is compliance, not certification: there is usually no certificate to earn, and the evidence is your documentation and practice. A management system such as ISO/IEC 27001 or ISO/IEC 27701 is the reliable way to keep that evidence current.

• A risk you want to control

  Continuity (ISO 22301), information security (ISO/IEC 27001), occupational health and safety (ISO 45001), bribery (ISO 37001) and compliance obligations (ISO 37301) each have a management-system standard built for the risk. Choose by the risk that would hurt most, not by the certificate that is easiest to get.

• A capability you want to prove

  Laboratories, inspection bodies and certification bodies prove competence through accreditation (ISO/IEC 17025, ISO 15189, ISO/IEC 17020, ISO/IEC 17024). AI governance (ISO/IEC 42001), energy performance (ISO 50001) and service management (ISO/IEC 20000-1) prove a capability customers increasingly ask about before they ask for the certificate.

Certification, accreditation, attestation, compliance: four different proofs

• Certification

  An accredited certification body audits your management system against the standard — a Stage 1 readiness review, then the Stage 2 audit — and issues a certificate, normally for a three-year cycle with surveillance audits in between and a recertification audit at the end. Sterling prepares the system and the people; the certification body audits and decides.

• Accreditation

  An accreditation body assesses a laboratory, inspection body or certification body for competence and impartiality, usually witnessing the work itself, and grants accreditation for a defined scope of methods or activities. Sterling does not accredit; your accreditation body assesses and decides.

• Attestation

  For SOC 1 and SOC 2, an independent CPA firm examines your controls and issues a report with its opinion — Type 1 on design at a point in time, Type 2 on operation over a period. There is no certificate; the report is what your clients read. Sterling prepares the controls and the evidence; the service auditor examines and reports.

• Compliance

  Laws and industry rules such as the GDPR, HIPAA and PCI DSS are judged by regulators, assessors and your customers against your documentation and practice. PCI DSS is validated by a Qualified Security Assessor or a self-assessment questionnaire; the GDPR has no organisation-level certificate. Sterling builds and evidences the programme; it does not validate compliance.

What moves cost and timeline

Every Sterling proposal is all-inclusive and shows each component. The figures move with the factors below, which is why the standard's own page gives drivers rather than a price list.

• Scope

  The number of sites, people, products or services and jurisdictions inside the certificate. Scope also decides the certification body's audit days, which are a separate cost set by the body.

• Where you start

  A system that already runs — documented processes, records, a culture of acting on findings — needs structure and coaching (Design™). A system built from the beginning needs implementation effort (Drive™). The readiness check tells you which you are.

• How many standards at once

  Standards that share the harmonised clause structure (ISO 9001, 14001, 45001, 27001, 22301, 50001 and others) share policies, risk assessment, internal audit and management review. One integrated system costs less than two separate ones and is audited in one visit.

• The standard's own demands

  Sector schemes add requirements of their own: unannounced audits in FSSC 22000, first article inspection in AS9100, technical validation and proficiency testing for ISO/IEC 17025 accreditation, a reporting period for a SOC 2 Type 2 report. These set the minimum timeline more than anything else.

Timelines run in months. Certification bodies expect to see the system operating, with an internal audit and a management review completed, before the Stage 2 audit; the standard's page gives the typical range for your situation.

Combining standards: one system, several certificates

Organisations that will hold more than one certificate should build one management system from the start. The harmonised structure makes context, leadership, planning, support, performance evaluation and improvement common; only the operational clauses differ. The practical gains are one set of policies and objectives, one risk method, one internal audit programme, one management review and combined certification audits. Sector schemes with their own structure (BRCGS, FSSC additional requirements, PCI DSS) sit alongside the integrated system rather than inside it, and the readiness checks score each standard on its own.

Integrated management systems All readiness checks