Certification readiness assessment, so the audit holds no surprises.

It is a structured test of whether your management system or controls would pass the independent audit if it took place now. A Sterling consultant reviews documents, interviews owners and samples records against every requirement, the way the certification body, CPA firm or assessor will, and gives you a rated verdict with the evidence. Findings reach you first, while there is still time to close them before the audit date.

A gap analysis comes first and asks what is missing; a readiness assessment comes last and asks whether what you built works. The gap analysis produces the remediation plan. The readiness assessment is a pre-audit review once the controls have run, with samples from real records and a go or no-go recommendation. Neither is the certification body's Stage 1 readiness review, which is part of the certification audit itself.

No. Sterling provides consulting, readiness assessment, software and training. An accredited certification body issues the certificate, a CPA firm examines your controls and issues the SOC report with its opinion, and a Qualified Security Assessor, or your acquirer where self-assessment is allowed, handles PCI DSS validation. Keeping the readiness work and the independent verdict in separate hands is what gives the result its value to your customers.

Yes. Each stage can be engaged on its own: a gap analysis to see where you stand, or a pre-audit review before an audit, examination or assessment that is already booked. Many organisations start with the gap analysis and decide on remediation support once they see the plan. A single stage is scoped and priced as one all-inclusive proposal in the same way as the full route.

It depends on the outcome and on where you start. The gap analysis is the short part; remediation takes as long as your largest gaps, and outcomes that test a period take longer again. A SOC 2 Type 2 report or an ISO certificate needs controls operating long enough to produce dated records, whereas a Type 1 report looks at controls as at a single date. Share your deadline at the start and we will tell you what is achievable.

Then you have learned it from us rather than from the auditor. The report names each finding, its risk to the outcome and what closes it, and the go or no-go recommendation explains whether the booked date should stand. Under the Sterling Promise we stay with you until the agreed outcome is achieved; moving an audit date remains your decision, taken with the evidence in front of you.

Yes, where the controls overlap. Access management, change control, logging, incident response and supplier oversight are tested once and mapped to each framework in Effivity, while framework-specific items, such as the cardholder data environment for PCI DSS or management's system description for SOC 2, are assessed on their own terms. You receive one plan with the overlaps visible, instead of three competing lists.

The contract with the independent party is always yours. We help you compare proposals where you have a choice, check a certification body's accreditation on the public registers, and confirm that a CPA firm or assessor is qualified for the report or validation you need. We work with whichever qualified party you choose and brief them on the scope before they start.

The discovery call can usually be held within a few days of your enquiry, and the scoped proposal follows it. The gap analysis starts once the proposal is accepted and your project owner is named. If a customer deadline or a booked audit is close, say so on the call and we will plan the pre-audit review around that date.