Sterling OS™: the operating model behind every Sterling engagement.

Sterling OS™ is the operating model Sterling uses for every consulting engagement. It combines five service brands: Design™ and Drive™, the two alternative ways to implement; Automate™, the Effivity platform your system runs in; Sustain™, support once certification or attestation is achieved; and Revise™, for transitions, scope changes and new standards. The stages, deliverables and decision owners stay the same whichever standard you pursue, so you always know what happens next and who decides.

Design™ is advisory consulting: we develop, you implement under our expert advice and supervision. Drive™ is fully managed consulting: we design and build under your approval. They are alternative support levels, so an engagement runs under one or the other, never both in sequence. Design™ is the default; Drive™ suits organisations without the internal capacity to implement, or with a date that cannot move.

No. Automate™ runs on Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries, and it is included with the engagement, at no additional cost. Your consultant configures it for the agreed scope, so documents, registers, audits, actions and training records are held in one workspace from the first workshop and stay there through Sustain™ and Revise™.

Sustain™ keeps an achieved outcome in place. For a certificate it covers support through surveillance and recertification audits: the internal audits, management reviews, refreshers and evidence each audit expects. It also extends to outcomes that are not certificates, such as SOC 2 attestation, SOC 1, PCI DSS, HIPAA and GDPR, where the recurring cycle needs the same discipline and the same Effivity workspace.

Whenever the system has to change shape: a revised edition of your standard, a scope that grows to new sites, products or services, a new standard to integrate, or several management systems to combine into one integrated system. Revise™ works inside the system you already run, so documents, registers and Effivity records carry forward instead of being rebuilt from nothing.

Yes. Attestation readiness and compliance programmes run on the same model as ISO certification: scope and gap analysis, implementation under Design™ or Drive™, the controls and evidence kept in Effivity, readiness testing before the external review, then Sustain™ for the recurring cycle. What differs is the outcome and who decides it, which your consultant sets out at the start.

No. Sterling consults, trains and prepares you; it never certifies, accredits, attests or validates. An independent, accredited certification body audits and decides on a certificate, and for SOC 2 or SOC 1 the service auditor, a CPA firm, issues the report. Under the Sterling Promise we stay with you through every finding until the agreed outcome is achieved, but the decision is never ours.

From scope to certificate typically takes three to six months for a single-site organisation, depending on the current maturity of your processes, the scope, the locations and the number of employees; multi-site and integrated programmes take longer. Sustain™ then continues each year for as long as you hold the outcome, and Revise™ is planned whenever a change arises.

Yes. Standards that share the harmonised structure can run as one integrated system with common document control, internal audit and management review, audited as one programme where the certification body agrees. Revise™ is also how a standard is added later, so starting with one standard never means rebuilding the system when a customer asks for a second.