Sterling Sustain™: Post Certification Support — keep meeting the requirements, keep improving

Sterling Sustain™ is Sterling’s post-certification support service for organisations in the Philippines: scheduled document reviews, internal audits, training and surveillance-audit support that keep your certification, attestation or assessment alive after the award — so requirements keep being met and surveillance never becomes a fire drill.

Sustain™ is the post-award phase of Sterling OS™ — support that keeps you meeting the requirements after certification, attestation or assessment: occasional training, document review, internal audit, pre-assessment review, and surveillance or annual-assessment support. Most systems don’t fail at certification; they decay after it — records drift, trained people leave, and the next external visit arrives as a surprise. Sustain exists so yours doesn’t, and so the annual cycle returns improvement, not just renewal.

 

You’re here if: the system went quiet the day after the certificate arrived · surveillance (or your annual SOC 2 examination) keeps you scrambling · staff turnover has eroded the knowledge the auditors originally saw · you renew every year but extract no improvement value.

Who typically chooses Sustain™

Certified organisations without a full-time compliance officer — the majority of Philippine SMEs, where the system’s original champion has been promoted, reassigned or hired away; holders of multiple certificates — ISO 9001, ISO 14001, ISO 45001 — juggling overlapping surveillance calendars; organisations whose attestations recur annually (SOC 2 examinations, PCI DSS revalidations) and need the evidence discipline maintained year-round; and — routinely — organisations certified through another consultant who has since vanished, under-delivered, or simply completed and moved on. We service systems we didn’t build; a brief system review is the entire onboarding.

What’s included — assembled to your cycle

Surveillance/annual-assessment calendar management: dates tracked, certification-body or assessor logistics handled, and preparation started early enough that nothing is a scramble.

Refresher and new-joiner training: as roles change, the people in them get trained — with records — so the competence auditors saw at certification still exists at surveillance.

Periodic document and change reviews: documentation kept current with how you actually operate, and with the standards themselves — revisions flagged early, with a warm handoff to Revise™ when a transition approaches.

Internal audits by practising Lead Auditors: the annual requirement, performed properly, with findings your team helps close.

Management-review facilitation: the decisions, minutes and actions the standard requires — run, recorded, followed up.

Pre-assessment readiness reviews: a structured check before every external visit, so surprises happen in private.

Findings and nonconformity closure support: whatever the external audit raises, driven to verified closure.

Your system stays live in Effivity throughout — included.

Your first 30 days

Week 1 — system review: current certificates, last audit reports, open findings, documentation state, who knows what. Week 2 — your annual compliance calendar built, gaps and risks reported plainly. Weeks 3–4 — the most urgent items actioned (overdue records, open findings, stale documents) and the standing rhythm scheduled. By day 30, the next external visit has a date, a plan, and no capacity to surprise you.

Entry: a current certificate, attestation or assessment outcome — from any consultant, or self-implemented; we service systems we didn’t build. Exit definition per cycle: the external assessment passed, findings closed, and at least one documented improvement delivered — renewal plus return.

What it costs: annual programmes sized to your standards, organisation and cadence — fixed scope, agreed before the cycle starts. Certification-body and assessor fees are theirs and always stated separately.

Frequently asked questions

What happens if I skip a surveillance audit? The certification body suspends the certificate, and continued non-compliance leads to withdrawal — after which you restart certification from the beginning, not from where you left off. Tender and client checks treat suspended certificates as no certificate. Surveillance is not optional maintenance; it is the certificate’s life support.

Our system has decayed since certification — can Sustain™ rescue it before the next surveillance? Usually, yes: a readiness sprint — document updates, legitimate record reconstruction, corrective-action closure, internal audit, management review — then the normal annual rhythm. What we won’t do is fabricate records: genuine gaps get documented with corrective actions, which auditors respect far more than suspiciously perfect paperwork.

Does Sustain™ cover SOC 2 and other non-ISO assessments? Yes — the phase covers certifications, attestations and assessments alike: annual SOC 2 examination readiness, PCI DSS revalidation support, and the evidence discipline they all share. One maintenance rhythm, correct terminology throughout — SOC 2 is an attestation, and we treat it as one.

What do auditors actually check in a surveillance audit? A sample, not everything: whether the system still operates — records current, internal audits and management reviews done, previous findings closed, changes controlled, objectives tracked — plus a rotating selection of processes so the full system is covered across the three-year cycle. Surveillance rewards steady operation and punishes last-week reconstruction, which auditors recognise instantly.

Our previous consultant disappeared after certification — can Sterling take over maintenance? Yes, and it’s one of the most common ways clients arrive. We review what exists, keep everything genuinely serviceable, flag honestly what isn’t, and put your system on the annual rhythm — regardless of who built it. You shouldn’t lose a certificate because a consultant lost interest.

About Sterling OS™: Sterling OS™ is Sterling’s delivery operating system — five defined services, taken alone or combined, covering guided and fully outsourced implementation, post-certification support, digitisation and standard transitions, with fixed scope, named deliverables and accredited certification bodies only. Explore the system →

 

Reviewed by Kaushal Sutaria, Founder — Lead Auditor · Last reviewed 07 Jul 2026

Last updated: July 2026 · Sterling International Consulting — Metro Manila · Cebu · Davao.