The Assurance DeskWhat Boulay Certifications offers, and what it publishes
Boulay Certifications certifies ISO/IEC 27001 under ANAB accreditation. Its published policy requires at least two years between any Boulay consulting work and a Boulay audit of the same client. A separate review team, not the lead auditor, makes the final certification decision. It sets out a three-stage cycle: first certification, two yearly surveillance audits, then recertification.
Boulay Certifications does not publish a price for ISO 27001 certification or SOC reporting. It does not publish its indemnity insurance, a liability cap or its auditors' names and credentials, and does not say whether it uses AI. ANAB's directory shows no Boulay accreditation for ISO/IEC 42001, the AI management standard.
Boulay Group was founded in 1934 and says it has over 300 staff and 49 partners. One partner, Jeffrey Filler, is the public contact for both its consulting and its certification work. Other Boulay staff hear appeals, with no outside panel and no stated timeframe. We could not check Minnesota's business register, which blocks automated access.
Strengths
- Genuinely ANAB-accredited certification body for ISO/IEC 27001, independently verifiable in ANAB's own public Management Systems CB Directory rather than a self-declared or unaccredited scheme.
- Publishes a detailed, numbered impartiality policy with a concrete two-year cooling-off rule separating Boulay PLLP's consulting engagements from Boulay Certifications' audits of the same client.
- Certification decisions are made by a separate internal Audit Quality Review department rather than by the auditor who recommends them, a structural check beyond the ISO 17021 minimum.
- Backed by an established, independently-owned 300+ person, 49-partner CPA and advisory firm (Boulay Group, founded 1934) with over 100 CPAs on staff, and does not overstate its scope by claiming CMMC C3PAO status it does not hold.
Things to check
- Its ANAB accreditation covers only ISO/IEC 27001; it holds no accreditation for ISO/IEC 42001 (AI management systems), so it cannot issue an accredited AI-governance certificate.
- Its ISO 27001 appeal process is reviewed only by other Boulay staff, with no independent external committee and no published timeframe.
- No fee information, rate card or worked pricing example is published for ISO 27001 certification, SOC reporting or CMMC-readiness services.
- No professional-indemnity insurance level or liability cap is disclosed for Boulay Certifications, LLC's certification work.
Common questions
Is Boulay Certifications accredited to certify ISO/IEC 42001?
No. ANAB's public directory lists Boulay as accredited for ISO/IEC 27001 only. A search for Boulay under ISO/IEC 42001 returns no results.
Does Boulay publish its certification fees?
No. Its ISO 27001 and SOC reporting pages carry no prices, and work starts with a consultation request.
How does Boulay keep its auditors apart from its consultants?
By written policy. There must be at least two years between Boulay PLLP consulting work and a Boulay Certifications audit of the same client, and the certification body may not do internal audits for its clients. A separate review team makes the final decision.
Evidence for each Boulay Certifications score
Show our working
Notes behind each thing to check
- Its ANAB accreditation covers only ISO/IEC 27001; it holds no accreditation for ISO/IEC 42001 (AI management systems), so it cannot issue an accredited AI-governance certificate. (ANAB's public Management Systems CB Directory (anabdirectory.remoteauditor.com), searched for "Boulay" under the ISO/IEC 42001 standard, returns "0 of 0 items"; the same search under ISO/IEC 27001 returns one accredited result (Boulay-MS-1093). Checked 2026-09-20.)
- Its ISO 27001 appeal process is reviewed only by other Boulay staff, with no independent external committee and no published timeframe. (Appeal-request page states the reviewing team "will consist of personnel who were not part of the originally assigned Boulay ISO project team", no external or independent body is named (boulaygroup.com/contact/iso-27001-appeal-request/, checked 2026-09-20).)
- No fee information, rate card or worked pricing example is published for ISO 27001 certification, SOC reporting or CMMC-readiness services. (boulaygroup.com/services/iso-27001-compliance/ and boulaygroup.com/services/soc-reporting/ contain no pricing; engagement is by consultation request only, checked 2026-09-20.)
- No professional-indemnity insurance level or liability cap is disclosed for Boulay Certifications, LLC's certification work. (No PI insurance figure or liability terms found on the certification body's public service, complaint or appeal pages, checked 2026-09-20.)
| Criterion | Score | Evidence |
|---|---|---|
| Help when things go wrong | Publishes a basic 3-stage audit/surveillance cycle (initial, two annual surveillance audits, recertification) and an appeal process, but appeals are reviewed only by other in-house Boulay staff, not an independent committee, with no stated timeframe; no named lead auditors or public suspension/withdrawal statistics are disclosed (boulaygroup.com/contact/iso-27001-appeal-request/, checked 2026-09-20). | |
| Qualifications of the people who do the work | ANAB's public Management Systems CB Directory confirms live, checkable accreditation as "Boulay-MS-1093", but only for ISO/IEC 27001. The same directory returns zero results for Boulay under ISO/IEC 42001, and no named individual lead-auditor credentials are published, so verifiable standing does not extend to AI-management-system certification (anabdirectory.remoteauditor.com, checked 2026-09-20). | |
| What it publishes about fees | No pricing, rate card or worked fee example is published for ISO 27001 certification, SOC reporting or CMMC-readiness services on boulaygroup.com; engagement is by consultation request only (checked 2026-09-20). | |
| Knowledge of your sector | Boulay Group lists nine general accounting-advisory sectors (construction, manufacturing, SaaS, non-profit, etc.), but no sector-tailored ISO 27001 or AI-governance certification programme, and no named certification-sector specialists, are published for Boulay Certifications specifically (boulaygroup.com/about-us/, boulaygroup.com/industries/, checked 2026-09-20). | |
| Independence from what it sells | Publishes a numbered impartiality policy: a two-year cooling-off period between Boulay PLLP consulting and a Boulay Certifications audit of the same client, a bar on providing internal-audit services to certification clients, a bar on outsourcing audits to consulting organisations, and a separate Audit Quality Review department holding final certification-decision authority. Held back from 5 because the same named partner (Jeffrey Filler) is the public contact for both the risk-advisory consulting practice and the certification body (boulaygroup.com/services/iso-27001-compliance/, checked 2026-09-20). | |
| Who carries the risk if the advice is wrong | No professional-indemnity insurance level, liability cap, or client-facing liability terms are disclosed anywhere on Boulay Certifications' public pages (checked 2026-09-20). |
Sources for Boulay Certifications
- Boulay Certifications, LLC holds active ANAB accreditation, listed as "Boulay-MS-1093," for ISO/IEC 27001 certification-body services, based in Minnesota, USA, contact Jeffrey Filler. (Accredited, ISO/IEC 27001 (ref. Boulay-MS-1093)) (anabdirectory.remoteauditor.com, checked 20 September 2026)
- The same ANAB Management Systems CB Directory returns zero accredited-body results for "Boulay" under the ISO/IEC 42001 (AI management systems) standard. (0 results, ISO/IEC 42001) (anabdirectory.remoteauditor.com, checked 20 September 2026)
- Boulay Certifications, LLC publishes a numbered impartiality policy requiring a minimum two-year gap between Boulay PLLP consulting work and a Boulay Certifications audit of the same organisation, and bars the certification body from providing internal-audit services to its clients. (2-year impartiality cooling-off period) (boulaygroup.com, checked 20 September 2026)
- Boulay's ISO 27001 certification decisions are made by a separate Audit Quality Review (QR) department with final authority, distinct from the lead auditor who only recommends certification. (Separate QR department holds final decision authority) (boulaygroup.com, checked 20 September 2026)
- Boulay's ISO 27001 appeals are reviewed by different in-house Boulay personnel rather than an independent external appeals committee, and no appeal timeframe is published. (Internal-only appeal review, no stated timeframe) (boulaygroup.com, checked 20 September 2026)
- Boulay Group, the parent CPA and advisory firm, was founded in 1934, is headquartered in Eden Prairie, Minnesota, and reports more than 300 staff, 49 partners and over 100 CPAs; it describes itself as independently and locally owned. (Founded 1934; 300+ staff; 49 partners; 100+ CPAs) (boulaygroup.com, checked 20 September 2026)
- Boulay's own commentary on the CMMC programme positions it as a readiness/advisory resource for defense contractors and does not claim status as an authorised CMMC Third-Party Assessment Organization (C3PAO). (No C3PAO claim found) (boulaygroup.com, checked 20 September 2026)
ANAB accreditation for ISO/IEC 27001 certification-body services, ref. Boulay-MS-1093 (anabdirectory.remoteauditor.com, checked 2026-09-20)
Seeking ISO 42001 certification
Where this firm appears
If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.
This is an independent editorial guide, not legal advice.