# Boulay Certifications, LLC - **Type:** Certification body - **Website:** https://boulaygroup.com/ - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A US certification body in Minnesota, part of the accounting and advisory firm Boulay Group. ANAB accredits it to certify ISO/IEC 27001 only, not ISO/IEC 42001 for AI. ## Boulay Certifications scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 2/5 Publishes a basic 3-stage audit/surveillance cycle (initial, two annual surveillance audits, recertification) and an appeal process, but appeals are reviewed only by other in-house Boulay staff, not an independent committee, with no stated timeframe; no named lead auditors or public suspension/withdrawal statistics are disclosed (boulaygroup.com/contact/iso-27001-appeal-request/, checked 2026-09-20). ### Qualifications of the people who do the work: 2/5 ANAB's public Management Systems CB Directory confirms live, checkable accreditation as "Boulay-MS-1093", but only for ISO/IEC 27001. The same directory returns zero results for Boulay under ISO/IEC 42001, and no named individual lead-auditor credentials are published, so verifiable standing does not extend to AI-management-system certification (anabdirectory.remoteauditor.com, checked 2026-09-20). ### What it publishes about fees: 1/5 No pricing, rate card or worked fee example is published for ISO 27001 certification, SOC reporting or CMMC-readiness services on boulaygroup.com; engagement is by consultation request only (checked 2026-09-20). ### Knowledge of your sector: 2/5 Boulay Group lists nine general accounting-advisory sectors (construction, manufacturing, SaaS, non-profit, etc.), but no sector-tailored ISO 27001 or AI-governance certification programme, and no named certification-sector specialists, are published for Boulay Certifications specifically (boulaygroup.com/about-us/, boulaygroup.com/industries/, checked 2026-09-20). ### Independence from what it sells: 4/5 Publishes a numbered impartiality policy: a two-year cooling-off period between Boulay PLLP consulting and a Boulay Certifications audit of the same client, a bar on providing internal-audit services to certification clients, a bar on outsourcing audits to consulting organisations, and a separate Audit Quality Review department holding final certification-decision authority. Held back from 5 because the same named partner (Jeffrey Filler) is the public contact for both the risk-advisory consulting practice and the certification body (boulaygroup.com/services/iso-27001-compliance/, checked 2026-09-20). ### Who carries the risk if the advice is wrong: 1/5 No professional-indemnity insurance level, liability cap, or client-facing liability terms are disclosed anywhere on Boulay Certifications' public pages (checked 2026-09-20). ## Sources for Boulay Certifications Every line carries the page it was read on and the date it was checked. - Boulay Certifications, LLC holds active ANAB accreditation, listed as "Boulay-MS-1093," for ISO/IEC 27001 certification-body services, based in Minnesota, USA, contact Jeffrey Filler. - Source: https://anabdirectory.remoteauditor.com/ - Checked: 2026-09-20 - The same ANAB Management Systems CB Directory returns zero accredited-body results for "Boulay" under the ISO/IEC 42001 (AI management systems) standard. - Source: https://anabdirectory.remoteauditor.com/ - Checked: 2026-09-20 - Boulay Certifications, LLC publishes a numbered impartiality policy requiring a minimum two-year gap between Boulay PLLP consulting work and a Boulay Certifications audit of the same organisation, and bars the certification body from providing internal-audit services to its clients. - Source: https://boulaygroup.com/services/iso-27001-compliance/ - Checked: 2026-09-20 - Boulay's ISO 27001 certification decisions are made by a separate Audit Quality Review (QR) department with final authority, distinct from the lead auditor who only recommends certification. - Source: https://boulaygroup.com/services/iso-27001-compliance/ - Checked: 2026-09-20 - Boulay's ISO 27001 appeals are reviewed by different in-house Boulay personnel rather than an independent external appeals committee, and no appeal timeframe is published. - Source: https://boulaygroup.com/contact/iso-27001-appeal-request/ - Checked: 2026-09-20 - Boulay Group, the parent CPA and advisory firm, was founded in 1934, is headquartered in Eden Prairie, Minnesota, and reports more than 300 staff, 49 partners and over 100 CPAs; it describes itself as independently and locally owned. - Source: https://boulaygroup.com/about-us/ - Checked: 2026-09-20 - Boulay's own commentary on the CMMC programme positions it as a readiness/advisory resource for defense contractors and does not claim status as an authorised CMMC Third-Party Assessment Organization (C3PAO). - Source: https://boulaygroup.com/cmmc-phase-ii-suspension-what-it-means-for-defense-contractors/ - Checked: 2026-09-20 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Not published - Credentials: Not published - Independent accreditation: Published - Client results: Not published - How it uses AI: Not published ## Strengths - Genuinely ANAB-accredited certification body for ISO/IEC 27001, independently verifiable in ANAB's own public Management Systems CB Directory rather than a self-declared or unaccredited scheme. - Publishes a detailed, numbered impartiality policy with a concrete two-year cooling-off rule separating Boulay PLLP's consulting engagements from Boulay Certifications' audits of the same client. - Certification decisions are made by a separate internal Audit Quality Review department rather than by the auditor who recommends them, a structural check beyond the ISO 17021 minimum. - Backed by an established, independently-owned 300+ person, 49-partner CPA and advisory firm (Boulay Group, founded 1934) with over 100 CPAs on staff, and does not overstate its scope by claiming CMMC C3PAO status it does not hold. ## Things to check Each one carries the factual basis it rests on. - Its ANAB accreditation covers only ISO/IEC 27001; it holds no accreditation for ISO/IEC 42001 (AI management systems), so it cannot issue an accredited AI-governance certificate. - Basis: ANAB's public Management Systems CB Directory (anabdirectory.remoteauditor.com), searched for "Boulay" under the ISO/IEC 42001 standard, returns "0 of 0 items"; the same search under ISO/IEC 27001 returns one accredited result (Boulay-MS-1093). Checked 2026-09-20. - Its ISO 27001 appeal process is reviewed only by other Boulay staff, with no independent external committee and no published timeframe. - Basis: Appeal-request page states the reviewing team "will consist of personnel who were not part of the originally assigned Boulay ISO project team", no external or independent body is named (boulaygroup.com/contact/iso-27001-appeal-request/, checked 2026-09-20). - No fee information, rate card or worked pricing example is published for ISO 27001 certification, SOC reporting or CMMC-readiness services. - Basis: boulaygroup.com/services/iso-27001-compliance/ and boulaygroup.com/services/soc-reporting/ contain no pricing; engagement is by consultation request only, checked 2026-09-20. - No professional-indemnity insurance level or liability cap is disclosed for Boulay Certifications, LLC's certification work. - Basis: No PI insurance figure or liability terms found on the certification body's public service, complaint or appeal pages, checked 2026-09-20. ## Where this firm appears - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.