UPDATE: see below for latest information.

In writing another piece today, I just uncovered yet another violation of accreditation rules. This is like playing whack-a-mole, and I can’t publish these articles fast enough.

Now it seems the Philippine office of BlueStar Certification Management, a CB run by drag queen Zyrus Allado Oyong and accredited by tax cheat Parveen Sadana of the United Accreditation Forum (UAF), bought a fake ISO 9001 QMS certificate from another CB. That’s a problem because ISO 17021-1 clearly says this:

5.2.4 A certification body shall not certify another certification body for its quality management system.

The CB selling the cert was Royal Impact Certification Ltd. (RICL), who we previously reported on for a number of similar violations, like issuing a fake ISO cert to an Indian police department. RICL is yet another Indian scammer CB, but managed to get full accreditation from UAF, too. Yes, there’s a pattern forming.

Worse, look at the scope of that ISO 9001 certificate. It’s for management system consultancy, the very thing BlueStar is not allowed to do as an accredited CB.

So, UAF not only allows its CBs to consult, but it will also allow other CBs to issue ISO 9001 certificates for the consulting, too! You can’t make this shit up.

Bluestar CMI also claims to be a “licensee and legal agency” of RICL, which, if true, means RICL issued a certificate to its own agent. I should not have to explain the conflict of interest here, but obviously, RICL would never deny certification to its own “legal agency.” So the certificate was issued under severe conflicts of interest and a lack of impartiality. Alternatively, RICL might not even know that Bluestar and Zyrus are claiming to be their Philippines rep. There’s no evidence on the official RICL page of any such partnership, and (so far) Zyrus hasn’t published a memorandum of agreement between him and RICL.

UAF does not perform any real accreditation audits on its CBs and allows them to commit any violations they like with impunity. UAF’s owner, Parveen Sadana, registered the AB in Delaware over a decade ago but appears to have never paid any taxes or filed any tax returns. The IAF has refused to eject him from membership, and he’s going to town accrediting scammers like BlueStar and RICL.

Notice how that fancy certificate has both the UAF and IAF logos on it… and now we can watch how neither of those organizations does anything despite this being a clear violation of ISO 17021-1. Both, meanwhile, claim tax-exempt status in the United States while claiming to enforce 17021-1.

Smells like tax fraud to me.

UPDATE 4 July 2025. On LinkedIn, Zyrus is spamming the comments sections with more false and defamatory content, and is now challenging me to a debate. He says that whoever loses the debate has to close their company. Sure, that’s how debates work.

He then created a number of fake accounts to spam LinkedIn, began harassing me on Facebook, and is trying to get access to the Oxebridge site as we speak.

Despite apparently denying he’s a drag queen — dude, you publicly posted yourself in drag on social media! — he created a sockpuppet account with the name “Rose May Quilicot.” This continues a long tradition of Bluestar creating fake LinkedIn accounts to make themselves look larger than they are.

Zyrus then openly admits he’s the person behind the Rose May sockpuppet account and that now he’s pretending to be a woman.

Again, I have no idea why he’s challenging the assertion he’s a drag queen, when he posted photos and videos of himself right on his public Facebook page declaring himself one. This sucks because it brings drag queens into disrepute and they have enough problems already.

Zyrus / Rose then posted this, which looks like the kind of thing I should probably be calling the Philippine police about. Notice the handwritten scrawl in red pen. Aggin, the problem for Zyurus is that defamation is a criminal offense in Philippines.

Called out on this, a new account popped up under the name “ladies man,” presumably to offset the drag queen allegation. This is some very strange behavior.

Next, Zyrus/Rose May/Ladies Man is claiming that the reporting is false because Bluestar Certification Management Inc. (BCMI) is a consulting company, but Bluestar Management Systems (BMS) is the CB, and they are two separate companies. Except they are not.

Zyrus/Rose May / Ladies Man says that the consulting company BCMI does not issue certificates. But on the exact same LinkedIn profile for Rose May Quilicot, it features a graphic that disproves that, too. That graphic includes an image of an ISO 9001 certificate with the logo BCMI, not BMS, despite Zyrus saying they don’t issue certificates. Worse, they issued it to themselves, so it’s BCMI issuing an ISO 9001 cert to BCMI.

In checking the official registry of certs issued by BMS, it appears that the cert was valid at some point but was subsequently withdrawn. The strange part is how the consulting company BCMI put its logo on the certificate. Now, ISO 9001 certs never include the logo of the certified company, and only the logo of the CB. More evidence that this is all the same company.

Then, of course, we have Zyrus’ own LinkedIn profile, which shows him working for both companies anyway. But in the Philippines, only BCMI is registered with the SEC in that country, meaning there is no Philippine office of the BMS at all. The only Philippine office for BMS is, in fact, the consulting company BCMI. And that’s the one that RICL certified to ISO 9001.

The LinkedIn profile for the certification body BMS, meanwhile, lists Zyrus as one of their employees. That may be a LinkedIn glitch, though.

I have more receipts. Here, for example, we see the website for the certification body BMS which features both logos right at the top. It then openly declares that the consulting company BCMI is the legal representative for the CB in the Philippines. In fact, the button at the bottom labeled “Bluestar Management Systems Philippines” actually redirects to the webpage for the consulting company BMCI.

Over at the website for the consulting company, BCMI, its website has an entire page literally called “Certification Services,” which includes statements like, “We operate the certification services in the Philippines and provide Management System Certification to our clients,” and “We provide internationally recognized certificates.”

Then we have an entire page on the page of the consulting company, BCMI, discussing their “certification procedure.” This openly and unambiguously says that it is BCMI (not BMS) who performs the Stage 1 and Stage 2 certification audits, issues the certificate, and then performs ongoing surveillance. There is no ambiguity at all here.

Zyrus’ Bluestar CMI page (again, for the consultancy) has menu options for both consulting and certification, reight next to each other.

And another:

Next, they have an entire page dedicated to the pricing of certification audits performed by BCMI, even including the UAF and IAF logos:

Remember: Zyrus and his alters on LinkedIn have claimed, openly, that they do not provide certification. He’s challenging me to a debate because he feels so strongly about this position. Meanwhile, his own websites say the exact opposite. So, someone is lying, since both things cannot be true at once.

To show his level of professionalism, here is what he wrote me on Facebook:

Want more? I have it. The BCMI homepage has a step-by-step breakdown of just how they do the certification services that Zyrus insists they don’t do. This includes open disclosure that they schedule the adult and provide the certification, all tasks that only a CB can do.

At the bottom of that page, it as a link to another CB, LMS Certification Philippines. That website is a clone of the Bluestar website, but with a different color scheme and logo. LMS is a certificate mill operating out of UAE and — I am serious now — was spamming my Whatsapp as I was writing this, asking me to become their consultant associate.

I cannot imagine Bluestar’s home office would be happy that their Philippines office is using the Bluestar website to market for LMS, their competitor.

The address at the bottom of the LMS Certification Philippines site is the exact same address as he uses for Bluestar Certification Management Inc, which he claims is not a CB.

Next, one of the LMS Certification Philippines websites is actually just a subdomain for the website of the consulting company BCMI anyway:

Finally, we have two “testimonials“ that appear on the BCMI website:

The first is from Industrial Pump Trading Services and overtly thanks Bluestar CMI as being a “reliable certification body.” In checking IAF CertSearch, sure enough, their certificate was issued by Bluestar Management Services. If they are separate companies, as Zyrus claims, why would the client thank BCMI and not BMS? And why would Zyrus publish that on his website?

The second is from Nagasaka Shipyard and thanks BCMI as being a consultant, but that certificate was then granted by the certification body Staunchly Management & System Services, a CB that Zyreus also claims BCMI acts as an “authorized certification audit associate and legal agency in the Philippines” for. So it certainly looks like Bluestar did the consulting, then the auditing, but issued a Staunchly certificate.

All of this is moot because, despite Zyrus / Rose / Ladies Man claiming otherwise, ISO 17021-1 is explicit that not only may a CB not operate a consulting company (whether through a related legal entity or not), it must also take action to stop a consulting company from marketing any single CB. So in this case, the various CBs that Zyrus sells audits for — such as Bluestar India, LMS, A-Mark, etc. — would be required to force him to shut down his website marketing.

Fortunately for the bad guys, these folks are all accredited by UAF or the shadiest IAF members like EGAC, so they get away with it. It’s literally against the rules, but if the rules go unenforced, this is what you get.

So, yes, a CB certified another CB.

UPDATE 8 July 2025: Added new evidence showing Bluestar CMI claiming to be representative for RICL, meaning RICL certified its own sales rep.

UPDATE 10 July 2025: Bluestar Management Systems has fired Oyong and demanded that Bluestar CMI remove all references to them. Read more here.

Advertisements
ISO 45001 Implementation