How to Upgrade Your Integrity Framework Tier in 3 Steps

How to upgrade integrity framework tier is the structured process of advancing an organization's integrity program from one maturity level to the next by satisfying defined prerequisites, executing a documented upgrade sequence, and embedding post-upgrade controls. The Integrity Framework at theintegrityframework.org implements this by mapping each tier transition to specific evidence requirements, named checkpoints, and a verification workflow that confirms readiness before any tier designation is formally changed.

Step-by-Step Tier Upgrade Process

Most organizations stall at their current tier not because they lack capability, but because no one has written down the actual sequence of steps required to advance. This section gives you that sequence, in order, with nothing left vague.

Step 1: Confirm Your Current Tier Standing

Before you do anything else, generate a current-state Tier Report from your integrity management dashboard. The report will output your active tier (Tier 1 through Tier 4), your last audit date, and any open non-conformances that must be closed before an upgrade application is accepted.

If you do not have dashboard access, contact your assigned Integrity Framework coordinator. Do not skip this step. Applying for an upgrade while open findings exist is the single most common reason applications are rejected on the first submission.

Step 2: Complete the Tier Upgrade Application Package

The application package has three components:

1. Self-Assessment Questionnaire (SAQ). Download the version specific to your target tier. Tier 2 and Tier 3 SAQs are not interchangeable. Fill out every field. Partial submissions are automatically returned.
2. Evidence Bundle. Attach the documents listed in the Evidence Requirements Matrix for your target tier. Common examples include signed policy acknowledgments, training completion records, and third-party audit reports no older than 18 months.
3. Sponsor Attestation Form. A named executive sponsor (director level or above) must sign the attestation confirming organizational commitment to the new tier's obligations.

Submit the complete package through the Integrity Framework portal under My Organization > Tier Management > Submit Upgrade Request.

Step 3: Undergo the Verification Review

After submission, a Verification Analyst is assigned to your case within 5 business days. The analyst will schedule a 60-minute structured review call. During this call they will:

• Cross-check evidence bundle items against the SAQ responses.
• Ask clarifying questions about any gaps or ambiguities.
• Confirm that your operational controls are live, not just documented on paper.

If the review passes, your tier designation is updated in the registry within 10 business days. You will receive a confirmation email and a new tier certificate in PDF format. If the review identifies deficiencies, you receive a Remediation Notice with a 30-day window to correct and resubmit. There is no penalty for one remediation cycle, but a second consecutive failure triggers a mandatory 90-day waiting period before reapplication.

Prerequisites and Eligibility Requirements

Eligibility is not optional reading. Getting past the application stage requires meeting hard prerequisites. Treat this section like a checklist, not background information.

Minimum Time-in-Tier Requirement

Every tier has a minimum residency period before an upgrade is available:

These windows exist to ensure operational maturity, not to slow you down. An organization that achieved Tier 2 designation on March 1 cannot submit a Tier 3 upgrade application before March 1 of the following year. The portal will block early submissions automatically.

Closed Non-Conformances

All findings from your most recent audit cycle must be marked Closed – Verified before you submit. "Closed – Pending" does not count. If your audit identified 4 findings and 3 are verified closed while 1 is still pending, your application will be rejected at the intake screening stage. Close everything first, then apply.

Active Participation Record

Your organization must have submitted at least 2 Integrity Check-In Reports within the 12 months preceding your upgrade application. These are the quarterly or semi-annual narrative reports documenting ongoing program activity. Organizations that went dormant and are trying to "jump" a tier by catching up all at once are ineligible. The framework rewards consistent practice, not last-minute cramming.

Named Roles Filled

The upgrade to Tier 3 and above requires that the following roles be formally designated and documented in your organizational chart:

• Integrity Officer (or equivalent title): responsible for day-to-day program oversight.
• Executive Sponsor: the director-level signatory mentioned in the application package.
• Tier Coordinator: the operational contact for the Verification Analyst.

Tier 1 to Tier 2 upgrades do not require all three roles, but at minimum an Integrity Officer must be named.

Common Upgrade Pitfalls to Avoid

These are the mistakes that appear repeatedly across upgrade applications. Knowing them ahead of time saves you a remediation cycle and, in some cases, the 90-day waiting penalty.

Submitting the Wrong SAQ Version

The Integrity Framework updates its SAQ documents annually, usually in January. Organizations sometimes download the current-year SAQ for their current tier rather than their target tier, or they use a cached PDF that is 14 months old. Both scenarios cause rejection at intake.

Fix: Always download a fresh copy of the SAQ directly from the portal on the day you start your application. Do not use a file someone emailed you six months ago.

Evidence That Is Too Old

The Evidence Requirements Matrix specifies maximum document ages. A third-party audit report must be no older than 18 months. Training completion records must cover the current program year. Policy acknowledgment logs must reflect the most recently published policy version.

Organizations frequently submit evidence that was sufficient at the time of their last audit but has since aged out. Review every document against the matrix before you bundle and upload.

Executive Sponsor Not Actively Engaged

The Sponsor Attestation Form is not a rubber-stamp formality. During the Verification Review call, the analyst may ask whether the executive sponsor has reviewed the SAQ. If the answer is effectively "they just signed what HR put in front of them," the analyst will note this as a culture-of-compliance concern. That note goes into the case file and can influence the outcome.

Get your executive sponsor to spend 30 minutes actually reading the SAQ before signing. That is not a large ask for something this important.

Conflating "Documented" With "Operational"

This is the most consequential mistake on this list. An organization might have a beautifully written Integrity Policy that was approved by legal and posted on the intranet. But if employees cannot tell the Verification Analyst where to find it, or if training on the policy has not been delivered, the policy is documented but not operational.

The verification review is specifically designed to probe this gap. Be ready to demonstrate that controls are functioning in practice, not just filed in a SharePoint folder.

Missing the 30-Day Remediation Deadline

If you receive a Remediation Notice, the 30-day window starts on the date of the notice, not the date you first open the email. Organizations that treat remediation as lower priority than day-to-day work sometimes miss the window by a few days and trigger the 90-day reapplication hold. Set a calendar reminder the same day you receive the notice.

Post-Upgrade Implementation Best Practices

Getting the new tier designation is the beginning, not the end. The most common reason organizations lose a tier at their next review is that they treated the upgrade as a finish line rather than a new baseline.

Update Your Internal Governance Documents Immediately

Within 5 business days of receiving your tier certificate, update the following:

• Your organization's formal Integrity Program Charter to reflect the new tier.
• Any vendor or partner agreements that reference your integrity tier designation.
• Your internal compliance calendar to include the new reporting and audit cadence required at the higher tier.

Do not wait for your next quarterly review cycle to do this. Governance documents that still reference your old tier create confusion and can create compliance gaps if obligations at the new tier started accruing from the designation date.

Brief Your Team on New Obligations

Higher tiers carry additional obligations. Tier 3 and Tier 4 require more frequent Check-In Reports and broader employee training coverage than lower tiers. Brief your Integrity Officer, Tier Coordinator, and relevant team leads on exactly what changed and when the first new obligation falls due.

A 30-minute internal briefing immediately after upgrade confirmation prevents the "I didn't know we had to do that now" problem that shows up at the next audit.

Establish a Running Evidence File

Start collecting evidence for your next audit cycle from day one of the new tier. Use a shared folder structure that mirrors the Evidence Requirements Matrix for your current (newly upgraded) tier. Every time a relevant event occurs, such as a training session, a policy review, or an ethics hotline interaction, log and file the documentation immediately.

Organizations that collect evidence in real time breeze through audits. Organizations that reconstruct evidence six weeks before an audit deadline find that documents are missing, timestamps are disputed, and participation records are incomplete.

Schedule Your First Tier Health Check at 6 Months

Set a formal internal review at the 6-month mark post-upgrade. This is not a full audit. It is a 2-hour internal check-in where your Tier Coordinator walks through the active obligations, confirms the evidence file is current, and identifies any gaps while there is still time to close them before the annual audit.

Treat this like a pre-flight check. Small issues caught at 6 months are easy to fix. The same issues caught at 11 months become expensive.

Timeline and Resource Planning

Upgrading tiers takes real time and real resources. Plan for both so the process does not stall mid-execution.

Realistic Timeline Estimates

Here is a practical timeline for a well-prepared organization working through a Tier 2 to Tier 3 upgrade:

Organizations that start the process while still carrying open findings, or that need to commission a new third-party audit because their previous one aged out, should add 6 to 12 weeks to the estimate.

Staff Time Required

Do not underestimate the internal labor involved. A realistic breakdown for a mid-sized organization:

• Tier Coordinator: 20 to 30 hours across the full process.
• Integrity Officer: 10 to 15 hours, primarily on SAQ completion and evidence review.
• Executive Sponsor: 2 to 3 hours, including SAQ review and attestation signing.
• Supporting team members: 5 to 10 hours total, primarily for locating and formatting evidence documents.

If your Tier Coordinator is also carrying a full operational workload, block their calendar explicitly for this project. Trying to run the upgrade application in the margins of another job is a reliable way to miss deadlines.

Budget Considerations

Three cost items deserve attention:

1. Third-party audit fees. If your current audit report is approaching the 18-month limit, you may need to commission a fresh one before applying. Budgets vary widely by organization size and audit scope, but plan for this well in advance. Audit firms often have 4 to 8 week lead times.
2. Training updates. Moving to a higher tier sometimes requires extending training to a broader employee population or introducing new training modules. Factor in content development or licensing costs if you are not building in-house.
3. Portal fees. Confirm with your Integrity Framework coordinator whether a tier upgrade carries an administrative processing fee. Fee structures can vary based on organization type and membership category.

What to Do If You Are Not Ready

If you run through this timeline and realize you cannot realistically meet the prerequisites within your target window, do not force the application. A rejected application does not cost you anything except a remediation cycle, but a pattern of incomplete applications or unresolved findings draws scrutiny at future reviews.

Instead, use the time to close findings, commission that audit, and build out your evidence file. A well-prepared application submitted 3 months later is better than a rushed application submitted now. The portal will still be there. The prerequisites will still be achievable. There is no competitive rush to upgrade a tier, only an organizational benefit to doing it correctly.

Ready to start your upgrade? Log into the Integrity Framework portal, pull your current Tier Report, and work down this checklist from the top. The process is clear when you have the full picture in front of you, and now you do.