An ISO certificate can influence a supplier approval, tender decision, export transaction or customer audit. Yet a PDF carrying a standard number and a certification mark does not, by itself, answer the questions a buyer needs resolved: Was the correct legal entity certified? Does the stated scope cover the product, service or site being purchased? Was the issuing certification body competent and, where required, accredited for that standard and sector? Is the certificate current and correctly represented?
Certificate verification is therefore a structured due-diligence exercise, not a quick visual check. This guide explains how procurement, quality, compliance and supplier-assurance teams can verify an ISO management-system certificate, use public registers intelligently and retain evidence of the decision. It also explains the 2026 transition from IAF and ILAC to Global Accreditation Cooperation Incorporated (Global ACI).
1. Why certificate verification must go beyond the PDF
A certificate is a time-bound statement about a defined organisation, management system, scope and set of locations. Buyers often make avoidable mistakes when they treat it as a general endorsement of everything a supplier does. A company certified for one manufacturing site may operate other sites outside the certificate. A certificate covering design and manufacture may not cover installation or servicing. A certificate may also be suspended, withdrawn, expired or superseded after a buyer first receives a copy.
The commercial question is not simply, “Does the supplier have ISO 9001?” It is, “Does this particular certificate provide relevant, current evidence for the legal entity, activities, sites and contractual requirements in this purchase?” Record the answer against the actual purchase decision.
2. Understand certification, accreditation and registration
Certification is written assurance from an independent conformity-assessment body that a defined product, service, process or management system meets specified requirements. Accreditation is a separate recognition: an independent accreditation body assesses whether a conformity-assessment body is competent to perform defined activities. These are different levels in the confidence chain.
For example, a manufacturer may hold an ISO 9001 certificate issued by a certification body. That certification body may, in turn, be accredited by a national accreditation body for ISO 9001 certification in specified economic sectors. The manufacturer is certified; the certification body is accredited. A database entry or logo should never blur these roles.
Accreditation is not compulsory in every context. ISO explains that accreditation provides independent confirmation of competence, but a non-accredited certification body is not automatically disreputable. The buyer must determine whether the tender, regulator, customer contract or internal policy requires accredited certification. See ISO’s guidance on certification and conformity assessment.
3. Obtain a complete, legible certificate and its supporting details
Ask the supplier for the complete certificate, including every page, annex, schedule and site appendix. A cropped image or first page may omit the scope, address, exclusions, multi-site details or accreditation information. Capture the certificate number exactly as printed, including prefixes, separators and suffixes.
Ask for the certification body’s official verification link or contact channel if one is not printed. Use contact information independently obtained from the certification body’s own website or the accreditation body’s register, not only a phone number or email supplied in an attachment.
4. Match the certified legal entity to the supplier you are buying from
Compare the certificate holder’s full legal name with the supplier named in the purchase order, contract, invoice and company registration records. Similar trading names are not enough. A parent company’s certificate does not automatically cover a subsidiary, franchise, joint venture or recently acquired business. If the supplier uses a trading name, ask for evidence linking it to the certified legal entity.
Check the registered address and the operational site address. For a group with several factories, warehouses or service centres, identify which locations are included and what activities each performs. A head-office certificate should not be assumed to cover every branch unless the certificate and certification arrangement explicitly establish that coverage.
5. Read the scope statement as a purchasing requirement
The scope is often the most commercially important part of the certificate. It describes the activities, products, services or processes covered by the certified management system. Compare that wording with the supplier’s actual role in your transaction. “Manufacture of metal components” may not cover design, surface treatment, installation or repair. A generic “trading” scope may not demonstrate control over a manufacturing process performed by another legal entity.
Look for exclusions, limitations, product families, site restrictions and wording that narrows the certified activities. Do not expand a scope by implication. If your contract requires design and manufacture but the certificate only covers manufacture, record the gap and ask for clarification or additional evidence.
Also distinguish management-system certification from product certification. ISO 9001 certification concerns a quality management system; it does not certify that each product meets a technical specification. Product conformity may require separate testing, inspection, regulatory approval or product certification, depending on the market and product.
6. Confirm the standard and edition are the ones your contract requires
Check the full standard designation and edition printed on the certificate. “ISO 9001” without an edition or an explanation of the applicable version may be insufficient for a controlled supplier-approval process. Compare the certificate with the edition named in the tender, customer specification or regulatory framework. Where a standard has been revised, determine whether an official transition period applies and whether the supplier’s certificate is still within the permitted transition arrangements.
7. Verify the certification body that issued the certificate
Identify the exact legal name of the certification body, not just a logo or abbreviated trading name. Check its official website, address, certificate-verification facility and contact details. If the certification body has changed its name, merged or transferred a certification portfolio, ask it to confirm the certificate number and the legal entity now responsible for the certification record.
Where the buyer requires accredited certification, the next step is to verify the body’s accreditation status for the relevant activity. A certification body may be accredited for one standard or sector but not another. Accreditation for ISO 9001 does not automatically establish accreditation for ISO 14001, ISO 45001, product certification or every industry code.
For management-system certification, ISO/IEC 17021-1 is the core competence standard used for bodies providing audit and certification of management systems. Other conformity-assessment activities use different standards. The National Accreditation Board for Certification Bodies (NABCB) lists its accreditation schemes, including management systems, product certification, inspection and validation/verification.
8. Check the accreditation body and the precise scope of accreditation
Find the accreditation body named on the certificate or accreditation mark. Confirm that the accreditation body is recognised for the relevant activity and that the certification body appears in its official directory. Then inspect the scope, not merely the directory listing. The scope should cover the certification standard and, where applicable, the economic sector or technical area relevant to the supplier’s certified activities.
Check the accreditation body’s current status, the certification body’s accreditation number, the applicable standard used to assess the certification body and any restrictions, suspensions or scope reductions. A body can be accredited for a limited set of sectors. If the supplier operates in a sector outside that scope, ask the accreditation body or certification body for written clarification before treating the certificate as accredited for that activity.
9. Use IAF CertSearch as a verification tool, not as the only test
IAF CertSearch is a global database for checking accredited management-system certifications. Search by the certified organisation, certificate number or other available details. Open the entity and certificate records rather than relying on an autocomplete suggestion. Compare the displayed legal name, location, standard, certification body and status with the document supplied by the vendor.
CertSearch data is uploaded by certification bodies and accreditation bodies and is subject to data matching. The platform’s own guidance explains that certification records are added through uploads and that unmapped data can be missing from the system. Therefore, a search result is a valuable independent cross-check, but a missing result should not be treated as conclusive proof that a certificate is false or invalid.
Record the exact search terms, date, result and any differences. If the certificate is found but the site, scope or status does not match, stop the approval and request confirmation from the issuer and accreditation body. If the certificate is not found, follow the escalation process in section 14 rather than approving or rejecting it automatically.
10. For Indian suppliers, check the relevant NABCB records
For an Indian certification body, use the official NABCB website and its scheme-specific registers. Search the certification body’s legal name and accreditation number. Open the relevant management-system or product-certification record and compare the accreditation standard, scope, validity period and status with the certificate under review.
11. Understand the 2026 transition to Global ACI
On 1 January 2026, Global Accreditation Cooperation Incorporated (Global ACI) became fully operational, assuming the former roles of the International Accreditation Forum (IAF) and the International Laboratory Accreditation Cooperation (ILAC). Its Global ACI Multilateral Recognition Arrangement (MRA) provides the international recognition framework for the relevant accredited conformity-assessment scopes. See the Global ACI website and its 1 January 2026 launch announcement.
This transition does not mean that an otherwise valid certificate automatically became invalid on 1 January 2026. Global ACI’s official Q&A explains that recognition continues through the new framework and that transitional arrangements govern the former IAF MLA and ILAC MRA marks. As of 7 November 2026, Global ACI’s published Q&A states that the new Global ACI MRA Mark is not yet authorised for use by Full Members pending the formal decision and economy-specific legal availability process. Eligible members may continue using the former marks under the transition rules.
For buyers, the practical lesson is simple: do not reject a certificate merely because it displays an IAF MLA or ILAC MRA mark after the transition date. Equally, do not assume that any organisation may continue using those marks. Verify the accreditation body’s current Global ACI MRA status, scope and mark guidance using official records. The mark is supporting evidence; the underlying accreditation and scope are what must be checked.
12. Check status, dates and changes over the certificate lifecycle
Compare the original issue date, current issue or revision date, expiry date and surveillance or recertification information. A certificate that has not reached its printed expiry date can still be suspended or withdrawn. Conversely, a certificate may be subject to an authorised transition or administrative update. The status must be confirmed with the issuer or relevant register, especially before a high-value award or renewal.
13. Recognise warning signs and investigate them consistently
Warning signs include inconsistent certificate numbers, misspelled legal names, altered dates, a scope that does not match the supplier’s activities, an issuer that cannot be independently contacted, accreditation claims unsupported by a register, missing site annexes, or a logo used outside its permitted rules. A certificate that says “ISO approved” or suggests ISO itself issued it is also a reason to ask questions: ISO develops standards but does not certify organisations.
14. What to do when a certificate is not found online
First, repeat the search using the exact certificate number, legal name and location shown on the document. Try the certification body’s own verification portal and the accreditation body’s directory. Check whether the database covers the relevant scheme and whether the issuing body uploads records to it. Some certificates, schemes or non-accredited certifications may not appear in a particular global database.
Next, email the certification body using an address from its official website and ask it to confirm the certificate number, holder, scope, sites, status and issue/expiry dates. If accredited status is part of the buyer’s requirement, ask the accreditation body to confirm the certification body’s accreditation scope and status on the relevant dates. Do not ask the supplier to forward an unverified email and treat that alone as independent confirmation.
If confirmation remains unavailable, classify the result as “verification pending” or “not independently confirmed” according to your procurement procedure. Do not silently convert an inconclusive search into a pass. A non-accredited certificate may still be acceptable where the contract permits it, but the decision should be explicit and risk-based.
15. Build a repeatable supplier-verification workflow
Make verification part of supplier onboarding rather than a one-time administrative task. Define which suppliers must hold certification, which standards and editions are acceptable, whether accreditation is mandatory, which sites and activities must be covered, and who has authority to approve exceptions. Align the criteria with the contract, regulatory requirements, customer specifications and the risk of the supplied product or service.
Use a controlled register with fields for supplier legal name, certificate number, standard and edition, scope, covered sites, certification body, accreditation body, accreditation scope, issue date, expiry date, current status, verification source, date checked, reviewer and next review date. Restrict editing rights and retain evidence of changes. A spreadsheet can work for a small supplier base; larger organisations may integrate the same fields into supplier-management software.
For related guidance, see Shark Certification’s articles on supplier declarations and responsible sourcing, internal audit evidence and competence and manufacturing traceability and audit evidence.
16. A 15-point ISO certificate verification checklist
- Obtain the complete, legible certificate and all annexes.
- Record the certificate number exactly as printed.
- Match the certificate holder to the supplier’s legal entity.
- Confirm the delivery site is included in the certified site list.
- Read the scope and compare it with the contracted activities.
- Check exclusions, limitations and any site-specific wording.
- Confirm the standard designation and edition required by the contract.
- Identify the certification body by its full legal name.
- Verify the certification body through its official contact or portal.
- Identify the accreditation body where accredited certification is required.
- Check the accreditation body’s recognition status and the issuer’s current scope.
- Search IAF CertSearch and record the exact result or non-result.
- For Indian issuers, check the relevant NABCB or other applicable accreditation register.
- Confirm current certificate status, dates, sites and any scope changes with the issuer when necessary.
- Record the reviewer, evidence, decision, exceptions and next review date.
A clear “pass” should mean that the certificate is authentic, current, relevant to the supplier and acceptable under the buyer’s defined requirements. If any critical point is unresolved, document the gap and obtain independent confirmation before relying on the claim.
17. Frequently asked questions
How can I verify an ISO certificate online?
Start with the certificate number and legal entity name. Search IAF CertSearch for accredited management-system certifications, then compare the result with the certificate. Also check the certification body’s official verification facility and the relevant accreditation body’s directory. If records differ or no result appears, contact the issuer independently.
Does every valid ISO certificate appear in IAF CertSearch?
No. CertSearch contains records uploaded to the platform and matching depends on data supplied by participating certification and accreditation bodies. A missing search result is not, by itself, proof that a certificate is invalid. Seek confirmation from the issuer and accreditation body.
Is a non-accredited ISO certificate automatically fake?
No. ISO states that accreditation is not compulsory and that non-accreditation does not automatically mean a certification body is not reputable. However, a buyer may require accredited certification by contract, regulation or policy. Check the requirement before deciding whether a non-accredited certificate is acceptable.
Does ISO issue ISO 9001 or ISO 14001 certificates?
No. ISO develops and publishes standards but does not audit or certify companies. Independent certification bodies issue management-system certificates. Accreditation bodies separately assess the competence of certification bodies for defined scopes.
Are IAF marks on certificates still acceptable after 1 January 2026?
They may be used under Global ACI’s transitional arrangements by eligible members, subject to the applicable rules and economy-specific transition process. Check the current Global ACI Q&A and the relevant accreditation body’s register rather than judging validity from the mark alone.
Conclusion: make verification part of supplier control
A reliable certificate decision connects five things: the right legal entity, the right scope and sites, the right standard edition, a verifiable certification body and—where required—an accreditation scope that covers the activity. Public databases accelerate the process, but they do not replace careful comparison and direct confirmation when records are unclear.
Shark Certification Private Limited provides certification, consultancy and training services. Organisations reviewing their certification requirements or building a more structured compliance programme can learn more about Shark Certification or contact the team for a consultation. The appropriate route depends on the applicable standard, scheme, regulatory requirement and the organisation’s scope; no certificate or accreditation outcome should be assumed in advance.
Image credits: Illustrative Unsplash photographs by Meggy Xue, MJ Duford, 2H Media and Beatriz Pérez Moya. Images are illustrative stock photographs and do not depict Shark Certification audits, clients or issued certificates.
