How to Verify an ISO Certificate: Scope, Validity and Certification Body

To verify an ISO certificate, confirm the certified organization's name, covered locations, applicable ISO standard, certification scope, certificate number, current status, issuing certification body and accreditation status. Use the certification body's official verification system or other recognized verification sources rather than relying only on a PDF certificate or logo."

How Do You Know Whether an ISO Certificate Is Genuine?

An ISO certificate can be an important piece of evidence when evaluating a supplier, contractor, manufacturer or business partner. However, seeing an ISO logo or receiving a PDF certificate is not enough to confirm that certification is current, genuine or relevant to the work being performed.

ISO develops International Standards, but ISO itself does not certify organizations. Certification is carried out by independent certification bodies. ISO defines certification as written assurance from an independent body that a product, service or system meets specified requirements.

This means certificate verification should focus on the organization that issued the certificate, the standard covered, the certified scope, the current certification status and, where applicable, the certification body’s accreditation.

Here is a practical way to perform that verification.

1. Check the Certified Organization’s Name

Start with the legal or registered name shown on the certificate.

The certificate should clearly identify the organization that has been assessed. Compare this name with:

• trade licences;
• contracts;
• purchase orders;
• tender submissions;
• supplier-registration documents; and
• official company information.

Minor differences in abbreviations may sometimes occur, but a completely different legal entity should be investigated.

If a group has several companies, do not automatically assume that certification issued to one company covers every related organization.

Certification applies to the organization and scope identified through the certification process.

2. Check Which Locations Are Covered

A company may operate several offices, factories, warehouses, branches or project locations, but its certificate may cover only some of them.

Look for site addresses or references to certified locations.

For multi-site certification, the certificate or associated schedule may identify the head office and additional locations.

This matters when verifying suppliers. A certificate covering a head office in one country does not automatically prove that a separate manufacturing facility is included.

If the locations are unclear, request confirmation from the issuing certification body.

3. Check the Standard and Edition

The certificate should identify the standard against which the management system was assessed.

Examples may include:

• ISO 9001 for Quality Management Systems;
• ISO 14001 for Environmental Management Systems;
• ISO 45001 for Occupational Health and Safety Management Systems; or
• ISO 22000 for Food Safety Management Systems.

The edition or publication year should also be reviewed.

Standards can be revised over time, and certified organizations may be required to transition to a newer edition under applicable transition arrangements.

Do not judge certificate validity only because an older edition appears on it. Check whether an official transition period applies and confirm the certificate’s current status with the certification body.

4. Read the Certification Scope Carefully

The scope of certification is one of the most important parts of the certificate.

It describes the activities that were included in the certification assessment.

For example, a company’s scope might cover: “Manufacture and supply of plastic packaging products.”

That does not necessarily demonstrate conformity for unrelated activities such as construction, IT services or food production.

When reviewing a supplier’s certificate, compare the certified scope with the products or services you intend to purchase.

A genuine certificate may still be irrelevant to your requirement when its certified scope does not cover the activity being evaluated.

This is particularly important in tender evaluation, vendor approval and supply-chain due diligence.

5. Check the Certificate Number

A properly controlled certificate will normally contain a unique certificate or registration number.

Use that number when contacting the certification body or searching its certificate-verification system.

NORMEIRA, for example, provides a public Client Directory that allows users to search using the company name or certificate number.

When a certificate number cannot be found, do not immediately conclude that the certificate is fraudulent. There may be a data-update issue, legacy numbering or another administrative reason.

Instead, contact the issuing certification body through independently verified contact details.

6. Check Issue, Expiry and Current Status

Look for relevant dates such as:

• original certification date;
• issue date;
• current-cycle date; and
• expiry date.

However, dates alone do not always confirm current validity.

Management-system certification normally includes ongoing activities after initial certification. Certificate status can change if certification is suspended or withdrawn.

Therefore, where the certificate is being used for a tender, regulatory requirement, supplier approval or major commercial decision, check its current status, not simply the printed expiry date.

NORMEIRA maintains formal processes dealing with certificate suspension and withdrawal as part of its certification controls.

7. Verify the Certification Body

Next, identify who actually issued the certificate.

Do not confuse:

• ISO;
• an accreditation body;
• a consultant; and
• a certification body.

ISO develops standards. Independent certification bodies conduct certification audits and issue certificates. Accreditation bodies, in turn, assess certification bodies against applicable accreditation requirements.

The certificate should clearly identify the issuing certification body.

Visit the certification body’s official website rather than relying only on telephone numbers or links printed in an emailed PDF.

8. Check Whether the Certification Is Accredited

If the certificate claims accredited status, verify that claim separately.

ISO explains that accreditation provides independent confirmation of a certification body’s competence, although accreditation is not mandatory for every certification activity. ISO also notes that lack of accreditation does not automatically mean a certification body is disreputable.

In the UAE, EIAC accredits management-system certification bodies against ISO/IEC 17021-1 and associated requirements for specific schemes.

Check:

• the name of the accreditation body;
• whether the certification body is listed by it;
• whether the relevant certification scheme is covered; and
• whether the client’s activity falls within the applicable accredited scope.

An accreditation logo on a certificate should not be treated as sufficient evidence by itself.

9. Use Official Verification Sources

ISO currently recommends checking accredited certification through recognized verification channels such as the certification body, the relevant accreditation body or the global certification database referenced by ISO.

For NORMEIRA-issued certificates, the official Certificate Verification facility links to NORMEIRA’s Client Directory, where users can search by company name or certificate number.

For legacy TUV Apex certificates, NORMEIRA states that existing certificates continue according to their original scope, validity period and certification conditions and should be verified through NORMEIRA’s official verification process.

Common Warning Signs to Investigate

Additional verification may be necessary when:

• the issuer cannot be identified;
• the company name differs significantly from the certificate;
• the certification scope appears unusually broad;
• dates have been manually altered;
• the certificate number cannot be confirmed;
• an accreditation claim cannot be verified;
• the certification-body website does not list a verification method; or
• the organization claims certification for activities outside the stated scope.

These points do not independently prove fraud. They are signals that further confirmation is appropriate.

Frequently Asked Questions

Does ISO issue ISO certificates?

No. ISO develops International Standards but does not certify organizations. Independent certification bodies carry out certification.

Is an ISO certificate valid simply because it has not expired?

Not necessarily. Current certification status should also be checked because certification may be suspended or withdrawn before the printed expiry date.

Can one ISO certificate cover several branches?

Yes, depending on the approved certification scope and certification arrangement. The included locations should be confirmed rather than assumed.

Is accreditation the same as certification?

No. Certification assesses an organization against specified requirements. Accreditation formally recognizes that a certification body operates according to applicable international requirements.

Final Verification Principle

A reliable certificate check should answer four questions:

Who was certified? What activity was certified? Who issued the certificate? Is the certification currently valid and appropriately recognized?

Checking these details helps procurement teams, customers and other interested parties make better decisions rather than relying only on an ISO logo or certificate image.

For certificates issued by NORMEIRA, use the Certificate Verification facility on NORMEIRA website. NORMEIRA’s accredited schemes and approved scope information can also be reviewed through its Our Accreditation page.