Verify ISO 22000 certificate details before you approve a food supplier, and spot a fake one

Where to check an ISO 22000 certificate

A food supplier's certificate usually arrives as a scanned PDF in an approval pack, and a scan tells you nothing about whether the certificate is still in force. Use three independent sources, and find each one through your own search rather than a link, QR code or phone number printed on the document.

1. IAF CertSearch

IAF CertSearch is the global database of accredited management system certifications. It kept its name after Global ACI took over the roles of IAF and ILAC on 1 January 2026. Search by company name or certificate number and compare every field with the paper: legal entity, address, standard, scope and expiry. The database relies on certification and accreditation bodies to feed it, so a missing record is a reason to ask the issuer, not yet a verdict.

2. The certification body's register

The body that issued the certificate is the authority on its status. Ask for written confirmation that the certificate is current and what products and sites it covers.

3. The accreditation body's directory

The certificate should carry the accreditation body's symbol and an accreditation number. Look that number up in the accreditation body's own directory and confirm three things: the same legal entity, accreditation that is current, and a scope that includes food safety management system certification to ISO 22000 under ISO/IEC 17021-1 and the food-sector rules of ISO 22003-1. Accreditation bodies typically list the food chain categories each certification body may certify; your supplier's category should appear there. Finally, confirm the accreditation body itself is recognised through the Global ACI arrangement. Our guide to choosing an ISO 22000 certification body covers the other side.

What a genuine ISO 22000 certificate shows

Accredited certificates follow the content ISO/IEC 17021-1 sets out, and a food certificate adds detail you can test against your purchase. Expect to find:

• The certification body: its name and address, with an authorised signature.
• The accreditation mark: the accreditation body's symbol and the certification body's accreditation number.
• The certified organisation: its legal name and the address of each certified site, often in a site schedule for groups.
• The scope: products or product groups, processes and activities, written plainly enough to check, for example "processing and packing of frozen cooked shrimp" rather than "food products".
• The food chain category: many certificates state the category or subcategory from ISO 22003-1; if yours does not, the certification body can confirm it.
• Standard and dates: ISO 22000:2018, sometimes shown with Amendment 1:2024; a unique certificate number; issue and original certification dates; and an expiry no more than three years out.

A match on the register is true only on the day you checked it. Annual surveillance keeps it true, and our guide to ISO 22000 surveillance and recertification explains the cycle.

ISO 22000, FSSC 22000 and HACCP certificates compared

These three documents are not interchangeable, and a genuine one of the wrong kind can still fail your customer's requirements. The full comparison sits in our guide to HACCP vs ISO 22000 vs FSSC 22000; this table shows what each proves at the point of verification.

If a retailer or brand owner requires GFSI-recognised certification from your suppliers, an ISO 22000 certificate, however genuine, does not meet that requirement by itself.

Warning signs of a fake or misleading food safety certificate

Problem certificates are forged, unaccredited, or genuine but narrower than the supplier implies.

• An unaccredited issuer: no accreditation mark, a mark from a body not recognised through Global ACI, or wording such as "accredited by IAF" or "ISO approved". Neither IAF nor Global ACI accredits certification bodies, and ISO certifies no one.
• Accreditation that stops short of food: a body accredited for quality or environmental management using its mark on an ISO 22000 certificate, or accredited for food but not for the supplier's category.
• A scope that leaves out what you purchase: dry goods certified while you receive chilled products, one factory certified while your orders ship from another, or trading and storage certified while processing is subcontracted.
• A category mismatch: a certificate for storage and distribution held by a company that manufactures, or for packaging when it supplies ingredients.
• Dates that do not work: expired, undated, valid for more than three years, or reissued many times without a change of number.
• The consultant as issuer: a "certificate" from the firm that built the system. Accredited certification bodies may not also consult on the system they certify.
• Speed: a supplier certified within days of starting, with no Stage 1 readiness review or Stage 2 audit on site.

The last point matters most in food. A working system needs validated control measures, PRPs in place and weeks of monitoring, verification and traceability records before any auditor can sample them. A certificate that skipped that work leaves the hazards uncontrolled, and the first customer audit or recall will expose it.

ISO 22000 certificate verification checklist

File the date, source and result of each check with the supplier's approval record, and repeat the status check at each annual review.

What to do if a supplier's certificate is fake or does not cover you

A single failed check is not proof of forgery. Certificates are renumbered, change bodies and reach databases late.

1. Ask the supplier first: request the current certificate, the site schedule and the certification body's contact details, with a deadline for the reply.
2. Contact the certification body directly, using details you found yourself, and ask for written confirmation of status, entity, sites and scope. It will confirm validity; it will not share the audit report.
3. Report a forgery to the certification body named on it and to the accreditation body whose symbol appears. Keep the document and the correspondence, and take legal advice before any contractual step.
4. Treat a genuine but unaccredited, lapsed or out-of-scope certificate as a supply risk: hold or increase incoming inspection, run your own supplier audit, agree a dated plan for accredited certification that covers your products, or source elsewhere. Record the decision and who took it.

ISO 22000 certificate checks: questions buyers ask