How to verify ISO 45001 certificate validity for a contractor or supplier, and spot a fake one

Why a safety certificate deserves a second look

An ISO 45001 certificate often decides who comes through your gate: principal contractors, plant operators and facility owners ask for it at prequalification. Yet it proves only that an accredited body once found an OH&S management system conforming, for a stated scope and stated sites. If the body did not exist, the scope was an office, or the certificate lapsed last year, the paper in your file looks the same.

Your own system asks for the check too. ISO 45001 places procurement, contractors and outsourcing under clause 8.1.4, within Operation, and an unconfirmed certificate is a weak control on contractor risk. The full prequalification-to-permit process is in our guide to ISO 45001 contractor management; this page covers one step, proving the certificate is real and relevant.

Where to verify an ISO 45001 certificate

Use four sources in turn; the holder's website or an emailed PDF is not one of them.

The certification body that issued it

Only the issuer can say whether its certificate is current today, and an accredited body will confirm the status of one it issued when asked. Find its register or contact details through your own search, never through a link or QR code printed on the document; a forger controls where those lead.

IAF CertSearch

This worldwide database of accredited management system certifications kept its IAF name after Global ACI took over the functions of the IAF and ILAC. Search by company or certificate number and compare the record with the document: legal name, standard, scope, sites and dates. Certification and accreditation bodies supply its data, so an empty result is a question for the issuer, not a verdict.

The accreditation body's directory

An accredited certificate carries an accreditation body's mark, usually a national body's, often with the certification body's accreditation number. In that directory confirm the same legal entity, an active accreditation, and a scope including ISO 45001 for the kind of work certified; our guide to choosing an ISO 45001 certification body explains how to read it.

Global ACI's recognised accreditation bodies

Certification bodies are accredited to ISO/IEC 17021-1 by an accreditation body recognised through the Global ACI arrangement, which replaced the IAF MLA and ILAC MRA on 1 January 2026. Its published list can be filtered by economy and by scopes such as management systems certification. An accreditation body absent from it gives the certificate no international recognition, however official its seal.

What a genuine ISO 45001 certificate shows

ISO/IEC 17021-1 sets what an accredited body's certification documents must identify. Read each item against the register:

• The legal entity you contract with, not a group or trading name.
• Every certified site, often in a site schedule.
• A scope naming the operational work, such as installation, maintenance or haulage, not only administration.
• The standard as ISO 45001:2018. The climate action amendment of 2024 did not change the year of publication, so certificates were not reissued and need not mention it.
• A unique certificate number.
• Dates that fit a three-year cycle.
• The certification body's name and address, and, for accredited certification, the accreditation body's mark with the relevant number.

Even a perfect match is a snapshot: surveillance audits run at least once a calendar year, and a certificate can be suspended or withdrawn between them while the printed copy stays unchanged. The cycle is explained in our surveillance and recertification guide.

Signs of a fake or misleading OH&S certificate

Forgeries exist, but a real document that promises more than it delivers is commoner.

• An OHSAS 18001 certificate offered as current. The migration period for accredited certificates ended on 30 September 2021, so any OHSAS 18001 certificate shown today is out of date.
• No recognised accreditation. No accreditation mark, a mark from a body missing from Global ACI's list, or an accreditation number the directory does not recognise.
• An office scope for field work. The certificate covers "project management" at a head office while the crews who will work at height on your site fall outside it; for work at temporary sites, the scope should still name that work.
• The wrong company. The holder is a parent, an affiliate or a previous entity, not the one on your purchase order.
• No sign of a site audit. IAF MD 22 requires the audit to evaluate the system during operational activities, such as a tour of facilities and work sites, and IAF MD 5 allows remote methods only where they do not replace witnessing risk control. Certification from documents alone is not accredited certification.
• Speed and guarantees. Certification promised within days, at one price for any standard, with the outcome assured. Hazard identification, a legal register, worker consultation, drills and an internal audit take months to produce evidence; ten days from enquiry to certificate is a warning, not a service level.
• Claims no accredited body makes. The ISO logo, "certified by ISO", or "ISO 45001 compliant" in place of a certificate number. ISO certifies no one and does not allow its logo to be used in connection with certification, so it cannot confirm a certificate either.
• The consultant as certifier. A document signed by the firm that wrote the safety system. A certification body may not also provide management system consultancy.

Shortcut certificates are found out at the worst moment: in a client's HSE prequalification or after an incident. By then the hazards the system was meant to control have been on site all along.

ISO 45001 certificate check for contractor prequalification

Record the date and source of each result in your prequalification file.

When an ISO 45001 certificate fails a check

Stay factual: a new number after recertification, a change of certification body or a lagging register can each explain a mismatch.

1. Write to the contractor for the current certificate and an explanation, with a response date.
2. Write to the certification body, using contact details you found yourself, and ask it to confirm in writing whether it issued the certificate, and its status, scope and sites. Its audit reports stay confidential.
3. If the body never issued it or it was altered, treat the contractor as uncertified, inform the certification body and any accreditation body whose mark was used, keep copies, and take legal advice before acting on the contract.
4. If it is genuine but unaccredited or out of scope, require accredited certification for the right scope by a date, or rely on your own evaluation of the contractor's safety arrangements.
5. Either way, protect the work. A mobilised contractor still needs induction, permits to work and supervision proportionate to the risk; none of that ever depended on the certificate.

Make sure your own certificate passes these checks

Clients will run these checks on you. Find your organisation in IAF CertSearch and your certification body's register, and have errors in legal name, sites or scope corrected. Make sure the scope names the operational work you tender for, not only your offices. Report changes of name, ownership, sites or activities to the body and keep surveillance on schedule.

Verifying an ISO 45001 certificate: questions buyers ask