How to verify an ISO 9001 certificate, and how to spot a fake or a misleading one

Why the certificate itself proves very little

Anyone with design software can produce a convincing ISO 9001 certificate, and a genuine one can lose its validity while the paper stays the same. So verify at the source, link by link: the certification body that issued it, IAF CertSearch, then the accreditation behind that body.

Purchasing teams need the check because ISO 9001 expects you to evaluate and control external providers under clause 8 (Operation); tender panels need it before awarding marks; certified organisations should run it on themselves, because their customers do. A valid certificate is not a promise about every delivery; our guide to ISO 9001 benefits covers the difference.

Where to check an ISO 9001 certificate

Four sources answer four different questions; none is the holder's own website.

1. IAF CertSearch

IAF CertSearch, the global database of accredited management system certifications, kept its name when Global ACI took over the work of IAF and ILAC. Search by company name or certificate details and compare the entry with the paper. It also offers bulk checks and alerts on suspended, withdrawn or expired certificates. Its data comes from certification and accreditation bodies, so a missing entry is a question for the issuer, not proof of a fake.

2. The certification body's register

The issuing body is the authority on current status, and an accredited body must be able to confirm on request whether its certificate is valid. Find its register and contact details yourself: a QR code on a forged certificate leads wherever the forger chose.

3. The accreditation body's directory

The accreditation mark identifies the accreditation body, usually a national one, and the certification body's accreditation number. In that body's directory, confirm the same legal entity under that number, accredited for ISO 9001 and the sector concerned, and not suspended or withdrawn; our guide to choosing an ISO 9001 certification body explains sector coverage.

4. Global ACI's recognised accreditation bodies

Global ACI, whose arrangement replaced the IAF MLA and ILAC MRA on 1 January 2026, lists the accreditation bodies it recognises, filterable by economy and scope, including management systems certification and ISO 9001. The accreditation body need not be in the supplier's country, but it must be listed; an unlisted one offers no internationally recognised accreditation, however official it sounds.

What a genuine ISO 9001 certificate shows

ISO/IEC 17021-1, the standard accredited certification bodies work to, sets out what their certification documents must identify:

• Organisation: the legal name and each certified site's address, often in a site schedule.
• Scope: the products, services and activities certified, specific enough to test.
• Standard and edition: ISO 9001:2015 or ISO 9001:2026.
• Certificate number: unique, with a revision number if reissued.
• Dates: the current issue, usually the original certification, and an expiry that fits a three-year cycle.
• Certification body: its name, address and mark, usually signed by an authorised person.
• Accreditation: the accreditation body's symbol with the certification body's accreditation number.

Every item should match the register, and even a match describes one moment: a certificate can be suspended or withdrawn mid-cycle, for example when the holder refuses its surveillance audits, and the paper does not change. Our guide to surveillance and recertification covers that cycle.

Signs of a fake or misleading certificate

Problem certificates are forged (never issued by the named body, or altered), unaccredited (real documents without recognised accreditation) or misleading (genuine and accredited, but not covering what the holder implies). The signs:

• Unrecognised accreditation. No accreditation mark, a mark from a body absent from Global ACI's list, or a number the accreditation body's directory does not show.
• A scope that misses your purchase. A trading and distribution certificate from a supplier you rely on for manufacture, or a scope too vague to test.
• The wrong entity or site. The certificate covers a parent, a sister company or only the head office, not the site that ships to you.
• Dates that do not hold. Expired, no expiry, validity well beyond three years, or the 2015 edition after the transition has closed.
• A consultancy issuing "certificates". A body that certifies may not also consult on management systems, so a certificate signed by the firm that wrote the system is not accredited certification.
• A certificate mill. Issued within days, without a site visit, from an online questionnaire, with the outcome guaranteed, or from a menu of standards at one price.
• Claims no accredited certificate makes. The ISO logo, "certified by ISO", "ISO 9001 compliant", or a product described as ISO 9001 certified.

Mills sell the document without the system or the audit. The saving lasts until a serious customer runs these checks, leaving a certificate that fails, the same operational gaps and the full cost of genuine certification still ahead.

ISO 9001 certificate verification checklist

Record each result, with its date and source, in your supplier evaluation.

What to do when a certificate does not check out

Start from facts: a renewal under a new number, a change of certification body or a lagging register can each explain a failed check.

1. Ask the holder in writing for its current certificate and an explanation, with a deadline.
2. Ask the certification body, through contact details you found yourself, to confirm status, scope and sites in writing; the audit report itself stays confidential.
3. If the body did not issue it, or it was altered, you hold a forgery. Tell the certification body, and the accreditation body if its symbol appears; keep copies, and take legal advice before acting on a contract or tender that relied on it.
4. If it is genuine but unaccredited or out of scope, decide as a supplier matter: accept it with added controls, require accredited certification for the right scope by a date, or audit the supplier yourself.
5. Record the outcome in your supplier evaluation and review deliveries accepted on the strength of the certificate.

Your own certificate: make sure it passes the same checks

Look your organisation up in IAF CertSearch and your certification body's register, and have any error in the legal name, sites or scope corrected; a customer who cannot find you will ask this page's questions about you. Report changes of name, ownership, sites or activities to the body, keep surveillance on schedule, and use the certificate and marks only for the certified scope. A certificate that survives every check is earned the unglamorous way: a system that runs, audited by an accredited body that has watched it run.

Verifying an ISO 9001 certificate: questions buyers ask