Free · five minutes · nothing leaves your browser
Certificate Check: how to verify an ISO certificate
Type in what a supplier's certificate shows and the checklist tells you what to check and where: IAF CertSearch, the certification body's own register, the accreditation body's directory, the scope, the sites and the dates, with the red flags in what you entered marked for you.
Sterling does not validate or verify certificates.The checklist sends you to the sources that can.
Copy the details exactly as the document shows them, and leave blank anything it does not show: a missing detail is itself something to check. Nothing you type is sent anywhere; close the page and it is gone.
Whatever the certificate
Where a certificate is checked
A certificate is a claim made on paper. Four independent sources can confirm it, and you should reach each one yourself, never through a link or QR code printed on the document.
1. IAF CertSearch
The global database of accredited management system certifications, fed by certification and accreditation bodies. It kept its name when Global ACI took over the roles of IAF and ILAC. An absent entry is a question for the issuer, not proof of a fake.
2. The certification body's register
The body that issued the certificate has the last word on whether it is current, suspended or withdrawn, and what it covers. Use its online register, or contact details you looked up yourself.
3. The accreditation body's directory
The accreditation mark on the certificate names an accreditation body and a number. Its directory should show that certification body, accredited for the standard on the certificate.
4. Global ACI's recognised list
Global ACI replaced the IAF MLA and ILAC MRA on 1 January 2026. Its list shows which accreditation bodies are internationally recognised, and for which scopes. Global ACI recognises accreditation bodies; it does not accredit certification bodies.
Not every scheme ends in a certificate
SOC 2, PCI DSS and ISO/IEC 17025 are checked differently
SOC 2
There is no SOC 2 certificate. A licensed CPA firm examines the controls and issues a SOC 2 report, Type 1 or Type 2, which you ask the supplier for, usually under a non-disclosure agreement.
PCI DSS
There is no PCI DSS certificate either. Validation ends in an Attestation of Compliance, signed with a Report on Compliance or a Self-Assessment Questionnaire; card brands such as Visa and Mastercard publish lists of registered service providers.
ISO/IEC 17025
Laboratories are accredited, not certified. The accreditation body's directory holds the laboratory's accreditation and its schedule of tests or calibrations; nothing outside that schedule is accredited.
Any “certified by ISO” claim
ISO writes standards and does not certify anyone. A certificate issued by ISO itself, or carrying the ISO logo, is a red flag on sight.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions about checking a certificate.
The checklist tells you where to look. These answers explain why.
Does Sterling verify or validate certificates?
No. Sterling is a consultancy and does not validate, verify or vouch for anyone's certificate. Only the certification body that issued a certificate can confirm its status, and only the accreditation body can confirm that body's accreditation. The checklist points you to both, and to IAF CertSearch.
A certificate is not on IAF CertSearch. Is it fake?
Not necessarily. Its records come from certification and accreditation bodies, and some bodies add them late or not at all. Treat a missing entry as a question for the issuer: ask the certification body directly, through contact details you found yourself, whether the certificate is current.
Why does the scope matter as much as the certificate?
Because a genuine certificate can cover one department, one site or one service and say nothing about the rest. If the scope or the site list does not name what you rely on, or the entity you contract with, the certificate does not cover it, however real it is.
Can we rely on the QR code or link printed on the certificate?
No. A forger controls whatever is printed on the paper, including the link and the QR code. Search IAF CertSearch and the certification body's register by typing their addresses yourself.
What happened to the IAF MLA and the ILAC MRA?
Global ACI replaced the IAF MLA and ILAC MRA on 1 January 2026. Its list of recognised accreditation bodies is now the place to confirm that an accreditation body has international standing. IAF CertSearch kept its name.
Is anything I type into the checklist sent to Sterling?
No. The checklist runs entirely in your browser. Nothing you enter is sent, stored or tracked, and it disappears when you close or clear the page.
Keep exploring
More free tools
Talk to a consultant
Earn a certificate your customers can check.
Tell us your standard, locations and target date. We’ll help you define the scope, choose an accredited certification body and plan the route to certification.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice