Checking an ISO certificate: is it genuine?
An ISO certificate is not difficult to copy. Some companies issue certificates without any serious audit taking place. How do you check whether a certificate from a supplier or partner is genuine and still valid? On this page, you go through that step by step.
Check whether your customer, scheme or applicable regulation requires a certificate from an accredited certification body (CB). Certification without accreditation also exists, but it does not automatically meet those conditions. The accreditation is granted by a national accreditation body, such as the Raad voor Accreditatie (RvA, Dutch Accreditation Council) in the Netherlands. You can read what accreditation involves exactly on the page accreditation explained.
Step 1: check the RvA database
Does the CB claim an RvA accreditation? Then the RvA register is your starting point. Go to the database of accredited bodies on rva.nl and search for the name of the certification body.
Check:
- Is the CB listed in the database?
- Is their accreditation still active (not withdrawn or suspended)?
- Is the standard on which the certificate was issued included in the CB’s scope?
If the CB is not in this register, first check whether another national body granted the accreditation. If the standard falls outside the accreditation scope, that accreditation does not cover the certificate.
Step 2: check the certificate itself
Check the following details on the certificate and with the issuing body.
| What you check | What you expect |
|---|---|
| Name and logo of the certification body | Does the issuer match the confirmation from the CB? |
| Accreditation number | For accredited certification: verify the proof in the register of the body named |
| Name of the certified organisation | Does the name match the company you are checking? |
| Standard and version | For example ISO 9001:2015, not an outdated version |
| Scope | Which activities, departments or locations are covered? |
| Validity dates | Issue date, expiry date (usually 3 years) |
| Certificate number | Unique number for verification |
The scope is a critical point. A company may be certified for one department or one location. If they claim to be certified for activities outside the scope, that claim is not correct.
Step 3: verify directly with the certification body
Most large certification bodies offer an online verification tool. You enter the certificate number and see the status straight away. Examples:
If the CB’s website has no verification tool, you can always call or email them with the certificate number.
Recognising foreign accreditations
Does your supplier hold a certificate from a foreign CB? Then the accreditation does not have to run through the RvA. Check the official register of the accreditation body named, and the scope of its recognition agreements. A logo or general membership does not prove that the standard and activity in question are covered. The RvA describes how international cooperation works .
If you buy laboratory services, check the ISO 17025 accreditation scope. An ISO 9001 certificate for the laboratory does not give the same proof about the specific test or calibration.
Red flags
Be critical if you see one or more of these signals.
| Red flag | What it may mean |
|---|---|
| CB cannot be found in a national accreditation database | Possibly not accredited |
| No accreditation mark on the certificate | Ask explicitly for the proof of accreditation |
| Certificate has expired but the company still claims to be certified | Ask for the current certificate |
| Scope does not cover the activities you want to buy | Certification does not apply to your situation |
| CB is not accredited for that standard but still issues a certificate | It may not meet the accreditation requirement you need |
So-called “certificate mills” exist: parties that issue certificates without a serious audit. They often have names that resemble recognised bodies. Always check the official accreditation database, not only the appearance of the certificate.
What if the certificate does not check out?
If you have doubts, ask the organisation for the name and accreditation number of their CB, and check these yourself. Ask the issuing CB to confirm the status and scope. A full audit report can contain confidential information and is not needed for every certificate check.
Do you want to know more about how to choose a reliable certification body for yourself? Read choosing a certification body.
Source on certification and accreditation
ISO: certification, accreditation and verification explains that accreditation offers independent confirmation of competence, while certification without accreditation also exists.