How to Tell an Accredited ISO Certificate From a Worthless One
There is a market in ISO certificates that are not worth the paper they are printed on. They carry the ISO number, a logo, a certificate number and an expiry date. They look entirely convincing. They are also invisible to the one system that matters.
This is not a rare problem in the Gulf. Procurement teams encounter it regularly, and organisations that bought one usually did so in good faith — the provider never said the certificate was unaccredited, because they were never asked.
Accreditation is the thing being faked
Two different organisations are involved in a genuine certificate, and conflating them is how the market works.
The certification body audits you and issues the certificate. The accreditation body audits the certification body — confirming it is competent, impartial and applying the standard correctly.
Anyone can set up a certification body. What they cannot do is grant themselves accreditation from a body that is a member of the International Accreditation Forum. That membership is the chain of trust, and it is what a fake certificate lacks.
Check one: look it up on IAF CertSearch
IAF CertSearch is the global registry of accredited certifications. Certificates issued through accredited bodies are listed there; unaccredited ones are not.
Search by company name or certificate number. If a certificate does not appear, that is not proof of fraud — there are listing delays, and very recently issued certificates may lag — but it shifts the burden back to the holder to explain why.
This single check takes under a minute and resolves most cases.
Check two: name the accreditation body, not the issuer
Ask the holder which accreditation body stands behind the certificate. Not who issued it — which body accredited the issuer.
A legitimate holder answers immediately, because it is printed on the certificate. A vague answer, or a name you cannot find in IAF’s member list, is the signal.
Be alert to official-sounding names invented to resemble real ones. The test is not whether the name sounds credible; it is whether that body appears in the IAF membership.
Check three: read the scope statement
This is the check almost nobody performs, and it catches a different problem — certificates that are entirely genuine but do not cover what you are buying.
Every certificate carries a scope statement naming the activities and sites certified. A contractor may hold a real ISO 9001 certificate whose scope covers only their head office administration, not the site works you are contracting for.
The certificate is valid. It is simply irrelevant to your purchase. Read the scope, and compare it against the work you are actually commissioning.
Check four: confirm it is still live
Certificates run a three-year cycle and remain valid only if annual surveillance audits are passed. A certificate can be suspended or withdrawn mid-cycle without the printed expiry date changing.
The registry reflects current status; the PDF does not. An in-date certificate is not necessarily an active one.
Warning signs worth noticing
- Certification promised in days with no audit described
- No mention of Stage 1 and Stage 2 audits
- A price dramatically below everyone else, with no accreditation named
- No surveillance audits in the following years
- Reluctance to put the accreditation body in writing
Any one of these can have an innocent explanation. Several together rarely do.
The shortest version: a certificate nobody can independently verify is a design exercise. If it is not on the registry and the accreditation body cannot be named, treat it as unverified.
If you discover you hold one
This happens more often than the subject is discussed. If you bought in good faith and have now learned your certificate is unaccredited, the practical route is to pursue accredited certification rather than attempting to transfer the existing one — transfer requires a valid accredited certificate to transfer from.
Your existing documentation is not wasted. If you built a management system to achieve the certificate, that system is the substantial part of the work, and it carries into a proper audit.
For procurement teams
Add two lines to your supplier qualification form: which accreditation body stands behind the certificate, and what the scope statement says. Then check the registry.
Those two questions and one lookup filter out the overwhelming majority of unverifiable certificates, and they take less time than reading the PDF you were sent.
You can also check any certificate we have issued directly through our verification page, which confirms status, scope and expiry.