Procurement teams in India receive ISO certificates every day as part of vendor registration, tenders and supplier audits. Most are genuine. Some are not — and some are genuine documents that are no longer valid, cover a different scope, or come from a body whose "accreditation" means nothing. Knowing how to verify an ISO certificate is a basic supplier control. This guide explains what accreditation means, then walks through a verification method you can apply to any certificate in about fifteen minutes.

First, understand who does what

Four kinds of organisation are involved in a legitimate ISO certificate, and confusion between them is what most fake certificates exploit.

  • ISO, the International Organization for Standardization, writes the standards. It does not certify organisations and does not issue certificates
  • Certification bodies audit organisations and issue certificates. For management systems they operate to ISO/IEC 17021-1
  • Accreditation bodies assess certification bodies for competence and impartiality and accredit them for specific standards and technical sectors. In India, the national accreditation body for certification bodies is NABCB, the National Accreditation Board for Certification Bodies, a constituent board of the Quality Council of India
  • The International Accreditation Forum (IAF) is the association of accreditation bodies. Its Multilateral Recognition Arrangement (MLA) is the agreement under which signatory accreditation bodies recognise each other’s accreditations, after peer evaluation

The chain is what gives a certificate its value: an accredited certification body, accredited by an accreditation body that is an IAF MLA signatory for the relevant scope. A certificate issued under that chain is recognised across the countries whose accreditation bodies are signatories. A certificate outside it may be perfectly legal to issue, but it carries no internationally recognised assurance.

How to verify an ISO certificate, step by step

Step 1 — Read the certificate properly

Note the certified organisation’s legal name and address, every site listed, the exact scope statement, the standard and its version, the certificate number, the dates of issue and expiry, the name of the certification body and any accreditation body mark. Check the standard version carefully. Certificates to ISO/IEC 27001:2013 ceased to be valid after the transition deadline of 31 October 2025, and OHSAS 18001 was withdrawn when ISO 45001 replaced it, with the migration period ending in 2021.

Step 2 — Check the certificate with the certification body

Accredited certification bodies are required to provide information on the validity of the certifications they have issued. Use the verification facility on the certification body’s own website — reached by typing its address yourself, not by following a link supplied with the certificate — or write to the body directly. Confirm not just that the certificate exists, but that it is currently valid rather than suspended or withdrawn, and that the scope and sites match the copy you were given.

Step 3 — Check the accreditation body is genuine

Identify the accreditation body from its mark on the certificate, then confirm on the IAF website that it is a member and an MLA signatory for the relevant scope, such as the main scope for management system certification and the relevant sub-scope for the standard in question. There are organisations with official-sounding names that describe themselves as accreditation bodies and are not members of any recognised arrangement.

Step 4 — Check the certification body is accredited for that standard

Accreditation is granted for specific standards and, often, specific technical sectors. Use the accreditation body’s own directory of accredited bodies — for NABCB, its published list of accredited certification bodies and their scopes — to confirm that the certification body is accredited for the standard on the certificate. A body accredited for ISO 9001 is not thereby accredited for ISO 27001 or ISO 22000.

Step 5 — Search IAF CertSearch

IAF CertSearch is the IAF’s global database of accredited management system certifications, populated with data from participating accreditation bodies and certification bodies. It is a useful cross-check. It is not yet complete for every body and every country, so a certificate that does not appear there is not automatically fake — but it is a reason to rely more heavily on steps 2 to 4.

Red flags of a fake or worthless ISO certificate

  • Claims to be "certified by ISO" or displays the ISO logo — ISO does not certify and does not permit its logo to be used this way
  • Claims of "IAF accreditation", or an accreditation mark from a body that is not an IAF MLA signatory
  • A certificate issued within days of first contact, with no evidence of a Stage 1 and Stage 2 audit
  • A vague scope such as "general trading and services" that does not describe what the supplier actually does for you
  • Names, addresses or sites that do not match the supplier’s registration documents
  • An outdated or withdrawn standard version, or dates that are inconsistent with a three-year cycle
  • No way to verify it independently, or a certification body that will not confirm status in writing
  • The same organisation that built the supplier’s management system also issued the certificate — accredited certification bodies must not do both

Accredited, unaccredited and fake are three different things

An accredited certificate has been issued by a certification body assessed by a recognised accreditation body. An unaccredited certificate may come from a real audit, but no independent party has checked the competence or impartiality of the body that issued it. A fake certificate misrepresents something — the body, the accreditation, the audit or the organisation. For customer, tender and regulatory purposes, most buyers should require accredited certification and say so explicitly in their supplier requirements.

What to do if a certificate fails verification

  1. Ask the supplier for an explanation in writing — occasionally the problem is a renamed entity or an expired certificate that has since been renewed
  2. Inform the certification body named on the certificate, which has an interest in stopping misuse of its name and marks
  3. Where accreditation marks are misused, inform the accreditation body concerned
  4. Review what else in the supplier’s qualification file relied on the same assurance

Certificates issued by GMSCPL can be checked through the certificate verification page on our website, and our team will confirm a certificate’s status in writing on request.