An iso 9001 certificate check takes about ten minutes, and it can save a buyer from trusting a certificate that is out of date or fake. A certificate is a claim by a certification body. Your job is to test that claim before you sign a supply contract.
What a certificate actually says
An ISO 9001 certificate says that an outside auditor found a company's quality management system in line with the standard on the audit date. It does not say the products are good. It does not say every site or every product is covered. Most certificates name the 2015 edition of the standard, so look for that on the page.
ISO writes the standard, but ISO does not issue certificates. Independent certification bodies do that work. A real certificate should carry the logo of the certification body and, next to it, the logo of the accreditation body that approved that certifier. A missing accreditation logo is a warning sign.
Step 1: Read the scope line
Find the scope statement. It lists the activities, products or services the audit covered. A factory might be certified for "assembly of electric motors" and not for the metal parts it buys in. If your order falls outside the scope, the certificate does not help you.
Next, check the address. Certificates cover named sites. A head office certificate does not cover a plant in another city unless that plant is listed. Match the legal name and the address to the supplier you are about to pay.
Step 2: Check the dates and the cycle
Look at the issue date and the expiry date. A certificate is normally valid for three years. During those years, the certifier returns once a year for a surveillance audit. At the end of the cycle, a recertification audit looks at the whole system again. The outcome is either another three years or a list of things to fix first.
So ask two plain questions. Is the expiry date still in the future? Did the supplier pass its most recent yearly audit? A certificate can be suspended or withdrawn between audits, which is why a paper copy is never enough on its own.
Step 3: Confirm the certifier is accredited
Ask the supplier which certification body issued the certificate. Then ask who accredits that body. National accreditation bodies approve certifiers as competent, and they watch their work. Certificates from a body with no accreditation may not be recognised by other buyers or by regulators.
You can often confirm this on the accreditation body's own website, which usually keeps a list of the certifiers it has approved. If the supplier cannot name the certifier, or the name does not appear on any such list, stop and ask more questions.
Step 4: Verify the record in IAF CertSearch
The International Accreditation Forum announced IAF CertSearch in October 2019. It is a global database of accredited management system certifications. Buyers can search it to validate certificates such as ISO 9001, ISO 14001, ISO 22000 and ISO/IEC 27001. It also lists accredited certification bodies and accreditation bodies.
The IAF describes the database as offering automated verification, real-time updates and fraud detection. It also has a watch list. A certified company can use it to show its own certification body that its suppliers meet the requirements.
There is one limit to know about. Certification bodies and accreditation bodies upload the records. In May 2024 the IAF reported more than 1.35 million certifications from 1,614 certification bodies, but it also said that many more bodies, including some of the world's largest, were still preparing to upload. The IAF has set 25 October 2024 as the date when uploading becomes mandatory. Until then, a missing record is not proof of a fake. It is a reason to ask.
Step 5: Ask the certifier directly
If CertSearch shows nothing, or something does not match, write to the certification body named on the certificate. Use the contact details from the certifier's own website, not the details printed on the supplier's copy. Give the certificate number, the company name and the site address, and ask the certifier to confirm that the certificate is valid, what its scope is and when it expires.
Keep the reply with your supplier file. If you buy from the same supplier for years, set a reminder for the expiry date and repeat the check when the certificate is renewed.
A short checklist
Before you rely on a supplier's certificate, make sure you can answer yes to each point below. If you cannot, treat the certificate as unproven.
- The legal name and site address match the supplier you are paying.
- The scope covers the product or service you are buying.
- The expiry date is in the future and the last yearly audit was passed.
- The certifier is accredited, and its accreditation body is named.
- The certificate number appears in IAF CertSearch, or the certifier has confirmed it in writing.
An ISO 9001 certificate shows that a supplier has a documented system and that someone independent has looked at it. It is a good filter, and a poor guarantee. Pair the check with samples, site visits and references.
Sources
- International Accreditation Forum, "IAF CertSearch gains momentum", 31 May 2024: iaf.news/2024/05/31/iaf-certsearch-gains-momentum/
- TQCSI, "IAF CertSearch Launched", 30 October 2019: tqcsi.com/news/iaf-certsearch-launched
- International Accreditation Forum, "Self-Certification Is Not a Real Thing", 19 October 2017: iaf.nu/en/news/self-certification-is-not-a-real-thing/
- Amtivo, "The three year certification cycle": amtivo.com/uk/resources/technical/the-three-year-certification-cycle/