How to verify an ISO certificate: a practical guide

To verify an ISO certificate, confirm the certificate number and the holder's name with the issuer, using its verification page or register. Then check that the standard, the scope and the dates match what your supplier or partner has told you.

The whole check takes a few minutes. It is worth doing before you accept a certificate in a supplier questionnaire, a tender or a customer audit, because a PDF on its own proves very little.

Who issues an ISO certificate?

ISO writes the standards. It does not issue certificates and it does not keep a register of certified companies. A certificate always comes from a third party: a certification body, or another issuer with its own assessment process.

That is why verification always leads back to the issuer. Whoever is named on the document is the only one who can say whether it is genuine and still valid.

Step 1: Read the document properly

Start with the certificate itself. A usable certificate shows these details:

• Full legal name and address of the certified company
• The standard, with number and year, for example ISO 9001:2015
• The scope: which activities, products or services are covered
• A certificate number
• Date of issue and date of expiry
• Name and contact details of the issuer

If one of these is missing, ask for a complete copy. A certificate without a number cannot be checked. A certificate without an expiry date cannot be relied on.

Compare the company name with the one on the quote or contract. A certificate for a parent company or a sister company does not cover the legal entity you are buying from.

Step 2: Identify the issuer

Look at who signed the certificate. Search for that organisation yourself. Do not follow a link or phone number printed only on the certificate.

You want to find a real company with a website, a postal address and a way to confirm certificates. If the issuer has no traceable presence, you have your answer already.

Step 3: Confirm the certificate with the issuer

This is the step that actually verifies the certificate. There are three common ways to do it:

1. QR code or link on the certificate. Scan it and check that it opens the issuer's own domain. The page should show the same holder, number, standard and dates as the PDF.
2. Public register or search page. Many issuers publish a list where you enter the certificate number or the company name.
3. A direct request. Write to the issuer, quote the certificate number and ask them to confirm holder, scope and validity.

Make sure the details on the verification page match the document word for word. A page that shows a different company name or an earlier expiry date is a warning sign, even if the number exists.

For certificates from the classic route, a second check is possible. Many certification bodies are accredited, and accreditation bodies and international databases let you look up whether a body and its certificates are listed. Use this if your customer or your tender demands an accredited certificate.

Step 4: Understand what the certificate is based on

Two certificates for the same standard can rest on different foundations. The classic route is an on-site audit by a certification body, with an auditor visiting the company. Other models, including Zertify, rely on an online self-assessment that the issuer reviews before it issues the certificate.

Neither basis is hidden, and a good issuer states it openly. What matters for you is whether it fits your requirement. Some tenders ask for an accredited body; our guide on accredited or not explains the difference and how to read such a requirement. If you want to know how an assessment-based certificate works, read ISO certification without an audit.

If you are unsure what your customer expects, ask them before you ask your supplier. Purchasing departments usually have a clear rule.

Step 5: Check scope, site and dates

A genuine certificate can still be irrelevant to your purchase. Three points decide this.

Scope. A certificate for "software development" does not cover hosting, support or consulting. Read the scope line and compare it with what you are actually buying.

Sites. Some certificates cover only the head office or a named location. If your order is handled elsewhere, the certificate may not apply.

Dates. Check the issue date, the expiry date and, where the model has one, the yearly confirmation. A certificate that expired last month is not valid today, whatever the PDF says.

Red flags that call for a closer look

Some signs appear again and again with doubtful certificates:

• The certificate says "ISO certified" without naming a standard
• No certificate number, or a number the issuer cannot find
• The issuer is not named, or cannot be found online
• The QR code leads to a domain that differs from the issuer's website
• Company name, address or scope differ between certificate, verification page and contract
• The certificate only exists as an image in an email signature or a website badge
• The holder refuses to name the issuer

One point alone does not prove fraud. Typos and old templates happen. Several together justify asking for written confirmation from the issuer.

Checklist: verifying an ISO certificate

• I have the full certificate as a PDF or scan, not only a logo
• The holder's legal name and address match the contract partner
• The standard is named with number and year
• The scope covers the product or service I am buying
• The certificate number is visible
• Issue date and expiry date are visible, and the certificate has not expired
• I found the issuer independently and it is a real organisation
• I confirmed number, holder and dates on the issuer's verification page or by written request
• I know whether the certificate rests on an on-site audit or an online assessment
• The basis meets my customer's or tender's requirement
• I saved a screenshot or confirmation for my supplier file, with the date of the check

How Zertify fits in

If you are on the other side of the table and need a certificate that a buyer can check without effort, the design of the certificate matters. A Zertify certificate carries a QR code on the PDF that leads to a public verification page. The page shows the holder, the standard and the status, so a purchasing department can confirm it in a minute without contacting anyone.

The certificate is issued by G6 Agency AG under licence from SICE (Swiss Institute of Certification and Education). It rests on an online self-assessment, with no on-site audit. A member of the SICE Certification Board reviews every assessment before the certificate is issued, and the certificate follows within 4 hours after a passed assessment and payment. It is valid for three years and confirmed every year with a short online re-audit, which is part of a yearly subscription.

You can see which management system standards are available on the standards page and how the subscription is structured on the pricing page. When you are ready, the assessment start takes you straight into the questionnaire.

What to do if the verification fails

Do not assume bad intent at once. Write to the supplier, name the exact discrepancy and ask for a corrected certificate or a written statement from the issuer. Give a deadline.

If the issuer confirms that the certificate does not exist or is no longer valid, treat the claim as unproven. Record this in your supplier file and tell the person who owns the purchasing decision. In a regulated setting, such as a public tender, inform the contracting authority as your rules require.

If the supplier cannot name an issuer at all, there is nothing to verify. Ask for a certificate that can be checked, or continue without relying on it.

Keep a record of the check

A verified certificate is only useful in an audit if you can show that you verified it. Note the date, the page or person you used, and the result. Repeat the check when the expiry date passes or when the supplier's scope changes. Once a year is a sensible rhythm for suppliers that matter to your business.