Why the document itself proves nothing
A certificate is a printed claim about a past audit. It cannot tell you that it has since been suspended, that the standard it names has moved on, or that the company’s certified scope never covered the work you are buying. Those are the three ways a genuine-looking certificate turns out to be worth less than it appears — and not one of them involves anybody forging anything.
All of it is checkable in a few minutes, against a register rather than against the document.
1Is it accredited, and by whom?
Anyone may print a certificate, and selling one without accreditation is not illegal — it is simply worth less, because nobody independent has checked the checker. Nobody publishes a reliable figure for how often this happens, so distrust anyone who quotes you one; what is documented is that it costs people contracts when a buyer looks. Look for the accreditation body's mark and name alongside the certification body's own: ANAB in the United States, UKAS in the United Kingdom, and their equivalents elsewhere. A certificate naming only the firm that issued it is telling you something by omission.
2Is it current?
Certificates run three years with surveillance audits in between, and they can be suspended or withdrawn inside that window without the PDF in your hand changing at all. The document cannot report its own suspension. Only the register can.
3Does the scope cover what they make for you?
The check almost everyone skips, and the one that most often fails. Scope is a sentence on the certificate naming the activities and the sites it covers. A group certificate held at a head office does not cover the plant machining your parts, and a scope reading 'design and distribution' does not cover manufacturing. Read that sentence against your purchase order.
Where to run the check
Start with IAF CertSearch. It is the global register of accredited management system certificates — around two million of them across more than a million organisations — searchable by company name or certificate number. It returns the certificate’s status, its scope, the sites it covers, who issued it and who accredited them. Registered users get a free allowance, currently three searches a day or thirty a month, which is ample for checking suppliers and not enough to screen a whole supply chain without paying.
Then the certification body’s own directory. Every accredited body publishes its clients. If the certificate names one, look the supplier up there directly — it is the most current source, and it settles suspensions faster than anything else.
And the accreditation body, if the first two disagree. ANAB, UKAS and their national equivalents publish the list of certification bodies they accredit and for which standards. This is how you find out that the impressive-looking issuer on the certificate is not accredited for ISO 9001, or not accredited at all.
The January 2026 change most advice hasn’t caught up with
On 1 January 2026 the International Accreditation Forum and the International Laboratory Accreditation Cooperation were succeeded by a single body, Global ACI. The IAF Multilateral Arrangement and the ILAC Mutual Recognition Arrangement — the agreements that made an accredited certificate mean the same thing in two countries — were replaced by the Global ACI Multilateral Recognition Arrangement, written to carry the same recognition forward.
Two practical consequences, because this is where people get it wrong in both directions:
- An IAF or ILAC mark is not evidence that a certificate is stale. Bodies holding signatory status at the end of 2025 may keep using the old marks until the Global ACI mark becomes available in their economy. You will be seeing both for a while, and both are fine.
- The register did not move. IAF CertSearch kept its name through the transition. If a supplier tells you the database is defunct because IAF is, that is not right.
Most published guidance on verifying certificates still describes the pre-2026 arrangement. It is not wrong about the method — only about the names.
When it doesn’t check out
Ask for two things, and not for another PDF: the certificate number and the name of the certification body. Then verify it yourself. A supplier who cannot produce those two pieces of information has answered your question.
Usually the answer is duller than fraud, and that is the point — the boring failure is the one worth designing for. The certificate lapsed during a bad year, or the transfer to a new certification body is half finished, or it was issued by a non-accredited firm that sold it cheaply and the supplier did not know the difference. None of those are cause to walk away on their own — but all of them mean the certificate is not doing the job you were relying on it to do, which is worth knowing before an auditor asks you how you control your suppliers.
The record, not the PDF
If you are checking a supplier because your own quality system requires it, the thing that matters at your next audit is not the certificate — it is the record that you checked, what you found, and when. A folder of supplier PDFs with no dates on the checks is the version of this that fails.
Cornerstone9 keeps that as a register: who your suppliers are, what you rely on each of them for, what evidence you hold, and when it was last looked at. If you are on the other side of this conversation — the one being asked to prove your own certificate — this is what that request usually means.
Sources
Global ACI succession and mark transition: UKAS, ANAB and A2LA transition notices, checked September 2026. Register coverage and free-tier limits: IAF CertSearch support documentation, checked September 2026. Figures move; the method does not.