Insights · 5 min read
The accreditation number checked out. That is not the same as the certificate being real.
In week one we published a sentence we still stand behind: a genuine accredited certificate appears in all three registers, and a fabricated one…
Published by CAS — Conformity Assessment Services · 4 September 2026
In week one we published a sentence we still stand behind: a genuine accredited certificate appears in all three registers, and a fabricated one appears in none.
That is true of two of them. This page is about the third, and about the one case none of our earlier writing covered — the check that passes, and is still wrong.
The three registers are not three of a kind
Two of them index certificates. One indexes certification bodies.
IAF CertSearch exists, in its own founding principles, to provide accurate data on accredited management system certifications issued by a certification body accredited by an IAF MLA signatory. That is a record of certificates.
The same principles give a second and separate purpose for the accreditation body data it holds: confirming that a certification body is accredited by an IAF member that is an MLA signatory. That is a record of bodies.
An accreditation body's own register is the second kind. You put in a number, and it tells you about the body that number belongs to.
Which is why that check passes for free
Take the accreditation number off a fabricated certificate and put it into the accreditation body's register. You will get a clean result. Current, in scope, correctly sectored.
Not because the register failed. Because it answered the question it was built to answer — is this body accredited — and that question has nothing to do with the document in your hand.
A forger has no reason to invent an accreditation number. Copying a real one is easier, safer, and far more convincing. IAF ID 17:2025 describes exactly this among the basic counterfeiting techniques: the replication of genuine certificates with tampered data, or the creation of fraudulent duplicates — documents that, in its words, deceive stakeholders who fail to conduct thorough verification checks.
So the accreditation number is the field most likely to be true on a document that is false. It is the last thing a forger needs to touch and the first thing most people check.
The standard makes the point better than we can
ISO/IEC 17021-1 §8.2.2 lists the things a certification document shall identify. There are nine, lettered a) to i): the client's name and location, the effective date, the expiry date, a unique identification code, the standard used, the scope, the certification body's name and address and mark, anything the scheme adds, and a way to distinguish revised documents from obsolete ones.
The accreditation number is not one of the nine.
What §8.2.2 g) says is that the certification body's own name, address and certification mark shall appear — and that other marks, giving the accreditation symbol as its example, may be used provided they are not misleading or ambiguous. Permitted. Not required.
And §8.2.2 d) requires a unique identification code.
Read those two together and the working practice of the whole market looks strange. The field almost everyone checks is optional. The field that actually identifies the document is mandatory, and almost nobody searches it.
What a resolved number does establish
Not nothing, and we are not arguing it is worthless.
It establishes that the body named on the certificate exists, that an accreditation body has assessed it, which accreditation body, for which schemes and sectors, and whether that is still true today. That is real information and it is worth having. Four useful facts.
Every one of them is about the body. None of them is about your document.
The one step that touches the paper
Search the certificate, not the number.
The certified organisation's legal name and the unique identification code, in a register that indexes certifications rather than bodies — iafcertsearch.org for accredited management system certifications, or the certification body's own record. That is the only step in the sequence that can tell a genuine document from a copy of one, because it is the only step whose subject is the document.
In our earlier writing we called this the step that means least on its own. That was the wrong emphasis, and this page is the correction: on its own it means least, and it is the only one a forgery cannot pass.
The route matters as much as the register
ID 17 also describes counterfeit websites and validation services — deceptive platforms that mimic legitimate certification processes and lead people to trust counterfeit certificates without proper verification.
The practical consequence is short. Type the address yourself. Do not reach a verification page from a link inside the document you are checking, or from an email that arrived with it, including one that says it came from us.
Our own number is copyable, and we publish it anyway
012418 is on our website, on this page, and on every certificate we issue. Anyone can put it on a document we never issued, and if you check only the number, it will check out.
That is the trade, and it is not a close call. Publishing the number is what makes checking possible at all. The cost is that it also makes copying easy — which is precisely why we would rather you checked the certificate than the number.
Three routes, and they are not equal
EGAC's register establishes that a body carrying 012418 is accredited, and EGAC has no commercial relationship with the organisation whose certificate you are holding.
IAF CertSearch, at iafcertsearch.org, holds data on accredited certifications, maintained by neither the seller nor the buyer.
Our own verification page is the fastest of the three and the least independent, because it is ours. Its value is not that it is authoritative. Its value is that it can be checked against the other two — and if it ever disagrees with EGAC's register, believe EGAC.