Five warning signs on a questionable ISO certificate

Five things on the face of a certificate call for a check before you rely on it: a required item that is missing, a mark that does not fit, a scope that does not fit the organization, dates that do not fit the certification cycle, and a body that cannot be found. None of them proves that a certificate is false; a genuine one can show a sign through an error or an old copy. Each is a reason to ask, and each rests on a rule you can point to.

1. A required item is missing

ISO/IEC 17021-1 §8.2.2 lists what a certification document shall identify, in items a) to i). Three gaps are worth noticing first.

• No unique identification code (§8.2.2 d). Without one there is nothing specific to search or confirm.
• The standard without its issue status (§8.2.2 e). "ISO 9001" alone does not say which edition was audited.
• No sites on a multi-site certificate (§8.2.2 a). Global ACI TECH-3-001 (formerly IAF MD 1) §7.8.2 requires the name and address of every site covered.

2. A mark that does not fit

§8.2.2 g) allows other marks, such as an accreditation symbol, provided they are not misleading or ambiguous.

• "Accredited", with no accreditation body named. Under Global ACI MRA-006 §8.2.2, an accredited management system certificate carries the accreditation symbol or an explicit reference to accreditation status that identifies the accreditation body. Without such a reference, it is not considered accredited.
• An accreditation symbol on a standard outside the body's accredited scope. MRA-006 §9.2 b) and §9.4 limit symbols to activities within the accredited scope. A document covering both accredited and non-accredited results must be clearly labelled (§9.8.4).
• The IAF MLA mark on its own. IAF ML 2:2023, which Global ACI keeps in force for that mark, does not allow a certification body to use it in isolation from its accreditation body's symbol (§4.3.1), and allows the combined mark on a certificate only where its scope includes an IAF MLA sub-scope (§4.3.3). CAS's ISO 22301 certificates, for example, carry EGAC's accreditation symbol and not the IAF MLA mark, because ISO 22301 sits outside EGAC's IAF MLA scope.
• A mark that resembles a recognised one. Global ACI TECH-3-015 (formerly IAF ID 17), the informative document on counterfeit certificates, describes parallel systems that use similar, misleading names, marks and logos (§4.2).

3. A scope that does not fit the organization

§8.2.2 f) requires the scope to state the type of activities, products and services at each site, without being misleading or ambiguous. Read it against what you know of the supplier.

• The scope describes a different business, such as manufacturing for a company that only trades.
• The name is not the company you deal with. A sister company's certificate does not cover the company invoicing you (§8.2.2 a).
• A site certificate standing alone. Under TECH-3-001 §7.8.3, a document issued for one site of a multi-site organization must state that the whole organization's management system is certified, trace back to the main certificate, and say that "the validity of this certificate depends on the validity of the main certificate". It is never issued in the site's own name.

TECH-3-015 counts a scope "inaccurately expanded beyond its actual parameters" among its examples of counterfeit certificates (§3.1.1).

4. Dates that do not fit the cycle

Under §9.1.3.2, a certification cycle runs for three years, with recertification in the third year before expiry, unless an industry-specific scheme sets a different period (Note 3). §8.2.2 c) requires the expiry date to be consistent with that cycle.

An older date is not a sign on its own. After a lapse, a certificate may keep its original certification date if the current cycle's start and expiry are clearly indicated, with the last cycle's expiry and the recertification audit date (note to §8.2.2 b). A body that accepted a transferred certificate may quote the initial certification date, indicating that another body certified the organization before (Global ACI TECH-3-002, formerly IAF MD 2, note to §2.3.4).

5. A body that cannot be found

Both the certification body and its accreditation body should be findable without the document's help.

• The certification body is not on the accreditation body's register, or its entry does not include the standard on the certificate.
• The accreditation body is not a recognised signatory. Global ACI publishes lists of its MRA signatories. TECH-3-015 §4.2 describes certificates from unknown certification or accreditation bodies that claim equivalent value.
• IAF CertSearch has no record of the body. Accreditation bodies upload each certification body they accredit under ISO/IEC 17021-1, with its addresses, scope and status (IAF MD 28:2023 §4.1.1; its Global ACI replacement is listed as in process). A missing certificate has ordinary explanations. A missing body deserves more attention, unless its accreditation body is shown as non-participating (§5.1.5).

What this means for you

If you are a buyer: one sign is enough to check before you rely on the certificate. ISO/IEC 17021-1 §8.1.2 requires the certification body to give the status of a given certification on request.

If you are certified: read your own certificate against these five points. If the name, a site or the edition is wrong, ask your certification body for a corrected document.

If you see one of these signs on a CAS certificate: check it at cas.com.eg/certsearch, and tell us.

CAS — An EGAC accredited MS certification body No. 012418. Accredited scope: ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO 50001 and ISO 22301. Certificates accredited for ISO 9001, 14001, 45001, 22000 and 50001 fall within EGAC's IAF MLA scope; ISO 22301 is accredited by EGAC and sits outside that scope.

Verify any certificate: cas.com.eg/certsearch