Key takeaways
- 1The accreditation body uploads each accredited certification body's name, office addresses, scope of accreditation and accreditation status (clause 4.1.1), at least monthly (4.1.3).
- 2The certification body uploads each certified organization's legal name, locations, certificate number, standard, scope, dates and status (4.2.1), at least monthly (4.2.4), and corrects an identified error or omission within two weeks (4.2.6). If an accreditation body uploads on its behalf, responsibility for complete data stays with the certification body (1.7).
IAF CertSearch is the global database of accredited management system certifications. Accreditation bodies upload the certification bodies they accredit, and certification bodies upload the accredited certifications they issue. Under IAF MD 28:2023, uploading is mandatory from 26 October 2024, so an accredited certificate is expected to be there. A valid one can still be missing, for reasons the database's own rules set out, and each points to a place to look instead.
What the database is
IAF formed IAF Database, LLC, effective 9 November 2017, for the sole purpose of overseeing a global database of management system certifications issued by certification bodies whose accreditation bodies are IAF members.
It operates under the Principles in Annex 1 of IAFDB PL1:2022, which IAF members approved on 3 August 2022. Principle 1 states the purpose: accurate data on accredited management system certifications issued by a certification body accredited by an IAF MLA signatory accreditation body under ISO/IEC 17021-1.
On 1 January 2026, IAF and ILAC brought their work together in Global ACI. IAF CertSearch is still online under its own name. The rules below are taken from the IAF documents written for it.
Who puts the data in, and on what basis
The Principles make certification bodies responsible for certification data, accreditation bodies for accreditation data, and IAF for membership data.
IAF MD 28:2023, the mandatory document for the upload and maintenance of data on the IAF Database, sets out what accreditation and certification bodies must do to meet those Principles (clause 1.2). Its application date is 26 October 2024. It covers every IAF MLA signatory accreditation body under ISO/IEC 17021-1 and the certification bodies it accredits under that standard.
- The accreditation body uploads each accredited certification body's name, office addresses, scope of accreditation and accreditation status (clause 4.1.1), at least monthly (4.1.3).
- The certification body uploads each certified organization's legal name, locations, certificate number, standard, scope, dates and status (4.2.1), at least monthly (4.2.4), and corrects an identified error or omission within two weeks (4.2.6). If an accreditation body uploads on its behalf, responsibility for complete data stays with the certification body (1.7).
A certification body that does not participate and has no accepted justification receives a nonconformity from its accreditation body (7.2).
MD 28 clause 1.5 links participation to ISO/IEC 17021-1 clause 8.1.2 b) and c): the duty to give, on request, the status of a given certification and the name, standard, scope and location of a certified client.
Why a valid accredited certificate can be missing
It is outside what the database holds. The database covers management system certifications issued under accreditation to ISO/IEC 17021-1, by a body whose accreditation body is an IAF MLA signatory under that standard. An accredited product or personnel certificate is a different kind of certification and is not part of it.
The body has an accepted exclusion. In exceptional cases, MD 28 allows a body to be excluded from some or all of its upload obligations on three listed grounds: local or national regulatory or government requirements; national or regional data privacy or data security laws; and, for a government agency, the absence of a mandate (clauses 5.1.2 and 5.2.2). A body with an accepted exclusion is shown as "non-participating", so that users know to contact it directly (5.1.5, 5.2.8). An exclusion can also cover only part of a certification body's data, without changing its participation status (Annex B.2).
The record is confidential. A certification body may mark data, such as the client's name, as confidential where the certification relates to national security, where publishing the location or scope could present a significant safety risk, or where a government or regulatory requirement demands it (clause 6.2). Confidential data is not visible to users. Where the certification body allows the name or certificate number to be searched, the result shows only the certification body, a statement that the information is confidential, any fields it chose to show, and an enquiry form (6.4).
The data has not arrived yet. Uploads are at least monthly, so a certificate issued, renewed or changed since the last upload can be missing or out of date. The date the certification body last updated or confirmed its data is displayed (note to 4.2.5). The Principles also give a newly accredited certification body a 12-month application period from its initial accreditation (Principle 12 a).
The certification body is not conforming. MD 28 has statuses for that too (Annex B.2). It is for the accreditation body to act on; on its own, it does not show whether a certificate is valid.
MD 28 clause 8.1 states the design: participation status and accepted exclusions (unless confidential) are shown to tell users "why information may be absent", so that they can verify directly with the body that issued the certificate.
Where to look instead
The certification body's own register. Under ISO/IEC 17021-1 clause 8.1.2 the certification body gives, on request, the status of a given certification and the name, standard, scope and location of a certified client. A note to the clause allows it to publish this on its website. Principle 13 limits IAF CertSearch data to these same facts; here they come from the body that issued the certificate. CAS's register is at cas.com.eg/certsearch.
The accreditation body's register. It confirms the body, not the certificate: that the certification body is accredited, for which standards and sectors, and that the accreditation is current. Where an accreditation body is non-participating, MD 28 directs users to contact it to confirm an accreditation (5.1.5).
What this means for you
If you are a buyer: check the certification body's participation status and last-update date before reading anything into a miss, then ask it for the certificate's status. Clause 8.1.2 requires an answer.
If you are certified: search for your record under your registered legal name. If anything is missing or wrong, tell your certification body; MD 28 gives it two weeks to upload corrected data.
If you need your record kept confidential: MD 28 clause 6.3 expects a written request from you to your certification body, on one of the grounds in clause 6.2 and with evidence.
CAS — An EGAC accredited MS certification body No. 012418. Accredited scope: ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO 50001 and ISO 22301. Certificates accredited for ISO 9001, 14001, 45001, 22000 and 50001 fall within EGAC's IAF MLA scope; ISO 22301 is accredited by EGAC and sits outside that scope.
Verify any certificate: cas.com.eg/certsearch
Read next