How to Verify a Supplier Certificate Is Real

A certificate sent by a supplier is not automatically proof. Before relying on it, verify the issuer, accreditation, certificate status, certified legal entity, site, standard, scope and relevance to the product being purchased.

This is especially important when the document affects supplier approval, destination-market compliance or a high-value production decision.

Quick answer: start with the organization that allegedly issued the certificate—not with the PDF itself. Confirm the certificate through the issuer or an official accreditation database, then check whether the legal entity, facility, scope, dates and product details match the proposed order.

First, identify what kind of document you received

“Certificate” is a broad label. The document may concern:

• a management system, such as ISO 9001;
• a product or model;
• a test report from a laboratory;
• an inspection result;
• a social or environmental program;
• a declaration made by the manufacturer itself;
• a business licence or other government registration.

These documents do not prove the same thing. A management-system certificate does not certify every product made by the company. A laboratory report may apply only to the tested sample and model. A supplier declaration is not the same as independent third-party certification.

The first verification question is not “Does the PDF look professional?” It is “What exact claim is this document supposed to prove?”

ISO does not certify suppliers

ISO develops standards but does not perform certification or issue certificates. ISO also states that organizations should not claim to be “certified by ISO.” Certification is performed by external certification bodies, which may themselves be accredited.

Therefore, an ISO management-system certificate should identify the certification body. That organization—not ISO—is the first place to verify the certificate.

The International Accreditation Forum’s CertSearch database can be used to confirm many accredited management-system certifications. Alternatively, contact the certification body or relevant accreditation body directly.

Step 1: Preserve the original document and supplier message

Save the original file rather than a screenshot. Keep the supplier’s email or platform message and record:

• sender and date;
• filename and file type;
• certificate or report number;
• claimed issuer;
• standard or regulation referenced;
• supplier legal name and site shown;
• expiry or validity date;
• product, model or scope claimed.

Do not edit the file. If the decision is commercially material, store a checksum or controlled copy so the reviewed version can be identified later.

Step 2: Verify the issuer independently

Do not use contact information printed on a suspicious certificate until the organization has been independently identified.

Find the issuer through:

• its official website;
• the relevant national accreditation body;
• IAF CertSearch for supported management-system certifications;
• an official regulator or conformity-assessment database;
• a trusted directory referenced by the accreditation body.

Then compare the official domain, address, logos and certificate-number format. A convincing logo is not proof; logos and signatures can be copied.

Step 3: Confirm accreditation and scope

Accreditation is formal recognition that a conformity-assessment body operates to applicable requirements. It is separate from the supplier’s certification.

Check:

1. Is the certification, inspection or laboratory body accredited?
2. Which accreditation body granted it?
3. Is the accreditation active, suspended or withdrawn?
4. Does the accreditation scope cover the relevant standard, activity or test?

For example, the German accreditation body DAkkS publishes a database that includes active, suspended and withdrawn accreditation status. The detailed scope matters: a body accredited for one activity is not automatically competent or authorized for every other activity.

Accreditation may not be mandatory in every commercial situation, but the buyer should understand what has and has not been independently confirmed.

Step 4: Match the certified legal entity and facility

Supplier groups often contain factories, trading companies, export entities and related businesses with similar names. Confirm that the certificate applies to the entity and site involved in the order.

Compare:

• full registered legal name;
• registration number where available;
• factory address;
• trading or export company relationship;
• manufacturing site shown in the RFQ or audit;
• contracting and invoicing entity.

A certificate belonging to a parent company, sister company or different factory may be genuine but irrelevant.

Step 5: Check the standard, version and certification scope

Read the exact standard reference and edition. Then review the scope statement.

For management systems, the scope may cover only selected activities or locations. For product documentation, verify the product name, model, materials, ratings and variants. For testing, check the test method, sample identity, date and laboratory scope.

Red flags include:

• vague wording such as “all products” without defined activities;
• a standard that is not intended for certification;
• a scope unrelated to the proposed product;
• an obsolete edition with no transition explanation;
• model numbers that differ from the quotation or specification.

Step 6: Verify status and dates with the source

Check issue date, expiry date and current status in the issuer’s database or through direct confirmation. A document may look valid while the certification has been suspended, withdrawn or replaced.

Record the verification date and source URL. Database status can change, so the evidence should show what was confirmed at the time of the purchasing decision.

If no online result appears, do not immediately assume fraud. Ask the issuer using independently sourced contact details. Databases can be incomplete, names may be transliterated differently and some certificates are not publicly searchable.

Step 7: Confirm product and report traceability

For product certificates and test reports, compare the document against the controlled buying specification.

Verify:

• exact model and variant;
• applicant and manufacturer;
• manufacturing site;
• photos or technical descriptions;
• materials, electrical ratings or other critical parameters;
• referenced standards and test methods;
• report number and linked certificate;
• sample date and test date;
• authorized modifications or extensions.

A valid report for a similar model is not proof for the product being ordered. If the supplier plans a new material, component, factory or subcontractor, determine whether the evidence still applies.

Step 8: Look for internal inconsistencies

Document design alone is a weak test, but inconsistencies can trigger deeper verification.

Watch for:

• spelling errors in issuer or standard names;
• inconsistent fonts, alignment or image quality;
• altered numbers or dates;
• missing pages or annexes;
• certificate numbers that do not match the issuer’s format;
• copied signatures or seals;
• QR codes leading to unrelated domains;
• impossible issue dates;
• supplier names that differ subtly across pages.

Do not accuse the supplier based only on visual clues. Verify with the issuer and record the result.

Step 9: Treat verification as one part of supplier approval

A real certificate is evidence—not a complete supplier assessment.

Depending on the product and risk, approval may also require:

• legal-entity and ownership checks;
• factory audit or remote capability assessment;
• product samples;
• independent testing;
• quality agreements and inspection plans;
• capacity and subcontracting verification;
• destination-market compliance review;
• controlled pre-shipment inspection.

Use the Supplier Evaluation Scorecard to connect verified documents to the actual decision criteria and mandatory gates.

Download the certificate-verification checklist

Use the printable checklist to record the document, issuer, accreditation, scope, entity, site, product match, status and verification result.

Download the Supplier Certificate Verification Checklist

What to do when a certificate cannot be verified

Do not simply mark it “fake” or proceed as if it were valid.

1. Ask the supplier for the full original document and annexes.
2. Request the issuer’s verification link or contact.
3. Contact the issuer independently.
4. Confirm accreditation status and scope.
5. Ask for model-specific evidence or a new test where needed.
6. Place supplier approval on hold until the material gap is resolved.
7. Record the issue in the supplier scorecard and decision log.

If the claim remains unsupported, treat it as a supplier-risk and integrity issue—not merely missing paperwork.

How Zignify can support verification

Zignify can help established brands and B2B buyers with supplier discovery, document review, issuer follow-up, factory verification, quotation comparison, quality planning and coordination of independent testing or inspections.

The service is paid professional sourcing support for commercial purchasing. Zignify is not a regulator, certification body, laboratory, retailer or legal adviser, and does not hold products in stock.

If you need a broader supplier search or help reviewing the evidence behind a commercial sourcing decision, submit a qualified product sourcing request.

Frequently asked questions

Can I verify an ISO certificate on the ISO website?

ISO does not issue certificates. Verify the certification body and use IAF CertSearch, the relevant accreditation body or direct issuer confirmation where applicable.

Does an ISO 9001 certificate prove product compliance?

No. It concerns a quality management system. Product compliance depends on the specific product, market, rules and applicable evidence.

What if the certificate number is not found online?

Contact the issuing body using independently sourced details. A missing database result is a warning requiring clarification, not automatic proof of fraud.

Can a genuine certificate still be irrelevant?

Yes. It may apply to a different legal entity, factory, activity, model, product variant, standard, test scope or validity period.

Should we accept a supplier’s screenshot of a certificate?

Request the complete original file and annexes. Screenshots may omit the scope, legal entity, dates, report links or limitations needed for verification.

Is certificate verification enough to approve a supplier?

No. It should be combined with commercial, legal, technical, capacity, quality and product-specific risk checks.