How to Check if a Company Is ISO 9001 Certified
A certificate PDF proves nothing on its own. Where the registrar's register lives, what an accreditation mark is doing on the page, and how to tell a current certificate from a lapsed one.
Introduction
A supplier just emailed you a PDF. It has a logo, a company name, a certificate number, and the words "ISO 9001:2015" in bold. That is where most buyers stop. It is also exactly where you should start, because a PDF is a picture of a claim, not evidence of one.
Knowing how to verify a supplier's iso 9001 certification means checking the claim against a record you did not get from the supplier. That record exists. It usually takes less time to check than it took the supplier to attach the file. This article walks through what the certificate actually represents, where to go to confirm it, and what each field on the page is supposed to prove.
Why the certificate PDF is not the proof
A certificate is a document a company can produce, scan, edit, or hand you years after it expired. None of that is unusual or even necessarily dishonest — most expired certificates sitting in a sales folder are just outdated, not forged. But a PDF by itself carries no live status. It cannot tell you whether the certification body that issued it still exists, still backs it, or pulled it last month.
The actual proof lives somewhere else: in a register kept by the organization that issued the certificate, or in a shared database that organization reports to. The certificate is a pointer to that record. Treat it as a starting point for a lookup, not as the answer.
That distinction matters because the stakes are not abstract. A machine shop with a lapsed or fabricated certificate can still ship parts, invoice you, and show up for an audit with a printed copy on the wall. The only way to know the difference between that shop and one with a currently valid, accredited certificate is to go check.
A certificate like that one has everything a legitimate one has: a registrar name, a certificate number, a scope, dates, and a logo. Whether it is worth anything depends entirely on what happens when you take those details somewhere else.
Accredited, certified, and self-declared
These three terms get used as if they mean the same thing. They do not, and the gap between them is the whole point of checking.
ISO itself certifies no one. ISO writes the standard; it does not audit companies or hand out certificates. ISO says this plainly: it "does not perform certification" and cannot certify or accredit any organization — that job belongs to independent, external bodies. Anyone who tells you their company is "ISO certified by ISO" has already gotten something wrong.
Here is the actual chain. The International Accreditation Forum (IAF) sits at the top. Its members are national accreditation bodies — ANAB in the United States, UKAS in the United Kingdom — that have signed the IAF Multilateral Recognition Arrangement (MLA), a mutual agreement that lets accreditations issued in one member country be trusted in another. An accreditation body audits and accredits certification bodies, often called registrars. A registrar then audits individual companies and issues certificates against the standard.
"Accredited certification" means the registrar that issued your supplier's certificate has itself been assessed and accredited by a recognized accreditation body, for that specific standard and scope. "Certified" on its own just means some registrar, accredited or not, issued a piece of paper. "Self-declared conformity" is a step below that: the company says it follows ISO 9001's requirements, with no outside audit at all. All three show up described as "ISO 9001 certified" in casual conversation. Only the first one carries independent verification behind it.
Every check described in this article exists to figure out which branch of that diagram your supplier's certificate actually sits on.
Find the registrar before you find the register
Before you can look anything up, you need to know who issued the certificate. The registrar's name is printed on the document, usually near its own logo and accreditation mark. Names that commonly show up on certificates held by US manufacturers include SGS, DEKRA, NSF-ISR (NSF International Strategic Registrations), Perry Johnson Registrars (PJR), DQS, and various TÜV entities.
Do not take the registrar's name on faith either. Ask the supplier directly for the certificate number and the registrar's name in writing, rather than relying only on the PDF's formatting. If the certificate lists an accreditation body logo — ANAB, UKAS, or another national accreditation body — note that too. You will need it to confirm the accreditation body is a recognized IAF MLA signatory, which is a separate check from confirming the registrar itself.
Once you have the registrar's name, the next step is to find that registrar's own record of the certificate, not a generic search engine result for the company name.
Search the registrar's public database
Go to the registrar's own website and look for its public certificate register — a searchable tool where you enter a certificate number or company name and get back the current status. Not every registrar publishes one, and among those that do, the location and interface differ from registrar to registrar, with no single central index that this article can point to directly. Search the registrar's own site, not a third party claiming to host its data.
What you are looking for in the result is simple: does the certificate number match, is the company name and site the same one quoting your work, and does the register show the certificate as currently active rather than expired, suspended, or withdrawn. If the registrar has no public register at all, that is not automatically a red flag, but it does mean you move to the next method rather than taking the PDF at its word.
A clean result like the one above gives you a status and a certificate number you can then cross-check somewhere else — which is the next step regardless of what the registrar's own register showed.
Cross-check in IAF CertSearch
IAF CertSearch (iafcertsearch.org) is the global register of accredited management-system certificates, fed by data from more than 2,500 certification and accreditation bodies worldwide. It covers ISO 9001 along with other management-system standards like ISO 14001 and ISO 45001, for any certification body that reports into it. A result shows the certificate's status, its scope, the sites covered, the issuing registrar, and the accreditation body that accredited that registrar.
Search the supplier's company name or certificate number there as a second, independent check against whatever the registrar's own register showed you.
A result not showing up in CertSearch is not proof the certificate is fake. CertSearch only covers registrars that are IAF MLA signatories and that have actually connected their data feed to it, and the rollout has had documented gaps where accredited registrars simply had not synced their records yet. A missing listing means you need to verify through the registrar directly or through the accreditation body's own directory — not that you caught someone lying.
One more useful stop: ANAB, the US accreditation body, keeps its own directory of the certification bodies it accredits for management-systems scope, at anab.ansi.org. That directory confirms whether a registrar itself is accredited. It is not a lookup for individual company certificates, so it answers a different question than CertSearch does, but it is the right place to confirm the registrar is legitimate in the first place.
Read the scope statement, not the logo
A certificate can be completely real and still tell you nothing about the work you need done. The logo and the bold "ISO 9001:2015" text are the least informative parts of the page. Four other fields decide whether the certificate actually backs the job in front of you.
| Field | What it proves | How it fails |
|---|---|---|
| Scope statement | Exactly which processes, products, or services the audit covered | Scope covers "assembly" but not "machining," or otherwise excludes the work you're sourcing |
| Site address | Which physical facility was actually audited | The certificate belongs to a different location than the one quoting or shipping your parts |
| Expiry date | Whether the certificate is currently valid | The certificate has lapsed and was never renewed, but is still shown to you as current |
| Accreditation mark | Whether the registrar that issued it was itself accredited by a recognized body | The mark is missing, altered, or from a body that isn't a recognized IAF MLA signatory |
Each callout above maps to one row in that table. Read all four before you read anything else on the page. A supplier can hold a genuinely accredited, currently valid certificate that still does not cover the process you need, or that was issued to a sister facility across town rather than the one building your parts.
Expiry, suspension, and withdrawal
ISO 9001 certificates run on a three-year cycle from the date of initial certification. In years one and two, the registrar runs a surveillance audit — a shorter annual check, typically covering somewhere around 30 to 40 percent of the full scope, confirming the quality management system is still functioning rather than re-auditing everything. In year three, the registrar runs a full recertification audit, similar in depth to the original certification audit, ideally finished a few months before the certificate's expiry date. This cycle is general industry practice described consistently across several registrars' own sites rather than a single clause you can cite in the standard itself.
Three outcomes matter when you're checking a certificate's status. Expiry is the simplest: the stated validity date passes with no renewal audit completed, and the certificate lapses automatically. No one has to act for that to happen — it just becomes invalid.
Suspension is different. It is a temporary, active pause imposed by the registrar, usually for a serious nonconformity found during an audit, a missed surveillance audit, or sometimes a voluntary request from the company itself. During a suspension, the company may not claim certification at all. Suspension is reversible if the underlying issue gets fixed within a window the registrar sets — the length of that window is specific to each registrar's own policy, not a universal rule, so do not assume a fixed number of months applies across every certification body.
Withdrawal is permanent. The certificate is revoked, either because the company surrendered it voluntarily or because the registrar pulled it after an unresolved suspension, non-payment, or a missed assessment. Getting a withdrawn certificate back requires a fresh reassessment from the start, not a quick catch-up audit.
What to do when the shop is not listed
Sometimes none of these checks turn anything up. The registrar has no public register, or the shop doesn't appear in IAF CertSearch under the name or number you were given. That is a dead end for a self-service lookup, not a verdict on the supplier.
There is no single published procedure from ISO or IAF for exactly this situation, so what follows is reasonable practice rather than an official rule. Start by asking the supplier directly for the registrar's name, the certificate number, and the accreditation body shown on the certificate — in writing, not from a scan. Then contact that registrar directly, by phone or through its own contact channel, and ask it to confirm the certificate and its scope. If you want to confirm the registrar itself is legitimate before you even call it, check the relevant accreditation body's own directory of the certification bodies it accredits, such as ANAB's directory for the US.
A shop that cannot produce a registrar name, or whose registrar will not confirm the certificate when you call, is a real red flag. A shop that simply isn't in IAF CertSearch yet, on its own, is not. Keep those two situations separate, and don't let the second stand in for the first.
Conclusion
A certificate is a claim, and claims get checked against records, not against themselves. The chain behind a legitimate certificate runs from an accreditation body, to a registrar that body accredited, to the audit that registrar actually performed on the facility in question. Confirming any certificate means tracing that chain yourself: find the registrar, check its register and IAF CertSearch, and read the scope, site, expiry, and accreditation mark before you read anything else.
None of this takes long once you know where to look, and none of it requires taking the supplier's word for anything. A supplier with a real, accredited, in-scope certificate will not mind you checking. One who can't be verified at all has told you something useful too.