Why verification matters
An ISO certificate is only worth something if it is genuine, issued by an accredited certification body and still valid. Buyers, operators and regulators increasingly check. For example, the Nigerian Content Development and Monitoring Board (NCDMB) states that any ISO certificate submitted with an NCEC application must be issued by a certification body accredited under the International Accreditation Forum (IAF).
Checking takes a few minutes. Here is how to do it.
What a genuine accredited certificate shows
- The legal name and address of the certified organisation, and every site covered
- The standard and its version, for example ISO 9001:2015 or ISO/IEC 27001:2022
- A scope statement describing the activities that are certified
- A unique certificate number
- Issue and expiry dates, normally within a three-year cycle
- The name of the certification body that issued it
- The mark of the accreditation body, used under licence
Five steps to verify an ISO certificate
1. Check the certification body’s own register
Every reputable certification body can confirm its own certificates. Many have an online register or verification page, or a QR code or link printed on the certificate. SCL certificates can be checked on our certificate verification page.
2. Search IAF CertSearch
IAF CertSearch is the global database of accredited management system certifications. Search by company name or certificate number and check the standard, scope, status, certification body and accreditation body. You can verify a limited number of certificates free with an account.
3. Confirm the certification body is accredited for that standard
Accreditation is granted for specific standards. Check that the certification body is accredited by an accreditation body that is a signatory to the IAF Multilateral Recognition Arrangement (MLA), and that the accreditation covers the standard on the certificate. In Nigeria, the national accreditation body is the Nigeria National Accreditation System (NiNAS).
4. Check the scope and sites
Make sure the scope covers the products or services you are buying, and the site that will do the work. A certificate for “office administration” does not cover fabrication or offshore services.
5. Check the status and dates
Certificates are kept valid by annual surveillance audits. A certificate can be suspended or withdrawn if the company fails to maintain its system. Confirm the current status, not just the expiry date printed on the paper.
Warning signs of a fake or worthless certificate
- It claims to be issued or “approved” by ISO itself. ISO does not certify organisations.
- There is no accreditation mark, or the “accreditation body” is not a member of the IAF
- The certificate cannot be found on the certification body’s register or on IAF CertSearch, and the certification body will not confirm it
- It was issued within days, with no on-site audit
- The validity period is longer than three years
- The scope is vague, or does not match what the company actually does
- An ISO/IEC 27001 certificate still shows the 2013 version. The transition to ISO/IEC 27001:2022 ended on 31 October 2025.
Frequently asked questions
Is it free to check a certificate on IAF CertSearch?
Yes, within limits. Anyone can create a free account on IAF CertSearch and verify a small number of certificates each day. Organisations that check many suppliers can take a paid plan.
What does it mean if a certificate is not on IAF CertSearch?
It does not always mean the certificate is fake. Some certification bodies have not uploaded all their data yet, and some companies ask for their listing to be kept confidential. Contact the certification body that issued it and ask them to confirm it in writing.
Does ISO issue certificates?
No. ISO writes the standards but does not certify organisations. Certificates are issued by independent certification bodies. A certificate that claims to be issued or approved by ISO itself is a warning sign.
How can I verify a certificate issued by SCL?
Use the certificate verification page on the SCL portal, or email info@systemcertifications.com with the certificate number. We will confirm the status, standard and scope.
How long is an ISO certificate valid?
Accredited management system certificates are normally valid for three years, provided the company passes its annual surveillance audits. A certificate can be suspended or withdrawn before its expiry date.
Sources: IAF CertSearch FAQ; ISO: how to verify an accredited certification; NCDMB NCEC Application Guidance Notes (December 2025).