How to Check If an ISO Certificate Is Genuine: NABCB, IAF and the Verification Every Buyer Should Do

Short answer: A genuine accredited ISO certificate can be traced in four moves: it carries the certification body's mark and an accreditation body's symbol, the body appears on NABCB's list for that standard and scope, the name, scope and dates match, and the number turns up on IAF CertSearch. If all four line up, it is accredited and current.

A buyer once showed me a certificate that looked perfect. Gold border, embossed seal, the standard number in large type. The company behind it had never been audited. The body that "issued" it had no accreditation, no office anyone could visit, and no listing anywhere. The buyer had already printed the logo on his tender documents. He found out when the tender desk asked one question he could not answer: who accredited your certifier?

That question is the whole game. Most guides on this topic tell you to "check the certificate online" and stop. That is not enough, because there are three different things a certificate can be, and only one of them passes a serious buyer. This post separates them, gives you the check in order, and covers the change that arrived in January 2026, when the body behind the familiar IAF mark stopped operating under that name.

First, the chain: who actually certifies whom

ISO writes standards. It does not issue certificates, audit companies, or keep a register of certified firms. That surprises people, and it is the root of most confusion.

Think of it like a driving test. ISO wrote the highway code. The certification body is the examiner — it audits your company against the standard and issues the certificate. The accreditation body is the authority that licences examiners: it assesses the certification body, watches its work, and can withdraw its licence. In India that authority is NABCB, a constituent board of the Quality Council of India, which sits under the Department for Promotion of Industry and Internal Trade in the Ministry of Commerce and Industry.

So a certificate is only as good as its chain. A strong chain reads: ISO standard → NABCB (or another recognised accreditation body) → accredited certification body → your company, audited and under surveillance. Break any link — an unaccredited body, a body accredited for a different standard, a certificate outside its scope — and the paper at the end carries no weight with a buyer who checks.

What a genuine accredited certificate must show

Hold the certificate and look for these, before you visit any website:

The standard, with its year. "ISO 9001:2015", not just "ISO 9001". An old edition is a warning sign on its own — a certificate still citing ISO 9001:2008 has expired, because that edition is long superseded.

The company name and address, exactly as registered. A mismatch here — a trade name where the legal name should be, an old address — is the commonest reason a verification search comes back empty.

The scope. One or two lines stating what the certificate covers: which sites, which products or services. A scope wider than the business — a trading firm certified for "manufacturing" — should make you pause.

The certification body's name and logo. The body that did the audit, named plainly.

The accreditation body's symbol. For an Indian accredited certificate, the NABCB symbol. For a foreign one, the symbol of that country's recognised accreditation body — UKAS in the UK, ANAB in the US, JAS-ANZ in Australia and New Zealand, and so on.

A certificate number, an issue date and an expiry date. Accredited management-system certificates run on a three-year cycle, with surveillance audits after the first and second years. A certificate with no expiry date, or a "lifetime" claim, is not an accredited certificate.

The IAF mark, where applicable. The mark showing the certificate sits under the international mutual recognition arrangement. Since January 2026 this arrangement has a new name, which the next-but-one section covers. Its absence alone does not condemn a certificate — use of the mark is optional — but its presence, genuine and matching, is a strong positive signal.

The five-minute check, in order

Step 1 — Read the certificate. Run down the list above. Note the certification body, the accreditation body, the standard and year, the scope, the certificate number and the dates. If the accreditation body's symbol is missing entirely, you already have your answer to the accredited question: it is not an accredited certificate. That does not yet make it a forgery — see the three buckets below — but it settles what a tender desk will do with it.

Step 2 — Check the certification body on the accreditation body's list. Go to NABCB's website and find its list of accredited certification bodies, then check two things, not one: that the body is listed, and that its accreditation covers this standard and this scope. A body accredited for ISO 9001 cannot issue an accredited ISO 27001 certificate. Bodies are authorised only for the standards and scope sectors they are accredited for, and a certificate outside that scope is outside the system however official it looks.

Step 3 — Check the certificate on the certification body's own site. Most accredited bodies run a certificate lookup: enter the certificate number and confirm the company name, standard, scope and validity. A number that returns nothing, or returns a different company, ends the check. Write to the body if you are unsure — a genuine body answers, because its own reputation rides on the answer.

Step 4 — Search IAF CertSearch. CertSearch is the global database for accredited certifications. It cross-checks three sources at once: the accreditation body's data, the certification body's data, and the certificate itself. Search by company name or certificate number. A clean hit there — company, standard, scope, current status — is the strongest confirmation available without writing to anyone.

What it means if CertSearch finds nothing

Here is where careless guides mislead you. Absence from CertSearch does not, on its own, prove a certificate is fake. The database depends on certification bodies feeding it their data, and not every accredited body feeds every certificate promptly; the guidance NABCB's former chief executive wrote for industry notes the database was still being built out, and that absence from it does not mean a certificate is not genuine.

So treat a blank CertSearch result as "unconfirmed", not "fake", and fall back to steps 2 and 3: the accreditation body's list and the certification body's own lookup. If both of those confirm it, you have an accredited certificate that simply is not in the global database yet. If neither confirms it, you have a problem, and the next section tells you which kind.

The 2026 change: IAF is now Global ACI

On 1 January 2026, the International Accreditation Forum (IAF) and the International Laboratory Accreditation Cooperation (ILAC) merged into a single body, the Global Accreditation Cooperation Incorporated — Global ACI. It now runs the single multilateral recognition arrangement that the old IAF arrangement fed into.

Three practical consequences. First, certificates and tender documents will increasingly say Global ACI where they used to say IAF; do not treat the new name as suspicious. Second, existing accreditations continue without interruption — nothing issued under the old arrangement stopped being valid on New Year's Day. Third, the old IAF and ILAC marks remain recognised as equivalent during the transition, with the changeover to the new Global ACI mark anticipated to run until 1 January 2029 or later. So a 2025 certificate carrying the IAF mark is not outdated, and a 2026 certificate carrying it is not wrong. What would be wrong is a body claiming a brand-new accreditation that appears on no list at all, under any of these names.

Three buckets: accredited, non-accredited, fake

This is the distinction most arguments about certificates miss.

Two points matter. A non-accredited certificate is not automatically a forgery. India does not licence certification bodies, so anyone can set one up and issue certificates, and if the market accepts them, that alone breaks no law. The harm is different: nobody independent has checked whether the body is competent or whether an audit happened at all. And a certificate crosses into fake the moment it is sold or presented as something it is not — an accreditation mark it does not hold, a scope it never audited, another company's number with a new name pasted over it. That line, misrepresentation, is the one to watch.

If you are buying certification for yourself, this is also the line that decides whether our ISO 9001 certification route fits your need: the consultancy prepares you for an accredited audit, and the certification body's fee is separate, because the audit must stay independent of the preparation. Our ISO 9001 cost guide sets out that two-bill split and why a single all-in price with no audit in it should worry you.

Red flags that should stop you

Any one of these is a reason to run the full check before you pay or accept anything:

No audit, or an audit that never visited. Accredited certification requires Stage 1 and Stage 2 audits, including time on site. A certificate promised in days, with no visit and no documents asked for, was not audited.

An accreditation body you cannot find. Search the body's name against the Global ACI membership and NABCB's lists. Bodies claiming accreditation from obscure outfits based overseas, outside the recognition system, cannot be vouched for — and that is the polite version.

A guidance standard sold as a certificate. Some ISO standards are guidance, not requirements — ISO 31000 on risk management is an example. You cannot be "certified" to a guidance standard. A certificate claiming it is paper, not certification.

Scope that outruns the business. A one-room trading office certified for design, manufacture and installation across five sites has not been audited for all of that.

Dates that do not add up. An issue date before the body existed, a three-year certificate with no surveillance dates, or an old standard edition still in force years after supersession.

Pressure to skip the check. "Our certificates are not on those websites, but everyone accepts them" is a sentence to walk away from. Genuine bodies want you to verify; it protects them too.

What to do if a supplier's certificate fails

Do not accuse first. Ask, in writing, for three things: the certification body's name and accreditation details, the certificate number, and permission to verify directly with the body. A genuine supplier produces all three without drama.

If the body confirms the certificate, the matter ends — file the confirmation with your vendor record. If the body says it never issued it, or the accreditation body says the body was never accredited for that standard, tell the supplier plainly and give a short deadline to produce an accredited certificate or lose the order. For tenders, write the requirement as "accredited certification, verifiable on NABCB's list or IAF CertSearch" rather than just "ISO certified" — that one clause does more than any amount of arguing after the bids arrive. And if you suspect outright forgery, send a copy to the accreditation body concerned; NABCB's own guidance invites exactly that, giving nabcb@qcin.org as the address for verification queries.

If it is your own certificate under question, the same file protects you: the audit reports, the surveillance schedule, the body's verification page. Keep them with the certificate, not somewhere else. A certificate on its own is a claim; a certificate with its audit trail is evidence. The same discipline applies across standards — our ISO 27001 cost guide for IT companies and our ISO 13485 and CDSCO guide both rest on the same point: the certificate matters because the audit behind it can be checked.

Frequently asked questions

Can I verify an ISO certificate free? Yes. The NABCB list, the certification body's own lookup and IAF CertSearch are free to search. Nobody legitimate charges you to confirm a certificate exists.

Does ISO itself verify certificates? No. ISO writes the standards and does not certify companies or keep a register. Verification runs through the accreditation body and the certification body, as this guide sets out.

My supplier's certificate has no NABCB logo but has a foreign accreditation mark. Is it valid? It can be, if the foreign body is a recognised accreditation body under the Global ACI arrangement and the certification body is accredited by it for that standard and scope. Check the body on that accreditation body's list, then on CertSearch. A foreign mark from a body outside the recognition system carries no more weight than no mark at all.

How long does an accredited ISO certificate last? Three years, with surveillance audits after the first and second years and recertification at the end of the cycle. A certificate past its expiry date, or one whose surveillance audits were skipped, is not current even if the paper still hangs on the wall.

Should I buy the cheapest ISO certificate I find? Only if no buyer, tender or regulator will ever check it. The cheapest offers are usually non-accredited: no independent audit, no listing, no verification. If anyone who matters asks for accredited certification, that certificate will be rejected, and you will pay twice — once for the paper, once for the real audit.

The check takes five minutes and costs nothing. The certificate that cannot survive it was never worth framing. Run the check before you sign, before you pay, and before you print the logo on a tender — that order is the whole lesson.