The Certificate Is Genuine. Is It the Factory You Are Buying From?

A certificate can be genuine and still leave the most important purchasing question unanswered. The company named on it may not be the company making the goods. The address may be a sales office. The activity being certified may be narrower than the manufacturing capability described in the quotation.

None of those differences proves fraud. They are reasons to stop treating certificate verification as a single yes-or-no exercise. For an industrial buyer, authenticity and relevance are separate checks.

Start with what has actually been certified

ISO describes ISO 9001 as a standard for an organization's quality management system. That is valuable evidence about its management arrangements, but it is not a test result for the parts on your purchase order. A drawing requirement, material grade or dimensional acceptance criterion still needs its own supporting evidence.

ISO also makes clear that it does not issue certificates. Certification is performed by external bodies. Its verification guidance points to checking through the relevant certification or accreditation body, or the applicable certificate database. A logo copied onto a company presentation is therefore not the thing to verify; the identifiable certification record is.

First obtain the certificate number, issuing body and full certificate, including any referenced schedule. Then compare the certified organization's legal name with the seller and the proposed manufacturer. A trading company can legitimately coordinate production elsewhere. The question is whether that arrangement is disclosed and whether the evidence supplied actually covers the operation on which the buyer is relying.

Read the scope as a purchasing document

Do not mentally expand a short scope statement. A description of sales and distribution is not interchangeable with a description of fabrication. Likewise, a certificate referring to one operation should not silently become proof that every business carrying the same group brand is covered.

For a multi-site organization, ask which listed location will perform the relevant work and how it appears in the certification record. If the supplier proposes to subcontract a process, ask who controls that process and what order-specific evidence will be supplied. These are suggested procurement checks, not a claim that each subcontractor must hold a separate ISO 9001 certificate.

Keep the response attached to the actual order. A buyer does not gain much from verifying one factory during supplier registration and then accepting deliveries from an undisclosed alternative. A simple record can connect the approved supplier, production address, covered activity and any declared subcontracting arrangement. The point is to preserve the identity of the operation, not accumulate more logos.

Check status without inventing a transition deadline

Standard editions and certification status are also different records. ISO's current public page identifies the 2026 edition and directs organizations certified to the preceding edition to their certification body for transition information. Publication of a revised standard is not sufficient evidence that a particular supplier's existing certificate became invalid overnight. Confirm its actual status and applicable transition arrangements with the issuer.

If a certificate cannot be verified immediately, record the uncertainty accurately: verification pending, scope unclear, or production location not yet connected. Do not turn a missing database result into an unsupported accusation, and do not turn a familiar accreditation symbol into a blanket approval.

The best outcome of this exercise is not a folder marked 'ISO checked.' It is a clear answer to a narrower question: what does this verified certificate tell us about the organization and activities that will fulfill this order? Product inspection and technical approval can then do their own jobs.

For the broader supplier decision, see verification before paying a steel-structure deposit.