This article is being published with the permission of author. It was first published with ehealth, online magazine.
The advent of ISO 9001 in 1987 was a historic event – it revolutionized the approach to quality and brought in the concept of the systems approach. It inspired the adoption of the management systems approach across diverse domains — including environmental management (ISO 14001), food safety (ISO 22000), and information security (ISO 27001) — and this approach continues to expand into many other fields.
Not long after ISO 9001 was launched, ISO 9001 certification became an elitist tag – despite a visible loss of reputation over the years, it still remains the most popular and certified standard globally.
While the standard itself, and other management systems standards too, maybe magnificent, the problem is in certification. Their popularity has led to mushrooming of certification bodies globally, more so in India, and therefore the question arises – what is an authentic certificate?
Unlike many services, the first thing to be clear about is that there is no regulation of certification bodies – no licensing or registration. Anyone can set up a certification body – as a proprietorship or partnership or private limited or LLP or Society or Trust under relevant laws – and start issuing certificates. If such certificates are accepted in the market, it is perfectly legal and no one can stop it.
However, the risk is one does not know whether the certification body is competent and whether it follows a robust process or even actually does an audit. A number of unethical certification bodies operate in India and across the world, issuing certificates without conducting any audits, often to organizations that have no systems in place. Such practices undermine the integrity of the certification process and exploit the lack of regulatory oversight, turning certification into a mere formality rather than a mark of compliance. This problem is widespread in the Indian market and affects many other regions globally as well.
Therefore, such certificates can mislead individuals and organizations, as they cannot reliably verify whether the certification body possesses the required competence, has conducted a proper audit, or whether the certified organization has truly implemented the ISO standard it claims to follow. How does one then establish a certification body is authentic or the certificate is authentic?
Fortunately for us, ISO not only issued standards like ISO 9001 or ISO 14001 or ISO 13485, etc, it also issued standards for the process of certification along with competence of certification bodies – the ISO 17021 series of standards. Even better is that an international body, International Accreditation Forum (IAF), which now has an MoU with ISO, came up in 1993 to supervise certification to such standards through accreditation bodies in various countries – some like the EU have a single national accreditation body in each country by law, some have national accreditation bodies even though not by law but accreditation not being such a lucrative business, they remain the only ones like NABCB in India, and some like USA have multiple private accreditation bodies.
These accreditation bodies commit to operate as per applicable international standard, ISO 17011, for them and accredit certification bodies as per international standards applicable to them e.g. ISO 17021 series for management systems certification. Regional bodies evaluate accreditation bodies to ensure global consistency. In India, for instance, the Asia Pacific Accreditation Cooperation (APAC) conducts these evaluations. The International Accreditation Forum (IAF), in turn, evaluates the regional bodies. Once an accreditation body demonstrates full compliance with ISO/IEC 17011, the IAF grants it signatory status under the Multilateral Mutual Recognition Arrangement (MLA), confirming its international equivalence.
Both the peer evaluation of accreditation bodies by regional organizations and the IAF’s evaluation of regional bodies operate on a four-year cycle. This rigorous process ensures accountability across all levels — truly reflecting the principle: “In God we trust; all others must provide evidence.”
Certification bodies accredited by these accreditation bodies can claim international equivalence, and the certificates they issue — often displaying the accreditation body’s logo and sometimes the IAF logo — are considered accredited certificates and are recognized internationally.
Therefore, one can say that accreditation under the IAF system is arguably the only means of identifying an authentic certification body or certificate. The problem is that this entire system is voluntary – there is no legal binding for a certification body to get accredited or an accreditation body to become part of the IAF system.
There are indeed certification bodies in the market that are either unaccredited or claim accreditation from some unknown accreditation bodies typically based in USA or Europe but which are not part of the IAF system and hence it is not possible to vouch for their authenticity or even existence in some cases. Unlike the IAF system, these certification and accreditation bodies are under no oversight and not obliged to follow the international norms. One can term these certification bodies (and accreditation bodies) as unauthentic and certificates issued by them as unauthentic.
It is therefore necessary for all the stakeholders, particularly those who rely on ISO certificates, to be aware of the risks of unauthentic certificates in the market and verify that they are receiving a credible, authentic certificate under the IAF system unless there is an alternate system of authenticating certificates available.
An authentic certificate should contain the following:
- Name and address of the organization certified
- Scope of certification describing its activities under certification. For example production, packing and sale of dairy products like (broad list of products)
- Certification is granted against a specific standard, scheme, or regulation — for example, ISO 9001 or ISO 13485 (standards), and AS 9100 or FSSC 22000 (schemes). In general, guidance standards such as ISO 31000 are not eligible for certification, as they provide recommendations rather than enforceable requirements. Only formal requirement standards or specifications can serve as the basis for certification.
- Date of issue and expiry of certificate, observing a 3-year cycle
- Unique identification number of the certificate
- Name and address of the certification body (CB)
- Logo of the certification body
- Accreditation symbol indicating the name of the accreditation body (AB) which has accredited the certification body (in most countries, in the absence of any law requiring certification bodies to register, accreditation is the only way of recognizing a competent, authentic certification body)
- The IAF Mark indicates that the certificate falls under the Multilateral Mutual Recognition Arrangement (MLA) of the International Accreditation Forum (IAF). This mark signifies that the certification is internationally recognized, equivalent, and accepted in the global market.
To judge the authenticity of certificates, visit the IAF website, where you can view the names of member Accreditation Bodies (ABs). The site also lists which ABs are signatories to the IAF MLAs for specific schemes such as QMS, EMS, or FSMS. Once you identify the AB in a country, use the link on the IAF website to access its official website. There, you can verify whether the Certification Body (CB) holds valid accreditation.
Under international norms, CBs must assist in verifying the certificates they issue, so you can confirm the certificate details directly through the CB or the AB. If the certificate was issued under a specific scheme like IATF 16949 or AS 9100, you can also verify it through the respective scheme owners.
The safest course is to rely on the national body, the National Accreditation Board for Certification Bodies (NABCB), which is a member of IAF and internationally equivalent and insist on the NABCB logo on the certificates. In case of any other certificate, it would be best to verify the certificate from the AB concerned or even take the help of NABCB to verify the certificate. The list of certification bodies accredited by NABCB is publicly available at the website nabcb.qci.org.in.
The Indian market unfortunately is hugely risky in this regard and therefore all stakeholders, especially the industry as well as purchasers/buyers, need to be aware of the IAF system to ensure they receive authentic certificates in the first place.