How to Verify ISO Certification Claim in a PE Screen

Executive Summary

A claim that a target is "ISO certified" is only a usable mandate-fit signal once it has been resolved to five things: a named legal entity, a specific site, a certified scope of activities, a standard and edition, and a current status on a stated date. ISO itself does not perform certification or issue certificates ^[1], so every such claim traces to an independent certification body, and the strength of that trace depends on whether the body is accredited, which is not compulsory. A website badge therefore proves nothing about coverage until it is matched to a record.

The primary public lookup is IAF CertSearch, which ISO recommends for certificates issued by accredited bodies ^[1]. Its FAQ states that the database only contains accredited certifications ^[2], that a certificate can be validated only if the certified entity is already known ^[2], and that no user can download or view a list of certifications ^[2]. Absence from search is consequently a research exception, not evidence of a false claim. When a record is missing, conflicting or confidential, ISO points to the certification body, the accreditation body or Global ACI ^[1]. CertSearch displays scope, certified locations, the issuing body and the accreditation body ^[2], with statuses of Active, Suspended, Withdrawn or Expired.

As of October 2026 the institutional picture has changed. ISO states that Global ACI has assumed the former roles of the International Accreditation Forum (IAF) ^[1]. An IAF resolution approved in principle the transfer of CertSearch ownership to Global ACI (Source: iaf.nu), yet an undated CertSearch FAQ page still names IAF Database LLC as owner ^[3]. This report found no source confirming completion, so analysts should record the operator as unverified.

The edition also matters. ISO published ISO 9001:2026 on 16 September 2026 ^[4], and ISO/TC 176 gives 30 September 2029 as the deadline for existing ISO 9001:2015 certificate holders ^[5]. A 2015-edition certificate in late 2026 is therefore normal, not suspect. For multi-site targets, IAF MD 1 permits sampling of similar sites (Source: iaf.nu), so the share of sites with verified, in-scope coverage should be reported with an explicit denominator and a count of unresolved sites. The worked example below (hypothetical) shows 5 of 12 sites verified in scope (41.7%), with an upper bound of 75.0% if every unresolved site were later confirmed.

Introduction and Background

Industrial private equity origination teams routinely meet statements such as "ISO 9001 certified" in company websites, trade-show materials and data-room summaries. For a mandate that requires quality-system maturity, the statement can be a useful screening input. For a screen that must be defensible months later, it is only an unverified claim until someone has tied it to a record. This report, written for origination analysts, sets out a dated, repeatable protocol for that tie. It is deliberately narrower than a general ISO explainer: it concerns one decision, namely whether a claimed ISO management-system certification is a credible signal for the named operating entity and the relevant site.

The distinction between a claim and a verified fact has practical weight. ISO defines certification as the provision by an independent body of written assurance, in the form of a certificate ^[1], and accreditation as the formal recognition of a certification body. A company is never "certified by ISO". The certificate comes from a certification body, and the strength of the signal depends on who accredited that body, for which scope, and whether the certificate is still in force.

The publisher, Docket, offers deal-origination and acquisition target research for private equity firms and treats certificate checks as one evidence item inside a wider screen. The approach here is generic and can be run manually with public tools. It makes no promise about deal outcomes, and it treats a failed or ambiguous lookup as an open research question, not as a finding about the target. Legal, regulatory or technical-audit conclusions remain with qualified professionals.

The sources are official and dated: ISO guidance, CertSearch support documentation, Global ACI, national accreditation bodies such as ANAB and UKAS, certification bodies' own validation pages, and standards text. All were retrieved on 27 October 2026. Where sources conflict, the conflict is preserved and labelled. Along the way the report answers how to verify an ISO 9001 certificate, how to check whether a supplier is ISO certified, how to use IAF CertSearch, which red flags warrant escalation, how accredited and unaccredited certificates differ, and how scope and expiry should be checked.

Definitions and Taxonomy: What a Certificate Claim Covers

Certification, accreditation and the parties between

Three parties appear in any accredited management-system certificate. The organization is audited. The certification body (CB) audits it and issues the certificate. The accreditation body (AB) assesses the CB. The standard for certification bodies, ISO/IEC 17021-1, sets principles and requirements for competence, consistency and impartiality of bodies providing audit and certification ^[6]. UKAS, the UK accreditation body, summarizes the layering as "check the checkers" ^[7], and notes that only certification bodies are described as accredited while their audited clients hold "accredited certification" ^[7].

Accreditation is generally voluntary. Global ACI says that in most countries accreditation is voluntary ^[8]. For an origination analyst the consequence is direct: an unaccredited certificate is a weaker, differently verified signal, not automatic grounds for exclusion. Record it as "certificate claimed, accreditation not shown" and let the mandate decide whether accredited certification is required.

Certification itself is optional. ISO states that organizations implementing ISO 9001 can choose whether or not to seek certification ^[9]. A target with no certificate may run a mature quality system, and a certificate does not by itself show product quality: one certification body states that ISO 9001 certification does not mean the company manufactures products or provides services of higher quality ^[10]. The signal concerns a management system, scoped to specified activities and sites.

The unit of verification

A certificate claim has at least six components, each of which must be resolved. The certification-document clause of ISO/IEC 17021-1 (clause 8.2.2), as reproduced in a public copy hosted by law.resource.org (a 2015-edition text, so check the current edition before relying on it), provides a checklist:

• Certified entity and location: the name and geographical location of each certified client, or the headquarters and sites for a multi-site certification ^[11].
• Scope: the type of activities, products and services covered ^[11].
• Standard and edition: the management system standard, including indication of issue status ^[11].
• Dates: the expiry date or recertification due date consistent with the recertification cycle ^[11].
• Issuer: the name, address and certification mark of the certification body ^[11].
• Identifier: ANAB, the US accreditation body, tells readers to look for a unique identification number or code ^[12].

Status completes the set, because the certification body must be able to confirm the status of a given certification on request ^[11]. These components, plus an observation date, become the columns of the worksheet presented later.

Who is who after the 2026 institutional change

Until the end of 2025, readers were pointed to the International Accreditation Forum (IAF) and, for laboratories, the International Laboratory Accreditation Cooperation (ILAC). IAF's own FAQ said both bodies would cease active operations following their dissolution plans (Source: iaf.nu). Global ACI reports it became fully operational on 1 January 2026, assuming those roles ^[8] (Source: iaf.nu), with membership spanning 142 countries according to UKAS ^[13], and a Global ACI letter to regulators published by the Australian accreditation body NATA says IAF and ILAC became non-operational as of that date (Source: nata.com.au). The same letter gives an anticipated end date for continued use of the legacy IAF and ILAC marks of 1 January 2029 (Source: nata.com.au). UKAS reports that a new arrangement replaces the former ILAC MRA and IAF MLA ^[13].

Two limits matter for verification. Global ACI itself does not assess and accredit conformity assessment bodies ^[8], and it does not issue certificates ^[8]. It points purchasers back to the conformity assessment body shown on the document to confirm validity ^[8]. It also says existing IAF and ILAC documents continue until equivalent Global ACI documents are adopted ^[8], which is why IAF-branded guidance such as IAF MD 1 remains in use.

Walking the Evidence Chain: From Claim to Record

Step 1: capture the claim before looking anything up

Record the claim exactly as made, with the URL or document where it appeared, the wording, the date seen, and any badge or certificate image. Capture the standard cited, the edition if shown, the certification body if named, and any certificate number. ISO notes that the certification body can be identified from the statement of certification, the certification mark used by the organization, or by requesting a copy of the certificate ^[1]. Capturing the claim first prevents a later search result from silently rewriting what was originally asserted.

Step 2: reconcile the entity before searching

Certificates are issued to legal entities, and brands are not legal entities. A website may promote a trade name while the certificate names a holding company, a regional subsidiary or a former name. The US Small Business Administration explains that a DBA is also known as a trade name, fictitious name, or assumed name ^[14], and most states require registration with the Secretary of State ^[14]. The IRS instructions for Form SS-4 note that each corporation in an affiliated group must have its own employer identification number ^[15]. Useful public cross-checks include:

• State registries: Delaware says its name search is intended to provide general entity details ^[16], a reminder that registry lookups confirm existence, not certificate coverage.
• Legal Entity Identifier (LEI) records: GLEIF states that every LEI is unique and can represent only one entity ^[17], and alternate names sit in an optional field ^[18], so an empty field proves little.
• SEC filings: for public registrants, Exhibit 21 requires subsidiary lists including the names under which subsidiaries do business ^[19].
• UK Companies House: registered address and incorporation date are free to view ^[20].

Reconcile an alias only with independent evidence, for example a registry record that lists the trade name plus a website footer naming the legal entity. If only the website links the brand and the certificate holder, mark the match "probable" and keep it out of any scored result until confirmed.

Step 3: search CertSearch by known entity or certificate number

IAF CertSearch invites users to search by company name or certificate details ^[21]. The FAQ states that a certification can be validated only if the certified entity is known ^[2], and that no user can download or view a list of certifications ^[2]. The tool is therefore a verification instrument, not a prospecting database. Practical points as of October 2026:

• Name language: the public user must search for the company name in the language the certification body uploaded ^[22], so a translated or anglicised name may not match.
• Access tiers: the IAF CertSearch support FAQ describes free public access as up to 3 certifications per day and 30 verifications for free ^[2]. Access tiers and limits change, so check them live on the ^[23] plans page before relying on this.
• Sites: results carry a badge showing the number of sites covered ^[24].
• Scale: bulk matching of 10,000 or more companies is advertised ^[21].

Whether public or free users see issue and expiry dates on the certificate detail screen was not confirmed from the documentation reviewed. The upload specification requires certification bodies to supply the issue and expiry dates ^[22], but the worksheet should record dates only as displayed or as obtained from the issuer.

Step 4: read status, issuer, accreditor, standard and scope

CertSearch defines its public statuses in plain terms. A certificate is Active when currently valid and compliant ^[25], Suspended when temporarily inactive and possibly under review ^[25], Expired when no longer valid due to reaching its end date ^[25], and Withdrawn when permanently revoked by the certification body. Status is only as current as the issuing body's last upload, and the minimum upload frequency is once a month ^[22], so a displayed status can lag real events.

Read the scope and locations against the target's actual operations. The upload specification requires the address of all additional certified sites, and a certificate that covers "design and sale of industrial valves" at a headquarters does not necessarily cover machining at a second plant. Also check that the accreditation covers the standard: UKAS warns that a certification body may hold accreditation that does not include the service in question, so the accreditation body's scope listing should be checked ^[26].

Step 5: understand what absence means

CertSearch support documentation lists several reasons a certificate may not be found: the certification has not yet been added to the database ^[27], or the company's name is restricted and confidential. A non-accredited certificate would not appear at all, and ISO's help article likewise notes that the database includes only accredited certificates ^[28].

Sources differ on how much weight absence carries. UKAS says in a 2022 factsheet that, because its accredited certification bodies must provide and keep updated data on their certified clients, a company not found on UKAS CertCheck does not hold UKAS accredited certification ^[29], while its validation guidance states that it is not mandatory for certification bodies to upload certificate data to CertSearch ^[26]. Both can be true: a national database with a loading requirement supports a firmer inference than a global database with uneven participation. For screening, absence from CertSearch is a prompt for a second route, not a conclusion. For confidential entries, users are directed to make direct contact with the certification body ^[30].

Step 6: use the issuer's own validation route

When CertSearch is silent, ambiguous or conflicting, go to the issuer. ANAB states that questions about whether a certificate is valid should be asked of the certification body ^[12], and UKAS describes the final step as obtaining confirmation that the certificate itself is valid ^[26]. Table 1 below summarizes public routes documented on official pages.

The table shows that direct validation routes differ in structure, not just in branding. Some are open searches, one is a form-and-reply process, and several are limited to a single legal entity within a global group. The practical lesson is to identify the issuing body first, from the certificate or the CertSearch record, and then use that body's route. Where the route is request-based, build the response time into the research plan and record the date of the request. The ANAB directory answers a different question, whether the issuing body itself is accredited, and should not be mistaken for a client-certificate check.

Red Flags and Accreditation Quality

Accreditation bodies publish what a proper certificate should show, and the absence of those elements is the most defensible list of red flags. No source reviewed publishes a ranked checklist of fake ISO certificate indicators, so the indicators below are derived from the content rules above and are analyst interpretation, not an official taxonomy.

• No certification body or mark: ANAB lists the name, address and certification mark of the certification body among the items a certificate should show ^[12].
• No site address or a generic location: ANAB expects the company name and geographic location ^[12].
• No scope, or a scope far wider than operations: ANAB expects a stated scope of certification ^[12].
• No certificate number or dates: ANAB expects issue and expiry dates ^[12].
• An accreditation symbol with no matching accreditation record: a European accreditation FAQ, quoting IAF Resolution 2016-17, says an accredited certificate must display the accreditation symbol and/or reference the accreditation status ^[37], which is the claim to test against the accreditation body's directory.
• The ISO logo used as a certification mark: ISO does not permit anyone to use the ISO logo in connection with certification ^[1], so the issuer's own mark is what should appear.

A single red flag is a reason to escalate, not a conclusion. Formats vary between certification bodies, older certificates may predate current layouts, and a missing element often reflects a template. Where a claim of certification itself appears incorrect, ISO advises that complaints be addressed to the certification body that certified the organization ^[1]; that route is a matter for the client's legal and compliance advisers, not for an origination analyst.

Accredited versus unaccredited certificates

Accredited means the certification body has been assessed by an accreditation body within the international arrangement. Unaccredited means no such assessment exists or none is shown. ISO's position is neutral: accreditation provides independent confirmation of competence, but it is not compulsory, and non-accreditation does not necessarily mean the certification body is not reputable ^[1]. The implications for a screen are:

• Accredited, found in CertSearch: the strongest and most easily dated evidence.
• Accredited body, certificate not found: an open research exception; query the body.
• Unaccredited body: no database check is possible. The evidence is the certificate document, any audit report that is shared, and the body's standing. Record a lower-assurance signal and let the mandate decide.
• Accreditation in transition: UKAS treats certificates issued before a body's transition decision for ISO 14001:2026 as unaccredited ^[38], so a new-edition certificate may legitimately appear without an accreditation mark for a short period.

Implementation: A Worksheet and Decision Matrix for PE Screens

The claim-to-certificate worksheet

Table 2 below is a copyable structure. Each row is one claimed certificate and site. Record the retrieval date for each evidence item, because the record is only true as of that day.

The worksheet breaks the claim into the components a certificate actually contains. Two fields do the most work in practice, and both are set out in the plain-text header below: "site_in_target_perimeter" (the covered addresses row of Table 2) and "entity_match" (the claimant legal name versus brand row). Many ambiguous results disappear once those are filled, because the certificate turns out to belong to a sister entity or to a site outside the mandate perimeter.

A plain-text version that can be pasted into a spreadsheet header or research log:

claim_text | claim_url | date_seen | brand | legal_entity | entity_match(confirmed/probable/unmatched)
standard | edition | certificate_id | certification_body | accreditation_body
scope_text | site_address | site_in_target_perimeter(Y/N) | status | issue_date | expiry_date
lookup_route | observation_date | evidence_file | outcome_class | next_action

Status decision matrix

Table 3 maps outcomes to actions. The classes and actions are an analyst-defined convention for origination screens, not an official taxonomy, and each mandate should set its own thresholds.

The matrix keeps three principles visible. A criterion is credited only for verified, in-scope coverage. An expired or suspended record is a hold because a renewal may be in progress, not a rejection. And nothing treats absence of a certificate as disqualifying by default, which is consistent with certification being optional.

Edition and transition handling

A certificate must be read against the edition in force. ISO states that ISO 9001:2026 is now the current edition, replacing ISO 9001:2015 ^[40], and organizations certified to the 2015 edition have three years to move. The certification body explains the timeline for each organization ^[40]. One certification body states that a 2015 certificate remains valid throughout the transition period ^[41] and that afterwards 2015 certifications will expire or be withdrawn ^[41]. That post-deadline statement comes from an issuer, not from ISO, and should be treated as an issuer position.

Edition is a worksheet field, not a pass/fail test. A 2015 certificate in late 2026 is normal, and a screen that rejected it would be wrong. The dates to watch are listed in the next section.

Data Analysis and Evidence

Scale of the certified population

ISO states that ISO 9001 has more than one million certificates issued to organizations in 189 countries ^[9]. ISO's wording equates certificates with organizations, which is a simplification: a company can hold several certificates and a certificate can cover several sites. The ISO Survey, the main annual count, counts certificates issued by certification bodies accredited by members of the international accreditation arrangement ^[42], and from 2025 onwards is compiled from anonymised, aggregated data in IAF CertSearch ^[42].

A Spanish-language summary by the certification body DQS (second-hand and indicative, and not an ISO publication) reports about 3.3 million accredited certificates worldwide in the ISO Survey 2025 ^[43], with 80 of the 81 in-scope accreditation bodies participating ^[43], and cautions that some data may still be incomplete in certain countries or standards ^[43]. Because the detailed Survey tables are login-gated, this report treats that second-hand total as indicative. The implication is that survey counts cover only accredited, uploaded certificates, so they do not estimate how many targets hold ISO certification in general.

CertSearch itself says it receives data from certification and accreditation bodies worldwide, and UKAS says CertCheck contains over 300,000 management system certifications issued by UKAS-accredited certification bodies ^[7]. These are operator-reported figures, not independent audits of coverage.

Multi-site sampling: why a listed site is not necessarily an audited site

IAF MD 1 (Issue 3, 18 October 2023) allows sampling where the sites perform very similar processes (Source: iaf.nu). For an initial audit the sample size is the square root of the number of sites (Source: iaf.nu), and the annual surveillance sample uses a 0.6 coefficient (Source: iaf.nu). At least 25% of the sample must be selected at random (Source: iaf.nu). The arithmetic gives these examples:

• 12 sites: initial sample of the square root of 12 = 3.46, rounded up to 4 sites; annual surveillance sample 0.6 x 3.46 = 2.08, rounded up to 3 sites.
• 100 sites: initial sample of 10 sites; annual surveillance sample of 6 sites.

Every site must still be listed on the certificate, so sampling does not change whether a site is covered. It does mean that "covered" and "audited this year" are different facts, and the value of a multi-site certificate as evidence of site-level practice is bounded by the sampling design. Whether a given certificate used sampling is a question for the certification body; CertSearch is not documented to display it.

Key dates for an October 2026 screen

• 1 January 2026: Global ACI fully operational, assuming the former roles of IAF and ILAC ^[8].
• 15 April 2026: ISO 14001:2026 published ^[44].
• 16 September 2026: ISO 9001:2026 published ^[4].
• 30 June 2027: accredited certification bodies must submit their ISO 9001 transition declaration ^[5].
• 31 March 2028: new and initial accredited ISO 9001 certifications may only be issued to the 2026 edition ^[5].
• 1 January 2029: anticipated end date for continued use of the legacy IAF and ILAC marks (Source: nata.com.au).
• 30 September 2029: existing ISO 9001:2015 holders must complete transition ^[5].

ISO 14001 shows that national bodies can set their own dates. Malaysia's accreditation body states that after 30 April 2029 accredited certification to ISO 14001:2015 shall no longer be accepted (Source: jsm.gov.my). ISO 45001 is under revision, planned for publication as ISO 45001:2027 ^[45], so a claim about occupational health and safety certification should also record the edition.

Certificate lifecycle affects how "current" a claim is. One certification body describes a three-year validity ^[46], with continued validity depending on surveillance audits at least once a year ^[46]. Accreditation bodies' own ISO 9001 cycle statements were not found in the sources reviewed, so this describes one issuer's practice.

Worked Example: Site Coverage Share (Hypothetical Example)

The following is a fictional illustration. "Example Components Group" and its sites do not exist, and the figures are invented to show the calculation.

An origination analyst screens Example Components Group, which has 12 operating sites inside a mandate perimeter that requires ISO 9001 coverage. The group's website says "ISO 9001 certified". The analyst applies the protocol and records an outcome per site, with a denominator of 12.

• Verified, in scope: 5 sites (41.7% of 12).
• Verified, wrong site or scope: 2 sites (16.7%).
• Expired: 1 site (8.3%).
• Conflicting name: 1 site (8.3%).
• No matching record: 2 sites (16.7%).
• Unknown (confidential entry): 1 site (8.3%).
• Total: 12 sites (100.0%).

The headline result is 5 of 12, or 41.7%, verified in scope. Three categories are unresolved (conflicting name, no matching record, unknown), totalling 4 sites. If all four were later confirmed in scope, the upper bound would be 9 of 12, or 75.0%. The expired site is held, not counted, because a renewal could be in progress, and the two wrong-scope sites are treated as not covered unless another certificate is found. Reporting the range, 41.7% to 75.0%, is more defensible than a single percentage, and the 4 unresolved sites become the research queue.

A sampling caveat applies. If one certificate lists all 12 sites under a multi-site arrangement, the initial audit sample under the IAF MD 1 formula would have been 4 sites, so the 5 verified sites show coverage on paper and say less about audited practice at each. The analyst records the figure as "listed and in scope" and asks the issuing body whether sampling was used. A mandate can also weight sites by revenue or headcount, which changes the share without changing the verified count.

Implications and Future Directions

Recheck triggers and dating the record

A verification is a snapshot. Because uploads can lag by up to a month and statuses change on suspension, expiry or withdrawal, each record should carry an observation date and a recheck trigger. Sensible triggers in a PE process are a change of owner or legal entity, a new site added to the perimeter, an expiry date inside the expected deal timeline, an edition transition event, and the move from origination to formal diligence. UKAS CertCheck lets registered users track certificates and receive notifications if the accredited status changes ^[47], which shows that status monitoring is a recognized practice.

Governance uncertainty to monitor

Three questions remain open as of October 2026. First, whether the transfer of CertSearch ownership approved in principle by IAF has completed: a CertSearch support page still names IAF Database LLC as owner ^[3]. Second, whether Global ACI will issue replacement documents for IAF MD 1 and related rules. Third, how national bodies set transition dates for ISO 9001:2026, since ISO leaves timelines to certification bodies. A report that cites CertSearch should state the operator as unverified until an official source confirms the position, and should be re-read against the current CertSearch and Global ACI pages before publication.

How the protocol fits wider screening

Certificate checks answer a narrow question within commercial and operational due diligence on quality certifications. Operational due diligence commentary for private equity generally treats production questions as topics for discussion after a site visit ^[48]. US federal acquisition rules name ISO 9001 as an example of a higher-level quality standard ^[49], with agencies directed to establish procedures for determining when such requirements are necessary ^[49]. Together these suggest a certificate is best used to prioritize further work, for example which sites to visit, and not as a substitute for an operational review.

For origination teams, the efficient design is to run the lookup early, when only a name is available, and keep the output structured so that a later reviewer can see which sites were covered, which were unresolved, and when each was observed. The publisher's own service is one way to organize such evidence, but the protocol works manually, in a spreadsheet, with the public tools described above.

Frequently Asked Questions (FAQs)

How do you verify an ISO 9001 certificate?

Capture the claim, reconcile the legal entity, then search IAF CertSearch by company name or certificate details. Read status, scope, locations, certification body and accreditation body, and confirm with the issuing body if anything is missing or conflicting ^[12].

Is a supplier or target ISO certified?

Only a record tied to the right legal entity, site and scope answers this; a website badge does not. If the entry is absent, the cause may be non-accreditation, a missing upload or confidentiality, so ask the issuer before drawing a conclusion.

What does IAF CertSearch cover, and what does it not?

It covers accredited management-system certification and has no plan to cover other areas ^[2]. It does not list unaccredited certificates and does not allow browsing of certificate lists.

Can ISO confirm a certificate?

No. ISO does not perform certification or issue certificates, and its help article refers readers to their national accreditation body, the certification body or the database.

Does an unaccredited certificate mean the company is unsuitable?

Not automatically. Accreditation is not compulsory, so the mandate should decide how much weight to give a lower-assurance signal.

How should ISO 9001 certificate scope and expiry be checked?

Record status and dates as displayed or as confirmed by the issuer, and compare scope and site addresses with the target's operations.

Conclusion

Verifying an ISO certification claim for an industrial target is a matter of resolving the claim into its components and recording evidence for each: entity, site, scope, edition, issuer, accreditor, status and observation date. The public tooling is good at confirming accredited certificates for known entities and weaker at proving absence. The documented limits of CertSearch, including accredited-only coverage, known-entity lookups and issuer-dependent update timing, mean that a missing result belongs in the research queue, not the reject pile.

The decision matrix converts outcomes into screen, escalate or hold actions, and the site-coverage calculation shows how to report a result with an explicit denominator and a range that reflects unresolved sites. The 2026 changes, namely the move of former IAF and ILAC roles to Global ACI, the publication of ISO 9001:2026 and the transition period that runs to 30 September 2029, make dating each record more important than before. Analysts who log the route, the date and the edition will be able to defend or refresh any screen result when the mandate, the target or the standards change.