An organisation presents me with its critical supplier's certificate · impeccable paperwork, the correct standard, an issuing body with a credible name. I look for it in the applicable public register and it does not appear. That result does not justify calling it false. It requires checking whether the scheme mandates publication, whether the issuer is accredited for that scope and which official source can confirm the document. The operational question fits on one line · through which official channel can a third party check it?
Criterion 12 established where the strength of a certificate lies · in the chain of separations that produced it. This criterion adds an operational condition · that chain must be checkable through an official channel. When the scheme offers a public register, consulting it allows issuance, validity, scope and accreditation to be reviewed without relying on the document presented by the interested party. When it does not, verification requires other official sources and retains greater friction.
Validation lies in the chain
IAF published a warning about so-called certification mills and explained how to review the legitimacy of a certification. The principle is simple: the logo and PDF file do not, by themselves, prove the issuer's competence or the certificate's validity. The check must follow the applicable chain — certification body, accreditation body, scope and multilateral agreement — using official sources.
The system has already taken this direction
The search infrastructure has advanced in a verifiable way. IAF reported that uploading to the global register became mandatory in October 2024 and that, in January 2025, it held data from 2.335 certification bodies and more than 2,5 million certifications. ISO cautions that its Survey 2024 uses information from IAF CertSearch and that the change in source affects comparisons with previous years; an increase in records therefore does not automatically equate to market growth. Since 2026, Global ACI has continued the multilateral cooperation previously coordinated by IAF and ILAC.
Three certificate statuses for a third party
Verifiable in a register · the scheme has a public source and the relevant data match. Verifiable through an official enquiry · there is no sufficient register, but the issuer or accreditation body confirms the document through an independent channel. Pending verification · only the paper exists or the sources contradict one another. These statuses describe the available evidence; none replaces risk assessment or, on its own, justifies an accusation of fraud.
The obligation runs both ways
Those who display a certificate gain clarity when the register allows it to be confirmed. Those who use it to make decisions about a supplier, a contract or a risk must exercise diligence proportionate to the impact of that decision. In some cases, consulting the public register will suffice; in others, scope, sites, status and accreditation will need to be confirmed with the entities in the chain.
The register's limitations are part of the argument. It can confirm certificate data and its chain, but does not, by itself, demonstrate the quality of the audit or the organisation's day-to-day performance. Those questions concern the scope, sample and independence explored in Criteria 03, 05 and 12.
The criterion test
Take the most visible certificate in your operations · the one your organisation displays, or the one your critical supplier presented to you. Three checks.
One · the register's coverage. First check whether the scheme, standard and issuer should appear in the register being consulted. For accredited management systems certifications covered by its mandate, check IAF CertSearch. Do not turn an absence outside its coverage into proof of falsity.
Two · the document and the issuer. Compare the legal name, standard, scope, sites, validity and status. Also verify that the certification body is accredited for that activity and scope when the certificate is presented as accredited.
Three · the narrative. Compare the confirmed data with the commercial use of the certificate. A certification limited to particular sites, processes or activities must not be presented as covering the entire organisation.
Record how long it takes and through which channel you obtain independent confirmation. Friction is a factor in the assessment, not proof of fraud. If the document cannot be confirmed by any reasonable official source, treat it as what Criterion 02 defines · a claim awaiting evidence.
The relevant advance is moving from an isolated piece of paper to a chain that can be consulted. The register reduces uncertainty when it clearly states what it covers and what it does not. Responsible verification maintains that same discipline.