An ISO certificate hanging on an office wall, with a logo, a signature and a stamp — it is very hard to tell at a glance whether it is fake. But the usual problem is not a completely fake certificate; it is a certificate that is genuine but not what the customer needs: wrong legal entity, wrong site, wrong scope, or a surveillance period that has lapsed while the certificate is still being presented.
Short answer: do not rely only on an image of the certificate. Check 8 points: legal entity name, facility address, certification scope, standard and version, issue date and expiry date, certification body name, accreditation information, and an independent verification channel. This article goes through each point and says where to look it up.
Why a “genuine certificate” is not necessarily a “suitable certificate”
There are two different kinds of risk when using an ISO certificate to review a supplier’s file, a bidding dossier, or before signing a certification contract:
- The risk of a non-genuine certificate: the certificate is entirely forged, or issued by an organization that does not really exist or is not registered to operate anywhere.
- The risk of a genuine but unsuitable certificate: the certificate was issued by a real certification body after a real assessment, but the scope, site or standard version does not match the work or requirement that needs proof.
The second risk is far more common and easier to overlook, because the reader only looks at the name of the standard (“having ISO 9001 is enough”) without reading the other items on the certificate carefully.
The 8 points to check
| # | Point to check | Where to read it on the certificate | Why it matters |
|---|---|---|---|
| 1 | Legal entity name | The name of the certified organization | Must match the registered name and address of the party you are dealing with; a parent company and a subsidiary are two different legal entities |
| 2 | Facility address | The audited site(s) | A branch or plant that has not been assessed is not within the scope, even under the same legal entity |
| 3 | Certification scope | The description of products/services/processes | Two organizations may both hold “ISO 9001” but with scopes of “trading” and “manufacturing” — entirely different |
| 4 | Standard and version | The standard number on the certificate (for example ISO 9001:2015 or ISO 9001:2026) | A bidding dossier or customer may specify which version; two versions from different years have different requirements |
| 5 | Issue date and expiry date | The certificate validity section | A certificate that is expired, suspended or not recertified no longer counts as a basis |
| 6 | Certification body | The name and logo of the issuing body | The body must be registered to operate in certification in Vietnam under Decree No. 107/2016/NĐ-CP (amended by Decree No. 154/2018/NĐ-CP) |
| 7 | Accreditation information | The mark or symbol of the accreditation body, if any | Shows whether an independent third party (for example BoA, or a foreign accreditation body within the IAF MLA) confirms the competence of the certification body |
| 8 | Verification code or channel | The certificate code, lookup link printed on the certificate or on the certification body’s website | Allows independent lookup, not relying only on the paper copy shown to you |
A completely genuine certificate can still “fail” at point 2, 3 or 4 — this is why professional bid inviters always read all 8 items, not stopping at the name of the standard.
Independent verification channels
When you need more certainty than reading the certificate, there are two lookup routes:
- IAF CertSearch — a global database backed by the International Accreditation Forum (IAF). The tool lets you search by organization name to see whether the certificate is currently valid, whether the issuing certification body is accredited, and whether that accreditation body is a signatory to the multilateral recognition arrangement (IAF MLA). A number of free verifications are available.
- The accreditation body in the relevant market — in Vietnam, for example, the Bureau of Accreditation (BoA), the only national accreditation body and a full member of ILAC, IAF and APAC. You can contact or look up BoA to confirm whether a specific certification body is currently accredited by BoA for the field and standard you need.
These two channels supplement reading the certificate; they do not replace the 8-point check above — because the database verifies the status of the certificate and the certification body, while whether the scope suits the specific work still needs a person to read and cross-check directly.
“Unaccredited” certificates: not fake, but a different level of reliability
One point that often causes confusion: not every ISO certificate needs an accreditation mark to be genuine. A certification body can issue certificates without being supervised by any accreditation body — called an unaccredited certificate. The assessment may still really take place, but no independent third party confirms the competence of the certification body itself.
For domestic customers, the requirement may be more flexible. For export customers, foreign groups and supply chains with internal standards, usually only certificates accredited by an accreditation body that is an IAF MLA member are accepted — so this is a question to ask clearly before a business signs a certification contract: “will the certificate to be issued be accredited, and by which accreditation body?”
Suggested cross-checking process when receiving an ISO certificate from a partner or supplier
- Ask for the full certificate (not just a photo of the logo or cover page).
- Read all 8 points in the table above and compare them with the specific requirements of the work, contract or bidding dossier.
- If you need more certainty, look it up on IAF CertSearch or contact the relevant accreditation body.
- If the scope or site does not match, ask the partner directly about a plan for an extension audit, instead of assuming “it probably still counts”.
- Record the date of checking and the result — for the certificates of important suppliers, put them on a periodic re-check schedule (for example every year), because a certificate can be suspended mid-cycle.
Common misunderstandings
- Feeling reassured because the standard name is right. Two certificates that both say “ISO 9001” can be completely different in scope and site.
- Trusting an “ISO certified” logo or advertising banner on a website or packaging. This is not a certificate and cannot replace the original certificate with all 8 items.
- Assuming that no accreditation mark means the certificate is fake. This is an unaccredited certificate — a different level of reliability, not a forgery; but it needs to be clearly understood to decide whether it is acceptable.
- Looking it up once and stopping. A certificate may be suspended or withdrawn mid-cycle if the organization fails a surveillance audit; for important partners, re-check periodically, not only at the time of signing the contract.
How Thái Tín supports you
Thái Tín receives the ISO certificate of a partner or supplier, or the business’s own intended certificate, and works through all 8 points against the specific requirements of a bidding dossier, contract or customer; it also helps look up through a suitable verification channel when needed. Confirming whether a certificate is accredited is done by the accreditation body (for example BoA); issuing, surveilling, suspending or withdrawing the certificate is decided by the certification body (CB). Thái Tín acts as the coordinating point. See also ISO 9001 Certification: What a Company Needs to Prepare and ISO, standards and certification services.
If your business needs to check a specific ISO certificate of a partner or supplier, send the certificate and the specific requirements of the dossier it is needed for, to get help with cross-checking.
Questions and answers
Is looking at an image or a photocopy of an ISO certificate enough to trust it?
It should not be. An image, logo or photocopy cannot show all 8 points that need checking: the legal entity name, facility address, certification scope, standard and version, issue and expiry dates, certification body name, accreditation information and a verification code or link. Ask for the full certificate (original PDF or direct inspection) and cross-check through an independent verification channel if you need certainty.
What is IAF CertSearch and how is it used?
IAF CertSearch is a global database backed by the International Accreditation Forum (IAF) that lets you look up and verify management system certificates by organization name, see whether the certificate is still valid, whether the issuing certification body is accredited, and whether that accreditation body is a signatory to the IAF Multilateral Recognition Arrangement (IAF MLA). The tool offers a number of free verifications.
Is an unaccredited ISO certificate (without an accreditation body mark) fake?
Not necessarily fake, but it carries a different level of reliability. A certification body may issue certificates without being supervised by any accreditation body (called an unaccredited certificate). Such a certificate may still reflect a genuine assessment, but no independent third party confirms the competence of the certification body. Export customers and foreign groups usually require a certificate accredited by an accreditation body that is an IAF MLA member, for example BoA in Vietnam.
Must a certification body issuing certificates register to operate in Vietnam?
Yes. Under Decree No. 107/2016/NĐ-CP on conditions for conformity assessment service business (amended by Decree No. 154/2018/NĐ-CP), a certification body operating in Vietnam must register its field of activity with the managing authority. This is a condition for lawful operation, distinct from whether the certificate is accredited — the two should be checked separately.
If a certificate is genuine but the scope or site is wrong, can it be used?
It should not be used for work outside the assessed scope. A completely genuine certificate (correct legal entity, correct certification body, still valid) may still be unsuitable if the scope written on it is a different activity, or the audited site is not where the work needing proof is carried out. That is why all 8 points must be checked, rather than stopping at confirming the certificate is genuine.
Legal basis · verification date
Verified 30 September 2026 · next review 30 December 2026. The content is general guidance and does not replace advice for a specific case.
- ISO/IEC 17021-1:2015 Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 1: principles on independence, impartiality and competence of certification bodies; confirmed in 2020, still the current version as of the review date of 30 September 2026 (iso.org/standard/61651.html, accessed 30 September 2026).
- IAF CertSearch — a global database backed by the International Accreditation Forum (IAF), enabling verification of management system certificates by legal entity, certification body and accreditation body (iafcertsearch.org, accessed 30 September 2026).
- Bureau of Accreditation (BoA) — Vietnam's only national accreditation body, under the Commission for Standards, Metrology and Quality of Viet Nam (STAMEQ, Ministry of Science and Technology), a full member of ILAC, IAF and APAC, signatory to the ILAC-MRA, IAF-MLA and APAC-MRA mutual recognition arrangements (boa.gov.vn/vi, accessed 30 September 2026).
- Decree No. 107/2016/NĐ-CP on conditions for conformity assessment service business, amended by Decree No. 154/2018/NĐ-CP: registration conditions for certification bodies (CBs) in Vietnam.
- Law on Standards and Technical Regulations No. 68/2006/QH11, amended and supplemented by Law No. 70/2025/QH15 (effective 1 January 2026): ISO standards are documents applied voluntarily, and certification is not a state licensing activity.
