A supplier may submit an ISO certificate with a professional layout, a certificate number, an authorised signature and a future expiry date. Yet these details do not necessarily establish that the certification is current, covers the manufacturing facility, or meets the requirements of the product being purchased.

For manufacturers, supplier certification verification is an important part of procurement and quality assurance. An incorrect assumption during supplier onboarding can lead to rejected materials, production interruptions, audit findings or regulatory non-compliance.

The solution is to conduct a supplier compliance audit that goes beyond document verification. Buyers need to establish whether the certificate is authentic, whether its scope applies to the intended supply, whether separate statutory approvals are required, and whether the supplier’s actual operations support its compliance claims.

Why Genuine-Looking Supplier Certificates Can Be Misleading

Supplier documentation can appear convincing while leaving important questions unanswered. Four issues deserve particular attention.

1. The certificate may no longer be valid

A certificate can display an expiry date in the future without conclusively establishing its current status. Suspension, withdrawal or other status changes may affect its validity. Buyers should check authoritative records and seek confirmation from the issuing certification body when necessary.

2. The certified scope may not cover the purchased product

An ISO 9001 certificate demonstrates conformity of a quality management system within its stated scope. It does not automatically certify every product manufactured by that organisation.

For example, a supplier may hold certification for equipment assembly while the buyer intends to purchase precision-machined components. The buyer must establish whether the relevant manufacturing activity falls within the certified scope.

3. The certificate may cover a different facility

A company may operate several factories, warehouses and subcontracting locations. Certification associated with one address does not automatically establish that another facility is covered.

4. Certification may be confused with regulatory approval

Management-system certification and statutory authorisation serve different purposes. An ISO certificate does not replace an applicable BIS licence, food business licence, pharmaceutical manufacturing licence or other product-specific regulatory requirement.

The correct verification method depends on the supplier’s activities, the product category, the destination market and the purchasing specification.

A Seven-Step Process for Supplier Certification Verification

A repeatable verification process helps procurement and quality teams evaluate suppliers consistently, rather than relying on visual inspection or supplier assurances.

Step 1: Collect the complete certificate

Request the original digital certificate or a complete, legible copy, including relevant annexures. Record:

• Certificate number and applicable standard or certification scheme.

• Certified organisation’s legal name and manufacturing address.

• Certification scope and covered activities.

• Issue date, expiry date and available status information.

• Certification body’s name and relevant accreditation details.

• Separate licences or approvals required for the proposed supply.

A logo on a website, a cropped certificate image or a supplier’s declaration should not replace the evidence required by the organisation’s supplier-approval procedure.

Step 2: Verify the issuing certification body

Confirm that the issuing organisation exists and is responsible for the certificate. Where accredited certification is required or specified, verify the body’s accreditation and whether its accreditation covers the relevant certification activity.

The International Organization for Standardization (ISO) develops standards but does not itself audit suppliers or issue ISO certificates. External certification bodies perform certification.

For relevant accredited management-system certificates, buyers can search IAF CertSearch using the supplier’s name or certificate number. Review the available information about the standard, certification status, scope, locations and issuing bodies.

If a certificate cannot be found, do not automatically conclude that it is fraudulent. Database coverage or record availability may be limited. Contact the certification body directly and retain its response. Where an accreditation claim remains uncertain, consult the relevant accreditation body.

Step 3: Match the certificate to the supplier and factory

Compare the certificate with the actual contracting entity and the location producing the goods.

Verification point	Question to resolve
Legal entity	Does the certified organisation match the contracting supplier, or is the relationship documented?
Manufacturing site	Is the actual production facility covered where required?
Certification scope	Does the scope include the relevant manufacturing activity?
Purchased item	Does the certification satisfy the buyer’s stated qualification criteria?
Outsourced work	Are subcontracted processes subject to appropriate controls and verification?

Differences in company names or addresses may result from legitimate changes, group structures or administrative updates. Nevertheless, buyers should obtain evidence explaining the difference rather than assuming that the certificate applies.

Step 4: Verify statutory licences separately

Identify the exact regulatory requirement before checking the relevant authority’s records.

For products subject to applicable BIS certification requirements, use the Bureau of Indian Standards (BIS) resources, including the BIS CARE app’s licence-verification facility where applicable.

For food businesses, the FSSAI portal provides access to licensing services and relevant verification facilities. Confirm that the licence corresponds to the business and activity involved.

For pharmaceutical, medical-device, chemical and electrical products, determine which manufacturing licences, registrations, approvals or conformity requirements apply. Consult the competent regulator for the relevant jurisdiction.

The important question is not simply whether the supplier possesses a licence. It is whether the authorisation covers the specific entity, facility, product and activity involved in the transaction.

Step 5: Compare documents with operating evidence

A valid certificate is not proof that every required control is consistently implemented. Request evidence appropriate to the supplier’s risk profile, such as:

• Inspection and test reports for relevant products.

• Calibration records for measuring equipment.

• Material identification and batch traceability records.

• Non-conformance reports and corrective-action evidence.

• Employee training records and documented operating procedures.

Look for consistency across records. For example, if a test report identifies a batch number, confirm that the number matches the production and dispatch records. This cross-check can reveal gaps that reviewing individual documents might miss.

Step 6: Investigate discrepancies before approval

Create a record of each unresolved issue, the evidence needed, the person responsible and the deadline for resolution.

A missing database entry may require issuer confirmation. A site mismatch may require revised documentation or clarification of certification coverage. Conflicting inspection results may require additional testing or a focused factory audit.

Do not treat every discrepancy as evidence of fraud. Distinguish administrative errors, incomplete records, scope limitations and potentially deliberate misrepresentation.

Step 7: Document the decision and schedule reviews

Record the evidence checked, verification date, outstanding risks, approval conditions and final decision. Establish a review date based on the supplier’s risk and the applicable requirements.

Renewal dates, facility changes, ownership changes, significant quality failures and regulatory developments may trigger an earlier review.

Red Flags That Require Further Investigation

The following warning signs should prompt a defined verification action.

Red flag	Appropriate response
Certificate number cannot be verified	Contact the issuing body and request confirmation.
Certificate appears expired or suspended	Establish the current status before relying on it.
Company name differs	Verify the legal relationship or documented name change.
Factory address does not match	Confirm whether the production site is covered.
Scope does not match the purchased activity	Obtain clarification and assess the actual qualification requirement.
Claimed accreditation cannot be established	Check the relevant accreditation body’s records.
Statutory licence details conflict	Verify the authorisation with the competent regulator.
Supplier refuses reasonable verification	Escalate the concern to procurement, quality and compliance.
Factory records contradict documented procedures	Investigate the discrepancy and consider an on-site audit.

A non-accredited certificate is not automatically fraudulent. Accreditation requirements depend on the applicable scheme, regulatory obligations and buyer’s criteria. The issue is whether the certification provides the assurance required for the intended decision.

Speak With An Expert: https://www.imarcengineering.com/contact?service=vendor-audits-and-compliance-checks

When Should a Manufacturer Conduct a Supplier Audit?

Document verification and supplier auditing serve different purposes. Verification establishes whether certification claims are supported by available evidence. An audit examines whether relevant controls operate effectively in practice.

An on-site assessment becomes particularly valuable when:

• The supplier provides safety-critical or quality-critical components.

• The product is subject to specific regulatory obligations.

• Documents contain unresolved inconsistencies.

• The supplier has experienced repeated quality failures.

• Production depends on specialised processes or subcontractors.

• The commercial or operational consequences of supplier failure are substantial.

During an audit, assess relevant production controls, inspection practices, traceability, calibration, storage, training and corrective-action effectiveness. Compare documented procedures with observed practices and sampled records.

The audit should be proportionate to the risk. A low-risk packaging supplier may require a different level of scrutiny from a supplier of critical pharmaceutical equipment or precision-engineered components.

A Practical Example: When an ISO Certificate Is Not Enough

Consider a manufacturer evaluating a supplier of precision-machined industrial components. The supplier submits an ISO 9001 certificate that appears genuine and has a future expiry date.

During review, the buyer discovers that the certificate lists a different factory address. Its scope also does not clearly establish coverage of the component manufacturing activity. Meanwhile, sampled inspection records show recurring dimensional deviations.

The appropriate response is to confirm site coverage with the certification body, clarify the scope and investigate the inspection failures. Depending on the findings, the manufacturer may require additional testing, corrective action or an on-site audit before approval.

The certificate should not be labelled fraudulent without supporting evidence. Equally, its apparent authenticity should not override unresolved quality risks.

Supplier Certification Verification Checklist

Before approving a supplier, confirm that the following actions are complete:

• Obtain the complete certificate and applicable annexures.

• Record the certificate number, standard and certification scheme.

• Verify the issuing body and relevant accreditation.

• Confirm current status using an authoritative source.

• Match the certified entity and facility to the proposed supply.

• Check that the scope covers the relevant activity.

• Verify applicable statutory licences and product approvals separately.

• Review relevant inspection, calibration and traceability records.

• Investigate discrepancies and assign corrective actions.

• Decide whether additional testing or an audit is necessary.

• Record the approval decision and any conditions.

• Schedule periodic or event-triggered verification.

If mandatory regulatory or quality requirements remain unresolved, escalate the case to the authorised decision-maker rather than granting an informal exception.

How IMARC Engineering Can Help

IMARC Engineering supports manufacturers through vendor audits and compliance checks that extend beyond collecting supplier certificates. Its support can include documentation review, certification and licence verification, facility assessment, quality-system evaluation, supplier risk assessment and corrective-action follow-up. This approach helps procurement and quality teams identify gaps between documented claims and actual operating controls, establish evidence-based supplier qualification decisions and strengthen ongoing vendor oversight. The scope of each assessment should reflect the supplier’s activities, applicable requirements and operational risk.

Conclusion

Reliable supplier certification verification requires more than checking a certificate number or expiry date. Manufacturers must establish authenticity, confirm entity and facility coverage, assess the certification scope, verify applicable regulatory approvals and examine evidence of actual compliance. When discrepancies arise, structured investigation and risk-based auditing provide a stronger foundation for supplier decisions than assumptions or visual checks. A documented process also makes future reviews more consistent, helping organisations maintain supplier accountability as requirements, facilities and operating conditions change.

Contact Us:

IMARC Engineering
Phone: +91-120-433-0800
Email: sales@imarcengineering.com
India: C-130, Sector 2, Noida, Uttar Pradesh 201301
LinkedIn: https://www.linkedin.com/showcase/imarc-engineering/