Why People Ask This Question
It sounds like a simple question, but it comes up more often than you might think. Business owners who are new to ISO certification often have no idea what they are actually going to receive at the end of the process. Is it a framed document? A digital file? A wallet card? And once you have it, how do you know it is legitimate?
On this page
The confusion is understandable. ISO certification is not like a university degree where you know exactly what the parchment looks like before you graduate. Different certification bodies produce certificates that look different from one another, and there is no single universal template that every certifier must follow. What does stay consistent, however, is the information that must appear on every legitimate certificate. That is what this article covers in detail.
If you are going through the certification process for the first time, or you have received a certificate and want to make sure it checks out, this guide will walk you through exactly what to look for, what each element means, and how to tell the difference between a valid certificate and one that should raise alarm bells.
The Physical Format of an ISO Certificate
Most ISO certificates are issued as A4 documents, either printed on heavy stock paper or delivered as a PDF. Some certification bodies will send both a printed version and a digital copy. The printed version is often suitable for framing and display in your office or reception area. The digital version is what you will use for tenders, client requests, and your website.
There is no requirement that a certificate be printed on any particular colour or use any specific font. Certification bodies have their own branding, so you will see significant variation in visual design from one body to the next. Some look quite formal and traditional. Others are more modern in layout. Neither style is more valid than the other.
What matters far more than the visual design is the content. A certificate can look impressive and still be worthless if it is missing key information or was issued by an unaccredited body. More on that shortly.
What Information Must Appear on a Legitimate ISO Certificate
A properly issued ISO certificate will always contain a specific set of information. If any of these elements are missing or vague, that is a problem worth investigating before you rely on the certificate for any commercial or compliance purpose.
1. The Name of the Certified Organisation
The legal name of your business must appear on the certificate. This should match your registered business name exactly. If your trading name differs from your legal entity name, some certification bodies will include both. This matters because when a client or procurement team checks your certificate against your company registration, the names need to align. A mismatch can cause unnecessary headaches during tender processes.
2. The Registered Address
The address of the certified site or sites must be listed. If your certification covers multiple locations, each location should be listed, either on the face of the certificate or on an attached schedule. If only your head office is listed but your operations happen at a different address, that is worth clarifying with your certification body before you submit the certificate to a client.
3. The Standard and Version
The certificate must clearly state which ISO standard you have been certified to, and which version of that standard applies. For example, it should say ISO 9001:2015, not just ISO 9001. The version matters because standards get updated over time, and being certified to an outdated version without transitioning can affect your certificate's acceptance. You can read more about how standard updates affect your certification in our article on how ISO standards are updated and what happens to your certificate.
4. The Scope of Certification
This is one of the most important fields on the certificate, and also one of the most commonly misunderstood. The scope describes exactly what activities, products, or services your certification covers. It is not a blanket endorsement of your entire organisation. It is a defined statement of what was assessed and found to conform to the standard.
A typical scope statement might read something like: “Design, development, and manufacture of industrial control panels for the mining sector.” If your business also does installation and maintenance, but those activities were not included in your audit, they will not appear in the scope. Claiming certification for activities outside your scope is a serious misrepresentation.
For a deeper look at how scope works in practice, our article on whether you can limit the scope of your ISO 9001 certification is worth reading.
5. The Certificate Number
Every certificate issued by an accredited certification body carries a unique certificate number. This number is used to verify the certificate in the certification body's public register. If someone wants to check whether your certificate is genuine, they will typically search using this number. If a certificate does not have a unique reference number, that alone should raise a red flag.
6. The Issue Date and Expiry Date
ISO certificates are not issued for life. They are valid for a defined certification cycle, which is typically three years. The certificate will show the date it was first issued and the date it expires. Within that three-year cycle, you will undergo annual surveillance audits to confirm your management system continues to meet the standard. At the end of the cycle, you go through a recertification audit.
If you receive a certificate from a supplier and the expiry date has passed, that certificate is no longer valid. Always check the dates before relying on a certificate for procurement or compliance purposes.
7. The Name and Logo of the Certification Body
The certification body that conducted your audit and issued the certificate must be clearly identified. Their name, logo, and usually their contact details or website will appear on the document. This is the organisation you have a contract with, and it is the organisation responsible for the validity of the certification.
8. The Accreditation Body Logo and Mark
This is the element that separates a meaningful certificate from one that carries very little weight. A legitimate certification body is accredited by a recognised national or international accreditation body. In Australia, that is JAS-ANZ, the Joint Accreditation System of Australia and New Zealand. In the UK it is UKAS. In many other countries it is a body that is a member of the International Accreditation Forum.
The accreditation body's logo will appear on the certificate alongside the certification body's logo. Sometimes it appears as a combined mark. This logo tells you that the certification body has been independently assessed and found competent to issue certifications against that standard. Without accreditation, the certificate is essentially self-declared and carries no independent assurance.
Our article on the difference between certification and accreditation explains this relationship clearly if you want to understand how the two layers work together.
9. The Authorised Signature
A valid certificate will include the signature of an authorised representative of the certification body. This is usually the certification manager or a director. Some bodies use electronic signatures on digital certificates. The signature confirms that the certificate was formally approved and issued through the proper internal process.
10. The Certification Body's Accreditation Number
Separate from the certificate number, this is the number assigned to the certification body itself by the accreditation body. It allows anyone to cross-reference the certification body against the accreditation body's public register and confirm that the certifier is currently accredited. This is a detail many people overlook, but it matters when you are verifying a certificate from a supplier you have never dealt with before.
What an ISO Certificate Does Not Contain
Just as important as knowing what should be on a certificate is understanding what you will not find on one. An ISO certificate does not:
- Guarantee the quality of any specific product or service
- Confirm that every process in your business was audited
- State that you had zero nonconformances during your audit
- Include your audit findings, corrective actions, or audit report
- Serve as a product certification or safety mark
The certificate confirms that your management system was assessed and found to conform to the requirements of the standard at the time of the audit. It does not say anything about the outcomes your system produces. This is a distinction that sometimes surprises business owners, and it is worth being clear about when you present your certificate to clients.
Digital Certificates and QR Codes
Many certification bodies now issue digital certificates that include a QR code or a hyperlink. Scanning the QR code or clicking the link takes you directly to the certification body's online register, where the certificate details can be confirmed in real time. This makes verification much faster and more reliable than the older method of emailing the certification body and waiting for a response.
If your certification body does not yet offer this functionality, you can still verify certificates manually through their public register. Our dedicated article on how to verify your ISO certificate online walks through the verification process step by step.
Some organisations also display a digital badge on their website that links back to their certificate record. This is increasingly common in sectors like IT and professional services, where clients may check credentials before engaging a supplier.
What a Fake or Invalid Certificate Looks Like
Unfortunately, fake ISO certificates exist, and some of them look very convincing at first glance. The most common problems are certificates issued by unaccredited certification bodies, certificates with altered dates or scope statements, and certificates from bodies that no longer exist or were never legitimate.
Red flags to watch for include:
- No accreditation body logo on the certificate
- An accreditation logo that does not match any recognised accreditation body
- A certificate number that cannot be found in the certification body's public register
- A scope statement so broad it covers the entire company with no specifics
- An expiry date that has passed
- A certification body you cannot find any independent information about online
- The absence of a physical address or contact details for the certification body
If you are checking a supplier's certificate and something does not feel right, trust that instinct and verify it properly. Our article on how to spot fake ISO certificates goes into detail on this topic and explains the commercial consequences of relying on an invalid certificate.
What to Do When You Receive Your Certificate
When your certification body issues your certificate, do not just file it away. Take a few minutes to check every field carefully. Confirm that your organisation name is spelled correctly and matches your legal registration. Check that the address matches the site that was audited. Read the scope statement carefully and make sure it accurately reflects what your business does. Verify the dates are correct.
If anything is wrong, contact your certification body immediately. Errors on certificates do happen, and most certification bodies will correct them promptly. What you do not want is to submit a certificate to a major client or government tender and then discover mid-process that the scope wording does not cover the activities you are being assessed on.
Our article on what you should check when you receive your ISO certificate provides a practical checklist you can work through as soon as the document arrives.
How to Use Your ISO Certificate Correctly
Once you have a valid certificate in hand, there are rules around how it can be used. You can display it in your premises, include it in tender submissions, reference it on your website, and mention it in marketing materials. What you cannot do is alter the certificate in any way, use it to imply certification for activities outside your scope, or continue using it after it has expired.
Most certification bodies will provide you with a certification mark or logo that you are licensed to use in your marketing. The rules around using this mark vary between certification bodies, but generally you must include the accreditation body's logo alongside it and must not use it in a way that implies product certification. If you are unsure about the rules that apply to your certificate, your certification body will have a usage policy document they can share with you.
Why the Certification Body You Choose Matters
Because there is no single universal template for ISO certificates, the credibility of your certificate depends heavily on who issued it. A certificate from a well-known, JAS-ANZ accredited certification body carries significantly more weight in the market than one from an obscure body nobody has heard of. Procurement teams at large organisations and government agencies are increasingly sophisticated about checking not just whether a certificate exists, but whether the certification body behind it is credible.
Choosing the right certification body is one of the most important decisions in the certification process. If you are at the stage of comparing providers, our article on the top 10 steps to select the best ISO certification body gives you a structured approach with a free checklist.
If you want to compare multiple accredited certification bodies without spending hours researching each one individually, CertBetter can help. Submit one form and receive up to three competing quotes from vetted, accredited certification bodies. The service is completely free for businesses seeking certification, and it takes the guesswork out of finding a provider whose certificate will actually be accepted by the clients and markets you are targeting.
