How to Check a Certificate and Its Certification Body: Checklist

Why check a certificate before relying on it?

Because a certificate is only a claim, and its value depends entirely on who signs it. It says that a site met a given standard, for a given scope, on a given date. If the body is not entitled to issue it, if the scope does not cover your product or if the certificate has been suspended, it proves nothing of what you are looking for.

Three situations call for the check:

• You are choosing your certification body. A mistake here is paid for the day a customer rejects the certificate you obtained.
• You are approving a supplier. A valid certificate that does not cover the material you buy does not meet the requirement of your own standard.
• A buyer asks for your certificate. It will check it; better to have done the check before it does.

How roles are shared between the consultant, the certification body and the accreditation body is explained in our guide consultant vs certification body: who does what. This how-to focuses on the checks.

How do you check that a certification body is entitled to certify against your standard?

With four checks, from the simplest to the most precise: the scheme owner’s list, the accreditation certificate, the scope of that accreditation, then the accreditation body itself. The table shows where to look in each case.

Global ACI (Global Accreditation Cooperation Incorporated) has taken over the role of the IAF (International Accreditation Forum); its mutual recognition arrangement (MRA) is the reference cited by recent schemes.

Ask for the accreditation certificate, not a brochure

A serious body sends it without difficulty, together with its scope. Check three entries: the accreditation standard, the standard covered and its version, and the field of activity. The GFSI benchmarking requirements, version 2024, also require a body whose range of certification services is wider than its accredited range to make the scope of its accreditation publicly available (Key Changes, version 2024).

Check the accreditation body, especially for an export certificate

In Morocco, SEMAC (Service Marocain d’Accréditation, the Moroccan Accreditation Service) accredits management system certification bodies to NM ISO/IEC 17021-1. The Ministry of Industry and Trade publishes its lists on its online documents and services page (in French); as of 5 November 2026, the most recent list of accredited management system certification bodies there was dated 1 June 2021. An old list says nothing about accreditations granted, suspended or withdrawn since: confirm with the body and with SEMAC.

For a foreign customer, international recognition counts. As of 5 November 2026, the Global ACI associate members page lists the Moroccan accreditation service among the accreditation bodies that are not yet signatories of its MRA, and the list of accreditation bodies under agreement with the Foundation FSSC does not include Morocco. For FSSC 22000, your body will therefore be accredited by a foreign accreditation body; for an ISO standard, ask your customer which accreditation it accepts. A buyer checking a supplier in another country applies the same reasoning to that country’s accreditation body.

How do you read a certificate, line by line?

By looking for the mandatory entries, then comparing them with your need. ISO/IEC 17021-1 sets the minimum content of a management system certificate (clause 8.2.2, according to the SADCAS checklist); IFS Food and FSSC 22000 add their own entries.

The food safety standards go further. An IFS Food Version 8 certificate shows, among other things, the COID identification code, the accreditation body and its registration number, the scope always translated into English, exclusions, the level achieved and the score, the date of the last unannounced audit, the expiry date and a QR code (Part 4, chapter 2.4 of the IFS Food Version 8 standard). An FSSC 22000 Version 7 certificate is in English, carries the COID and the QR code supplied through the Foundation’s Assurance Platform, and must match the public register (FSSC 22000 Version 7 scheme, Part 3, section 7.2).

How do you check a certificate in the public registers?

By starting from the scheme owner, never from a link supplied with the document. A certificate is checked at its source: the register, the database or the body itself.

• BRCGS. According to the BRCGS guide to certification, all certificated sites feature in the BRCGS Directory, which brands and retailers use to find suppliers. The same guide states that the body issues the certificate within 42 calendar days of the first day of the audit: a recently audited site may not appear there yet.
• IFS. The QR code on the IFS Food certificate carries a public link to the IFS website that verifies the certificate’s authenticity. The IFS Database shows the certification status; the full report is visible only with the permission of the certified company. After the certificate expires, the previous report and certificate remain visible for three months; if the recertification audit takes place later, the COID is set to inactive.
• FSSC 22000. The public register, updated daily, lists all current FSSC certified organisations, with filters by scheme, certificate status, country and scope.
• ISO standards. There is no single register. ISO/IEC 17021-1 (clause 8.1.2) requires the body to provide, on request, the status of a given certification, as well as the name, normative document, scope and location of a certified client: write to it.

For a supplier, this check takes a few minutes and can prevent a poorly targeted audit. Our supplier audit guide for EU and UK buyers sourcing in Morocco explains what the auditor then checks, beyond the certificate.

Which warning signs should make you reject a certificate or a body?

Anything that prevents you from tracing the chain back to a recognised accreditation body, or that mixes consultancy and certification. The most frequent:

• A certificate that cannot be found in the scheme’s register, or that the body will not confirm in writing.
• No accreditation body named, or one of which you can find no trace.
• A vague scope, which names neither the products, nor the processes, nor the site.
• A suspended certificate: under ISO/IEC 17021-1 (clause 9.6.5.3), the certification is then temporarily invalid.
• A body that also offers consultancy, internal audits or a “consultancy and certificate included” package: ISO/IEC 17021-1 forbids it (clauses 5.2.5 and 5.2.6).
• A promise of an easier or faster audit thanks to a specified consultancy (clause 5.2.9).
• A certification mark applied to the product: the assessment checklist for certification bodies verifies that their mark is not used on a product or product packaging seen by the consumer.
• An “ISO 22000 certificate” presented as GFSI-recognised: it is FSSC 22000, which incorporates ISO 22000, that appears among the recognised programmes, not ISO 22000 alone.

Which checklist should you apply, and when?

This one, before signing with a body, then at every supplier approval or re-approval.

• The body appears on the scheme owner’s list (FSSC, IFS, BRCGS), where there is one.
  
• You have received its accreditation certificate and its scope, both current.
  
• The accreditation standard matches the scheme: ISO/IEC 17021-1, ISO 22003-1 or ISO/IEC 17065.
  
• The scope covers your sector and the version of the standard concerned.
  
• The accreditation body is recognised for this scope and accepted by your customer.
  
• The certificate is currently valid and is neither suspended nor withdrawn.
  
• The site, products and processes purchased are within the scope.
  
• The certificate can be found in the public register or is confirmed in writing by the body.
  
• The body has offered you neither consultancy, nor internal audits, nor a “guaranteed certificate”.
  
• The check is dated and filed in your supplier or certification file.