An ISO certificate is a statement about a management system at a point in time. It is not a product guarantee, a government approval or a permanent badge. Understanding the difference matters when a buyer asks you to prove it.
Most procurement teams have a checkbox labelled “ISO certified”. The certificate satisfies the checkbox. What the buyer actually wants to know is whether your organization controls the things that affect them: delivery, data, safety, environmental impact or food risk. A certificate is evidence that a system exists to control those things — provided the certificate was issued by a body whose accreditation covers the scope.
What the certificate does prove
A valid certificate from an accredited certification body shows that an independent auditor examined your management system against a published standard and found it conformant. That means, at minimum:
- You have defined the scope of the system, including the sites and processes it covers.
- Responsibilities are assigned, and top management has reviewed the system.
- Risks have been assessed using a documented method, and controls were chosen in response.
- You run internal audits and act on what they find.
- Nonconformities are investigated and corrected, with evidence the correction worked.
For ISO/IEC 27001, that includes a risk treatment plan and a Statement of Applicability covering the 93 Annex A controls. For ISO 22000, it includes hazard analysis and validated control measures. The detail differs; the pattern is the same.
What it does not prove
A certificate does not certify a product, a batch or an individual. It does not guarantee that every procedure was followed yesterday, or that a nonconformity will not appear at the next surveillance audit. Audits sample; they do not inspect everything.
It also does not prove that the issuing body was competent to audit your sector. That depends on accreditation, which is granted for a defined technical scope. A body accredited for quality management is not automatically accredited for medical devices or information security. The certificate should name the body and its accreditation; if it does not, ask why.
Why “government certified” is a red flag
ISO standards are published by the International Organization for Standardization, a non-governmental body. No government issues ISO certificates. Where a regulator requires certification — medical devices, for example — it is referencing a standard or a scheme, not issuing the certificate itself.
When a supplier describes a certificate as a “government ISO certificate”, treat it as a signal to check the paperwork rather than a reason to relax. The phrase usually appears where the accreditation does not.
What a buyer should actually check
- The issuing body. Is it named on the certificate, and is it a certification body rather than a consultancy?
- The accreditation. Does the body hold accreditation for this standard and this technical scope? Check the accreditation body’s public directory.
- The scope statement. Does it cover the activity you are buying, at the site that performs it?
- The dates. Is the certificate within its validity period, and has surveillance been maintained?
- The register. Does a lookup return the same client name, standard and scope as the document in front of you?
The last check is the fastest, and it is the one that catches copied or altered documents. A QR code should resolve to a verification page that matches the printed certificate. If the link goes nowhere, or the page shows an expired status, that is the answer.
What this means if you are buying certification
Ask three questions before you sign anything. Who issues the certificate? What is their accreditation for this standard? And what happens at surveillance in year one?
A provider that answers all three in writing is selling you a system. A provider that dodges the second question is selling you a document. The difference shows up the first time a serious buyer checks.
If you want to test a register before you rely on one, run a lookup and see what it returns. Our own register publishes client name, standard, scope, issue date, expiry date and status — and nothing else about the client.