Verifying certificates: five checks that take five minutes
Most supplier certificates are genuine. The ones that are not share the same tells, and all of them are visible on the document itself if you know where to look.
At a glance
Specification at a glance
| Document | Check this | Where |
|---|---|---|
| ISO 9001 certificate | Certificate number, issuing body, scope, validity dates | On the certificate, then the issuer's online register |
| ISO 9001 scope | The scope text must describe the actual production | Certificate, scope box |
| CTI report | Report number, sample name, page count, testing period | Cover page, then CTI's verification route |
| PONY report | Report number, sample name, conclusion summary | Cover page and summary page |
| Mill certificate | Coil number matching the label on the goods | Certificate and the pallet label |
| Any certificate | Grades named match the purchase order | All of the above |
Start with the scope, not the logo
An ISO 9001 certificate says a quality system was audited for a stated scope. Read the scope: if it says trading, distribution or a different product, the certificate does not cover the material you are buying. The most common mismatch is a certificate for a trading company presented for a factory.
Expiry and surveillance
Certificates run on three-year cycles with annual surveillance. A certificate past its surveillance date without a new mark is not valid, even if the printed expiry date is in the future. Check the surveillance box, then check the issuer's register, which is usually a free search.
Reading a CTI or PONY report
Look at the sample name, the test panel, the page count and the conclusion page. A report that tests lead and cadmium only is not a ROHS report; a nine-page report usually contains the full panel and the instrument data. The report number is verifiable with the testing house, and the number on the cover should match the number on every page.
The tells of a fabricated document
Blurred stamp over the number, missing page numbers, a page count of one for a test that needs five, a report number that does not follow the house format, and a sample name that does not match the grade you are buying. None of these proves fraud alone; two of them together justifies a verification call.
Verify, then file
Keep the verified copy, the date you verified it and the register page. When a retail customer audits you two years later, that note is what turns a certificate into evidence. It takes five minutes at the start and saves a week later.
Questions
Common questions
How do I verify an ISO 9001 certificate?
Take the certificate number and the issuing body from the certificate and search the issuer's public register. The scope, the validity and the surveillance status should match the document you were given.
Does a CTI report cover a production batch?
No. A report covers the sample submitted on the dates stated. Ask for the batch reference that the sample came from, and for the mill certificate for the batch you are buying.
What if the certificate is in Chinese only?
Ask for the bilingual version, which most Chinese certification bodies and testing houses issue. A translation you made yourself is not evidence.
Is a food-contact report the same as ISO 9001?
No. ISO 9001 is a management system certificate; a food-contact report is a product test. Buyers need both, for different reasons.
Can you send copies with the quotation?
Yes. Certificate scans and the report covers for the grades you are buying travel with the quotation on request.