A supplier file often begins as a folder of emailed PDFs: a food-safety certificate, a laboratory report, an organic or halal certificate. The instinct is to study each one for signs of tampering. That effort is mostly misplaced.
Short answer: certificate verification means confirming a certificate with the body that issued it, not examining the file. Visual red flags can raise a question, but they only catch careless forgeries, and a clean-looking PDF proves nothing. For each certificate, identify the issuer, check its register or contact it through details you found independently, check that the issuer is accredited for that activity, and record the dated confirmation in your supplier file.
Why the eye is the wrong instrument here
A scanned certificate is an image of a claim. Ordinary office software can produce an image identical to a genuine certificate, because the genuine certificate is usually the template. A forger who changes a name, a date or a scope line leaves nothing a buyer can reliably see.
Forgers also borrow real names. The US National Organic Program keeps a list of publicly announced fraudulent organic certificates, and notes that an operation named in one may in fact be certified USDA AMS, fraudulent organic certificates. A name that matches a real, certified business tells you nothing about the document in front of you.
The consequences are not only commercial. Codex guidance on official food certificates says that product relating to fraudulent certificates should be considered in violation of the importing country's requirements, and lists destruction as one possible measure Codex Alimentarius, CXG 38-2001, section 9.
The real danger of a visual checklist is false confidence. A buyer who has ticked ten boxes feels verified. A competent forgery passes all ten.
The few anomalies still worth noticing
A few anomalies still deserve a second look, as reasons to ask, never as verdicts:
- Dates that do not fit. An audit date after the certificate date, or a laboratory report dated after shipment.
- Scope that does not match the deal. The product, site address or activity on the certificate differs from what you are buying and where it is made.
- Identifiers you cannot find. A certificate number, accreditation number or report number that the issuer's register or the accreditation body cannot locate.
- Contact details that lead back to the seller. A printed verification address or number that is a free email account or matches the supplier's own.
- Reluctance. A supplier who objects when you say you will confirm the certificate with the issuer.
Nobody publishes a reliable hit rate for these checks, and by construction it is lopsided. They catch careless forgeries, miss competent ones, and also fire on genuine documents: certificates are reissued, sites move and scans degrade. Their only proper output is a question for the issuer.
Certificate types in a food shipment and who issues each one
Every certificate has an issuer, and only the issuer, its register or its accreditation body can confirm it.
| Certificate type | Typical issuer | Verification route | What a confirmation proves | What it still does not prove |
|---|---|---|---|---|
| Management-system certificate (for example ISO 22000, ISO 9001) | Certification body, often accredited | CertSearch, then the certification body | The certificate exists, with its stated site, scope and status | That any particular lot is safe or meets your specification |
| Food-safety scheme certificate (for example FSSC 22000, BRCGS) | Certification body licensed under a scheme owner | The scheme owner's public register or directory | Status, site and scope as recorded by the scheme owner | Product quality in your shipment |
| Laboratory report or certificate of analysis | Testing laboratory | The laboratory directly, and the accreditation body's directory for its scope | The report was issued with these results | That the sample represents the lot |
| Inspection certificate | Inspection body | The inspection body directly, and its accreditation scope | What was inspected, when, where and against what | Anything outside the stated inspection scope |
| Phytosanitary or official health certificate | Exporting country's competent authority | The importing authority, which receives or checks official certificates; electronic exchange where used | The authority certified the consignment | Commercial quality or contract compliance |
| Destination conformity certificate (for example Kenya PVoC, Nigeria SONCAP) | Agent appointed by the destination regulator | The regulator's current list of appointed agents, then the agent | The certificate was issued by an appointed agent | Anything beyond the regulator's programme |
| Organic or halal certificate | Private certifier | The certifier, and any public register or recognition list the destination uses | The operation held that certification for that scope | That the destination accepts that certifier |
The certification route
CertSearch remains the global database for accredited management-system certificates and is linked from the current Global Accreditation Cooperation Incorporated website. It offers account-based free verification for occasional use, subject to limits CertSearch; Global ACI. Since 26 October 2024, IAF Mandatory Document 28 has required participating certification bodies to upload their management-system certificate data at least once a month Standards Council of Canada, IAF MD 28 bulletin.
Two limits matter. An unaccredited certificate will not be there. And MD 28 allows justified exclusions, for example where national rules or data-privacy law prevent an upload IAF, MD 28:2023. A certificate that is missing from CertSearch is a question for the certification body, not proof of forgery.
For food-safety schemes, go to the scheme owner. GFSI publishes the list of certification programme owners it recognises, including BRCGS, FSSC 22000, IFS, SQF and GLOBALG.A.P. GFSI, recognised certification programme owners. FSSC says a certificate can be checked in its public register by identification code or QR code, and asks users to contact the foundation if a certificate does not appear FSSC, checking certificate authenticity. BRCGS says a free Directory Lite account shows a site's certification status, scope and validity period; approved certification bodies update the Directory throughout the year and typically add certification data within 24 hours of the decision BRCGS, Directory FAQs. A QR code on a scan is part of the scan, so type the register address yourself.
The official-certificate route
Official certificates, such as phytosanitary and health certificates, are issued by or under the control of the exporting country's competent authority, and Codex guidance asks authorities to investigate suspected fraudulent ones with the certifying body Codex Alimentarius, CXG 38-2001. Where both countries use it, the IPPC ePhyto Solution moves electronic phytosanitary certificates between national plant protection organisations through a central hub IPPC, ePhyto Solution. Ask your customs broker how official certificates reach the importing authority for your product; where each sits in the export file is covered in the document set behind one shipment.
Destination conformity programmes work through appointed agents. Kenya's Bureau of Standards lists the inspection companies appointed to issue certificates under its Pre-Export Verification of Conformity programme KEBS, PVoC, and the Standards Organisation of Nigeria names the firms that conduct SONCAP assessments on its behalf SON, SONCAP FAQ. Check that the issuer is on the regulator's current list, then confirm the certificate with that agent or the regulator.
Verification routes: register, issuer, accreditation body
Use three routes for any certificate you intend to rely on.
- Register lookup. Search the scheme owner's or database's register yourself. Compare the legal name, site address, scope, certificate number, issue and expiry dates and status with the PDF, field by field.
- Direct confirmation. Contact the issuer through details you found independently, such as its website reached by typing the address, or the accreditation body's directory, never those printed on the certificate. Ask the issuer to confirm the certificate number, holder, site, scope and status in writing.
- Accreditation lookup. Check that the issuer is accredited for the activity on the certificate. Global ACI now publishes the current list of recognised accreditation bodies and their scopes Global ACI, recognised ABs. The legacy ILAC search remains online during the transition and links to accreditation-body directories of laboratories and inspection bodies; ILAC advises contacting the relevant accreditation body directly to check the validity and scope of a certificate or report ILAC, accredited conformity assessment bodies; ILAC, signatory search. For management-system certificates, use CertSearch and confirm the accreditation body's current recognition and scope in Global ACI's register.
If the routes disagree or stay silent, the certificate is unconfirmed. ILAC asks anyone who has received a counterfeit certificate or fraudulent report to contact the accreditation body in the economy where it was issued ILAC, accredited conformity assessment bodies. For a suspected wider fraud, take legal advice; ICC Commercial Crime Services runs a Fraud Investigation Bureau that conducts enquiries into suspect documents ICC Commercial Crime Services.
Accreditation versus certification
A certification body certifies a company; an accreditation body assesses the certification body, laboratory or inspection body. Since 1 January 2026, Global Accreditation Cooperation Incorporated, branded Global ACI, has assumed the former roles of IAF and ILAC and administers the new global multilateral recognition arrangement Global ACI. Its recognised-AB register is now the current route for checking an accreditation body's recognition and scope. CertSearch remains linked from Global ACI for management-system certificate verification, while the IAF and ILAC websites remain available as legacy references during the transition.
A certificate from an unaccredited body can be entirely genuine and still mean little: the issuer exists, the audit happened, but no independent body has assessed the issuer's competence. Accreditation also has a scope. UKAS, the UK accreditation body, lists accredited activities on each organisation's schedule of accreditation and says that the absence of a schedule on its website indicates the accreditation is no longer in force UKAS, frequently asked questions. A laboratory accredited for moisture testing is not thereby accredited for pesticide residues.
Recording the verification, not the document
Your supplier file should show what was confirmed, not merely what was received. For each certificate, record:
| Field | Example entry |
|---|---|
| Certificate and holder | Certificate number, holder's legal name, site address |
| Issuer and accreditation | Issuer's name, accreditation body, accreditation number and scope checked |
| Route used | Register search, direct confirmation, accreditation lookup |
| How contact details were found | For example, the accreditation body's directory, not the certificate |
| Result | Confirmed, not confirmed, discrepancy, no reply |
| Date and person | Date of the check and who carried it out |
| Recheck date | Before expiry, before each new contract, and before each payment in a new relationship |
Keep the register screenshot or the issuer's written reply with the entry; a confirmation is a dated fact. Whether the company itself exists is a separate check, covered in verifying that a trading company exists, and payment details need their own control, set out in payment redirection fraud in trade. If you are about to pay a deposit on the strength of the file, see how much advance payment is reasonable.
Worked example: a flawless HACCP certificate
Hypothetical teaching example. The companies, bodies and figures below are invented. Amounts are in currency units (CU).
A buyer is preparing a first order of hulled sesame worth 48,000 CU, with a 30% deposit of 14,400 CU. The supplier sends a HACCP certificate. It is visually flawless: consistent fonts, a crisp logo, a QR code, a signature and a certificate number. It names "Certification Body X" and an accreditation mark.
The buyer ignores the visual checklist and follows the routes:
- What is certified? The Codex text that describes the HACCP system places responsibility for applying HACCP principles on each food business and does not describe a certification scheme Codex Alimentarius, CXC 1-1969. So the buyer asks which criteria Certification Body X audited against.
- Register. The certificate number returns nothing in CertSearch, and HACCP is not one of the GFSI-recognised programmes, so there is no scheme-owner register to search. Absence alone settles nothing.
- Accreditation lookup. The accreditation mark belongs to "Accreditation Body Y". It does not appear in Global ACI's recognised-AB register or the legacy ILAC signatory search, and CertSearch shows no accreditation body of that name. The national accreditation body in the supplier's country, reached through its own website, has no record of Certification Body X.
- Direct confirmation. Certification Body X, contacted through its own website, confirms that it issued the certificate after a one-day audit.
The certificate is genuine, and it is worth very little. The buyer holds the deposit, asks whether the processor holds an accredited scheme certificate or will accept an independent audit, and records "genuine, unaccredited, not relied on" in the file. The PDF was never the question.
Common mistakes
- Treating a clean-looking PDF as verified, or a scruffy one as forged.
- Using the contact details, link or QR code printed on the certificate to confirm it.
- Confirming that a certificate exists without checking that its site and scope match your goods.
- Accepting an accredited-looking mark without checking the accreditation body and its scope.
- Filing the PDF but not the confirmation, its date or who made it.
- Treating absence from a database as proof of forgery, instead of a question for the issuer.
What this process is not, and what to recheck
Confirming a certificate with its issuer is not forensic authentication, not certification and not a guarantee of food safety. It establishes that a named body issued a named certificate with a stated scope and status on the day you checked. It says nothing about any particular lot; for what third-party inspection covers, see independent inspection certificates.
Registers, scheme owners, recognised programmes and appointed agents change. Verification routes differ by country and scheme; the examples here are illustrative, not complete. Before relying on a certificate, recheck the register on the day, confirm which bodies the destination authority recognises for halal, organic, conformity or official certificates, and take legal advice where a document is part of a dispute or suspected fraud. This article is general information, not legal, certification or regulatory advice.
Frequently asked questions
How can I verify a certificate is genuine? Search the issuer's register or database yourself, contact the issuer through details you found independently, and check that the issuer is accredited for that activity. Record the result and the date.
How can you tell if a document is forged? Often you cannot, from the document alone. Inconsistent dates, scope or identifiers justify questions, but only the issuer can confirm or deny a certificate.
Is a certificate from an unaccredited body fake? Not necessarily. It may be genuine, but no accreditation body has assessed the issuer's competence, so it carries less weight.
Next step
For the rest of the supplier file, read payment redirection fraud in trade, which covers confirming bank details independently, and independent inspection certificates, which explains what a third-party quality and quantity report covers.
Resources
- Global Accreditation Cooperation Incorporated — Home and current MRA — https://global-aci.org/en/home/ (accessed 2 October 2026)
- Global ACI — Recognised accreditation bodies and scopes — https://global-aci.org/en/recognised-abs/ (accessed 2 October 2026)
- CertSearch — Accredited management-system certificate validation — https://www.iafcertsearch.org/ (accessed 2 October 2026)
- International Accreditation Forum — IAF MD 28:2023, Upload and Maintenance of Data on the IAF Database — https://iaf.nu/iaf_system/uploads/documents/IAF_MD_28_Issue1_26102023.pdf (accessed 2 October 2026)
- Standards Council of Canada — IAF MD 28 for the Upload and Maintenance of Data on IAF Database (CertSearch) — https://scc-ccn.ca/accreditation/bulletins/iaf-md-28-upload-and-maintenance-data-iaf-database-certsearch (accessed 2 October 2026)
- ILAC — Accredited Conformity Assessment Bodies (legacy transition reference) — https://ilac.org/ilac-mra-and-signatories/accredited-conformity-assessment-bodies/ (accessed 2 October 2026)
- ILAC — Signatory Search (legacy transition reference) — https://ilac.org/signatory-search/ (accessed 2 October 2026)
- GFSI — GFSI-recognised certification programme owners — https://mygfsi.com/how-to-implement/recognition/certification-programme-owners/ (accessed 2 October 2026)
- FSSC — How to check the authenticity of your FSSC 22000 certificate — https://www.fssc.com/insights/how-to-check-the-authenticity-of-your-fssc-22000-certificate/ (accessed 2 October 2026)
- BRCGS — Directory FAQs (October 2025 edition) — https://www.brcgs.com/media/nkndsxeg/brcgsdirectoryfaqs-oct25.pdf (accessed 2 October 2026)
- UKAS — Frequently Asked Questions — https://www.ukas.com/faqs/ (accessed 23 September 2026)
- FAO/WHO Codex Alimentarius — Guidelines for Design, Production, Issuance and Use of Generic Official Certificates (CXG 38-2001) — https://www.fao.org/fao-who-codexalimentarius/sh-proxy/en/?lnk=1&url=https%3A%2F%2Fworkspace.fao.org%2Fsites%2Fcodex%2FStandards%2FCXG+38-2001%2FCXG_038e.pdf (accessed 23 September 2026)
- FAO/WHO Codex Alimentarius — General Principles of Food Hygiene (CXC 1-1969) — https://www.fao.org/fao-who-codexalimentarius/sh-proxy/en/?lnk=1&url=https%3A%2F%2Fworkspace.fao.org%2Fsites%2Fcodex%2FStandards%2FCXC+1-1969%2FCXC_001e.pdf (accessed 23 September 2026)
- IPPC — ePhyto Solution — https://www.ippc.int/en/ephyto/ (accessed 2 October 2026)
- USDA Agricultural Marketing Service — Fraudulent Organic Certificates — https://www.ams.usda.gov/services/enforcement/organic/fraudulent-certificates (accessed 2 October 2026)
- Kenya Bureau of Standards — Pre-Export Verification of Conformity — https://www.kebs.org/pre-export-verification-of-conformity/ (accessed 2 October 2026)
- Standards Organisation of Nigeria — SONCAP FAQ — https://son.gov.ng/soncap-faq/ (accessed 2 October 2026)
- ICC Commercial Crime Services — Home — https://icc-ccs.org/ (accessed 23 September 2026)
