How to Check an ISO 9001 Certificate Is Real in South Africa

To verify an ISO 9001 certificate in South Africa, confirm that the certification body named on it is accredited by SANAS, or by another accreditation body in the Global ACI recognition arrangement (formerly the IAF MLA), for the scope on the certificate. Then look the certificate up on IAF CertSearch, or ask the certification body to confirm it in writing.

Tenders and retailer questionnaires ask for ISO 9001 all the time, and few buyers check what they are sent. As consultants and auditors, we help businesses build quality management systems and get them ready for certification. As supplier auditors we are often handed certificates that do not survive five minutes of checking. Here is how to tell the difference, for a supplier’s certificate and for the one you are about to pay for.

Who can issue an ISO 9001 certificate in South Africa?

Three different organisations are involved, and mixing them up is where most of the confusion starts. The International Organization for Standardization writes ISO 9001. It states plainly that it does not perform certification or accredit certification bodies. Certification bodies audit your quality management system and issue the certificate. Accreditation bodies assess the certification bodies to check that they are competent and impartial.

In South Africa that accreditation body is the South African National Accreditation System. The Accreditation for Conformity Assessment, Calibration and Good Laboratory Practice Act 19 of 2006 establishes SANAS and recognises it as the only accreditation body in the Republic. Under section 24(2) of the Act, misusing accreditation or the accreditation symbol is an offence, and section 27(2) sets the penalty: a fine, imprisonment of up to 24 months, or both.

Accreditation bodies around the world recognise each other’s accreditations through a multilateral recognition arrangement. Since 1 January 2026 it has been run by Global Accreditation Cooperation (Global ACI), which took over the work of the International Accreditation Forum (IAF) and ILAC. Many certificates still carry the IAF MLA mark, which is allowed during the changeover. That is why a certificate from a properly accredited foreign certification body is also accepted here. Our guide to what ISO 9001 is explains the standard itself.

Consultants such as ASC sit outside that chain on purpose. We help you build the system, train your people and audit you internally, and an accredited certification body then audits you independently.

ISO/IEC 17021-1, the standard certification bodies are accredited against, does not allow a certification body to offer management system consultancy at all, and bars it from certifying a system that a related consultancy built within the previous two years. The rule keeps the two apart so that nobody audits their own work.

How do you verify an ISO 9001 certificate? Four checks

1. Find the certification body and its accreditation. The certificate should name the certification body and normally carries the accreditation body’s mark. Confirm on the accreditation body’s own website, for South African bodies SANAS, that the certification body is accredited for ISO 9001 certification and for the sector code that covers the supplier’s activity, for example code 3, food products, beverages and tobacco. A certificate issued outside the certification body’s accredited sectors is not an accredited certificate.
2. Search the certificate on IAF CertSearch, the global database of accredited certificates. It holds only accredited certificates, so it confirms the certification and the accreditation in one place. If the certificate is not listed, do not assume it is fake. Contact the certification body directly and ask it to confirm the certificate number, status and scope in writing.
3. Read the scope and the sites. The scope says which products, services and sites are covered. A certificate for a head office in Johannesburg tells you nothing about a factory in Gqeberha, and a scope of “distribution” does not cover manufacturing.
4. Check the dates and the edition. Certificates run for three years with surveillance audits in between. ISO 9001:2026 was published on 16 September 2026. Global ACI has set a three year transition. From 31 March 2028 new certifications may only be issued to ISO 9001:2026, and accredited certificates to the 2015 edition stop being valid on 30 September 2029. Ask your certification body which audit will cover the move. Our ISO 9001:2026 transition plan sets out the steps.

Warning signs of a certificate that will not stand up

• The certificate arrived within days, with no stage 1 and stage 2 audit on site or remotely.
• Nobody from the certification body ever interviewed staff, looked at records or walked the operation.
• The certificate claims to be issued, approved or accredited “by ISO”.
• The accreditation named belongs to a body that is not SANAS and does not sign the Global ACI arrangement (formerly the IAF MLA), or the certificate has no accreditation mark at all.
• The same company wrote your documents or ran your internal audits, then issued the certificate.
• There are no surveillance audits in the years between issue and expiry.
• The scope is vague, or covers activities the business does not actually perform.

None of these proves fraud on its own, but two or three together should stop a supplier approval until the certificate has been verified. A second party supplier audit checks exactly this, on site, against what the certificate claims. For FSSC 22000 and BRCGS certificates, our supplier and co-packer audit guide covers the scheme registers.

What a credible route to ISO 9001:2026 looks like

If you are the one who needs the certificate, the route is the same for a packaging converter, a laboratory, a logistics company or a food manufacturer adding quality to an existing FSSC 22000 or BRCGS system. It takes longer than a certificate mill, and it is the version a customer’s auditor will accept.

1. Gap assessment. Compare what you already do with each clause of ISO 9001:2026, so you only build what is missing.
2. Build the system. Policy, objectives, risks and opportunities, processes and the documented information the standard and your business need. Our ISO 9001:2026 implementation consulting builds it with you, requirement by requirement.
3. Train the people who will run it. Managers need to understand the standard. ISO 9001 sets no number of internal auditors, but nobody may audit their own work, so most sites train at least two to audit each other’s areas. Our ISO 9001:2026 Internal Auditor course trains them online for R3,850 on the current special, normally R4,670.
4. Run it for long enough to have records. Certification bodies audit evidence that the system works, not documents that describe it.
5. Internal audit and management review. Find your own nonconformities and close them before the certification body does.
6. Choose an accredited certification body. Get quotes from more than one (here is what certification costs in South Africa), confirm their SANAS or Global ACI recognised accreditation for your scope, and book stage 1 and stage 2.

Questions we are often asked

Does ISO issue ISO 9001 certificates?

No. ISO develops the standard but does not certify organisations or accredit certification bodies. Certificates are issued by certification bodies, which in South Africa should be accredited by SANAS or by an accreditation body in the Global ACI recognition arrangement (formerly the IAF MLA).

How do I verify an ISO 9001 certificate online?

Search the company or certificate number on IAF CertSearch, which lists accredited certificates only. If it is not listed, ask the certification body named on the certificate to confirm its status and scope in writing.

Is a supplier’s ISO 9001:2015 certificate still valid?

Yes, while it is in date and its surveillance audits are up to date, but accredited certificates to the 2015 edition stop being valid on 30 September 2029, and from 31 March 2028 new certifications may only be issued to ISO 9001:2026. Check which audit the supplier’s certification body has booked for the move.

How long does ISO 9001 certification take?

Starting from nothing, six to twelve months to build the system and nine to fifteen months to the certificate in hand. Moving a working 2015 system to the 2026 edition usually takes four to six months. A gap assessment tells you which applies to you.