The supplier is certified—but does the certificate cover your order?

A supplier's management system certificate is useful only after the buyer has checked what it covers. The document may be genuine while the legal entity, site or activity relevant to an order sits outside its scope. For procurement teams in the Netherlands buying across borders, the practical question is not simply whether a certificate exists. It is which purchasing decision that certificate can reasonably support.

ISO explains that it does not issue certificates; external certification bodies do. It also identifies routes for confirming certification and accreditation status. This makes the issuer a verification source, rather than a decorative logo at the bottom of a PDF.

First, is the document authentic and current? Obtain the complete certificate and any referenced scope annex, then compare its identifier and status with the issuer's authoritative information. Use contact details found independently on the issuer's official website if clarification is needed. A forwarded screenshot or a supplier's own website badge is a starting point, not completion of that check.

Second, is the scope relevant? Match the named entity to the contracting supplier and identify the site and activity behind the order. Trading names, group structures and subcontracting can make this less obvious than it appears. Record any unresolved relationship instead of silently treating a parent company's certificate as covering every subsidiary and facility.

Third, what does the certificate establish? The Dutch accreditation body, RvA, distinguishes management system certification from product certification. Assessment of a management system is not a statement that each product, service or process meets specified product requirements. The purchase specification, required testing and acceptance evidence therefore remain relevant.

RvA assesses the competence, impartiality and independence of conformity assessment bodies. Its directory can be searched for bodies and their accredited activities. Checking the accreditation body alone is insufficient if the certification body or relevant activity is not the one covered by the search result.

ISO notes that accreditation provides independent confirmation of competence, while non-accreditation does not automatically make a certification body disreputable. Procurement policy should therefore state whether accredited certification is required for this purchase, and why. Do not invent a universal legal requirement from a commercial preference; equally, do not waive an actual contract requirement because the supplier presents a plausible explanation.

For cross-border purchases, preserve the evidence of the applicable scheme and the route used to verify it. If a directory has no result, treat that as an unresolved verification question and contact the responsible body. Absence from one search result is not, by itself, a defensible allegation of fraud.

Our recommended purchasing record separates certificate status from order acceptance. Capture the certificate identifier, issue and expiry information, verification date, relevant entity/site/activity, and any scope annex reviewed. Then record the outstanding product or service evidence required by the order. This is a proposed control, not a reproduction of an ISO clause.

A useful hypothetical example is a supplier certified for distribution that proposes to manufacture a custom component through another facility. The buyer should clarify the scope and manufacturing arrangements rather than assume the distribution certificate answers the production-quality question. The example does not imply that such an arrangement is prohibited; it identifies an evidence gap to resolve before the acceptance decision.

For other supplier risks, cyber assurance at contract renewal illustrates why evidence must relate to the service being purchased. A quality management certificate does not remove the need to examine a separate security requirement.

Suppose a fictional supplier offers a distribution-site certificate for an order manufactured at another site. The following is an example review record, not an actual certificate verification.

The appropriate summary is not “supplier approved because ISO certified.” It is: “Certificate status checked; relevance to the manufacturing activity unresolved; product acceptance evidence outstanding.”

Assign the scope question to the responsible buyer, retain the issuer response, and obtain the evidence required by the purchase specification. If the contract requires certification of the manufacturing activity, resolve that requirement through the authorised purchasing route. A genuine distribution certificate cannot fill that gap by inference.

Use separate status fields for the three questions. This lets the next reviewer see exactly what was checked without mislabelling a scope gap as a fraudulent certificate or a product failure.

Do not infer that from the publication date alone. Verify the certificate's current status and the issuer's applicable transition arrangements. ISO's current ISO 9001 information identifies the 2026 edition and directs certified organisations to their certification body about transition. Avoid inventing a common expiry date for every supplier.

AI assistance was used in preparing this article.

This article is general information. Verify current requirements and seek qualified advice for your specific circumstances.

Spotted an issue? Contact our editorial desk.