I was recently at a meeting with some colleagues and the subject of forged certificates was brought up. We discussed the fact that some organizations do have the audacity of not just creating a fake certificate, but sometimes even wanting to change registrars. Seems odd? Later on, I was asked by a reader for some tips on how to find out if a registration or certificate is valid or not. The reader noticed while auditing their potential supplier that the processes in this company did not look very much in control the way an ISO certified company would.
So here I’m with some concise steps and links that can hopefully help anybody confirm if a certain organization is indeed ISO certified.
Look at the Certificate
The first thing you need to do when you are evaluating a potential supplier based on their ISO certificate is requested them to provide you with a copy of the certificate itself. If the company is indeed certified, they should not have a problem providing you with a copy of their ISO certificate. When you have it, then you can take the following steps:
- Only Registrars are allowed to give ISO certificates. An organization cannot self-grant an ISO certificate.
- Look for the name of the registrar (i.e. DNV, BSI, ABS etc.)
- Look for the name of the accreditation body (i.e. ANAB, ANSI, UKAS, etc.). If you see a stamp from an accreditation body, you can find out if this accreditation body is a member of the International Accreditation Forum
- If there is no stamp from an accreditation body on the certificate then you can be suspicious as to whether the Registrar is competent to audit. A registrar may opt to not seek accreditation, but that may or may not be an indication of their ability and competency. Here is an excerpt from the ISO website:
“In most countries, accreditation is a choice, not an obligation and the fact that a certification body is not accredited does not, by itself, mean that it is not a reputable organization. For example, a certification body operating nationally in a highly specific sector might enjoy such a good reputation that it does not feel there is any advantage for it to go to the expense of being accredited. That said, many certification bodies choose to seek accreditation, even when it is not compulsory, in order to be able to demonstrate an independent confirmation of their competence.”
- If there is a registrar name on the certificate, the quickest way to find out if the certificate is valid is to call the Registrar directly and ask them to verify that they have issued such certificate. Explain to their Registrar what you are trying to do and they should be able to put you in touch with the specific department that can help with you with such situations.
- Bear in mind that if an organization certifies Plant A, it does not mean that Plant B and C are also certified. Usually, the certificate will tell you exactly which processes and locations are certified. So if you have a certificate, say for Exxon Mobil La Porte, TX; that would not apply for the Exxon Mobil plant in Lake Charles, Louisiana.
- Ensure that the certificate has not expired. If it has, then you can ask the company the reason why the certificate is expired. A valid reason could be:
- They already had their recertification audit –to renew their certificate- however, the Registrar failed to provide the Audit report on time and therefore they were unable to answer the nonconformities on time. In this case, you should be able to get a copy of the recertification audit report. Actually, I have experienced this situation and the organization truly may not be at fault.
- They were not ready for their recertification audit and decided to postpone it. In this case, you should expect to see an audit agenda, describing the new audit date. I have seen this situation also, in this case, the organization itself is admitting they have shortcomings. See if they are actually working on improving the system.
Search the Net
If you have some time and access to the internet, you can actually go to the Registrar website directly and look for a list of their clients. Here is a few of them:
Not all registrars are created equal
Like it or not, I’m going to have to be sincere, not all registrar stand to the same auditing principles or conform to the same audit standards. Simply put, some registrars are better than others. I’m not being biased but rather speaking from my own experience and what I heard in the ISO world.
Let’s put the case of those registrars operating without being accredited or perhaps while their accreditation in under suspension. In either case, they are not authorize to give certificates until their auditing practices are up to par with accreditation body auditing practices and ISO auditing standard as well.
When an organization is audited by a registrar who does not have good practices, the only one that stands to lose is the organization, because they are made believe their management system is conforming to the standard, when in fact, such management system may have many opportunities for improvement, in some cases severe. The problem is not just “not conforming to the standard” but rather not getting the full benefit of being certified, which means improving the processes and the business.
Of course all audits are based on a sampling plan, however, if a registrar decides to audit less days than the recommended by the International Accreditation Forum or another similar entity, then you may not be able to truly obtain a representative sample from which to audit.
It still smells…
If you have done your homework, looked at the certificate and audited the company and you still think that the processes from your potential supplier do not match the level of quality an ISO certified company should demonstrate, then go with your assessment. Of course, if you figure out the certificate is not valid, then don’t bother. Forging a certificate is not professional and should be an indication of other mal practices they may be capable of. A good supplier should be able to help you improve your quality by providing you with excellent products and services. If you feel they are not qualified even if they are certified, then trust your instincts.
This article was published by Quality Digest on 10/05/2009.
