Fake ISO Certificate? How to Check Yours Is Genuine in Malaysia
Published 3 min read
Short answer: a certificate only carries weight when the certification body that issued it is accredited by a body that has signed the IAF agreement (IAF MLA). That can be Standards Malaysia or an overseas accreditation body: both are equally valid. You can check this yourself in a few minutes with the free databases below. If you cannot find it, ask the certification body to confirm the certificate number in writing.
Accredited vs non-accredited
ISO writes the standards. It does not issue certificates. A certification body (CB) audits your company and issues the certificate. An accreditation body, such as Standards Malaysia, checks the CB itself: its auditors, its audit time, its independence. Accreditation bodies that sign the IAF agreement recognise each other's work. So a certificate from a CB accredited in another member country, for example by ANAB (USA), DAkkS (Germany), JAS-ANZ (Australia and New Zealand), JAB (Japan), CNAS (China) or HKAS (Hong Kong), is accepted in Malaysia in the same way as one accredited by Standards Malaysia. The IAF MLA member list shows every signatory. Some tenders or customers name a specific accreditation body, so check their requirement.
| Accredited | Non-accredited | Bought | |
|---|---|---|---|
| Who checks the CB | An IAF MLA accreditation body, in Malaysia or overseas | Nobody, or a body outside IAF | Nobody |
| Real audit | Yes, stage 1 and stage 2, then yearly | Sometimes | No, or a token visit |
| Accepted by MNCs and tenders | Usually | Often rejected | No |
| What it tells your customer | Your system was audited by checked auditors | Little | Nothing, and it can be fraud |
Why some CBs are not accredited
To be accredited, a CB must show competent auditors, enough audit days for each client, and real independence: no consulting for the clients it certifies, and no "guaranteed pass". The accreditation body then reviews its office and watches its auditors work on site. A CB that sells certificates in a week, at a price that cannot cover a real audit, cannot pass that review. That is often the gap behind very cheap certificates.
Check it yourself (free)
- IAF CertSearch: accredited management system certificates worldwide. Only accredited certificates are listed.
- Standards Malaysia accredited directory: for CBs accredited in Malaysia. For a CB accredited overseas, use that accreditation body's own directory.
- FSSC 22000 public register: every valid FSSC 22000 certificate, with its scope.
- IATF customer portal: validity of IATF 16949 automotive certificates.
- The CB's own website: most large CBs have a certificate search. Otherwise email them the certificate number.
Check the company name, site address, scope and expiry date match what you were told. Unsure which accreditation counts? See which ISO certificate is most recognised in Malaysia.
A genuine certificate, a 3-day system
Accreditation proves the audit was real. It does not prove the system works on a normal day. Some companies build their records in the three days before the audit, pass, and go back to the old way the week after. The certificate is genuine. The system is not stable.
Your customer finds out first: at incoming inspection, in a complaint, or in their own supplier audit. That is why serious buyers run a second-party audit and do not rely on the certificate alone. AISO Management can audit your suppliers on your behalf against ISO 9001 and your own requirements, and reports only to you. We do not audit suppliers AISO has consulted for.
FAQ
Does ISO issue certificates? No. ISO writes the standards. Certification bodies issue certificates, and IAF MLA accreditation bodies, in Malaysia or overseas, check those certification bodies.
My certificate is not on IAF CertSearch. Is it fake? Not necessarily, since not every CB uploads every record. Check the CB on its accreditation body's directory and ask the CB to confirm the certificate number in writing.
Is a non-accredited certificate illegal? Not always, but many customers, multinationals and tender panels do not accept it.
How long does real certification take? For a small or medium company, usually three to six months from start to certificate. A certificate that arrives in a few days, with no audit on site, should be questioned.
Next step
Send a photo of the certificate to us on WhatsApp. We will tell you, at no charge, whether it checks out and what a supplier audit would cover. Planning ISO 9001:2026 for your own company? See our ISO 9001 page or contact us.
Talk to a consultant about this Contact
Tell us the standard and the deadline.
A consultant replies within one working day with a plan and a quote.