ISO Certification in India: How to Avoid Fake Certificates

Do you really need ISO certification in India?

ISO certification is not a government licence. It is a voluntary certificate that shows your business follows an international management standard. Nobody can say "you must have ISO" in general. It becomes necessary only when a buyer, a tender or your own process needs it.

So start with the reason. Once you know why you need it, you can choose the right standard instead of buying whatever an agent offers.

• ISO 9001 is for quality management, useful for manufacturers and service providers.
• ISO 27001 is for information security, often asked by IT and data-handling businesses.
• Other standards cover areas like environment, workplace health and safety, or food safety. Which one fits depends on your business and what the buyer or tender asks for.
• Read the tender or buyer requirement carefully. It may name the standard, and sometimes the type of certifying body.

Can ISO certification be done in 2 days?

A real certification is not just a document. A certifying body checks whether your business actually runs a management system as per the standard. That normally needs your processes and records to be in place first, and then an audit by the certifying body.

The time depends on your size, your current systems and the standard chosen. A promise of a certificate in 2 days, without anyone looking at your work, is a warning sign. Such certificates are often just a printed page and may not be accepted when it matters.

• Be careful if the seller does not ask a single question about your products, process or records.
• Be careful if the price is far below what others quote and the seller pushes you to pay today.
• Be careful if the seller says the certificate is "government approved" but cannot say by whom.

How to check if the certifying body is accredited

ISO itself does not issue certificates to businesses. Certificates are issued by independent certifying bodies. The important question is whether that body is accredited, which means a recognised authority has checked that the body is competent to certify.

In India, the accreditation body for certification bodies is NABCB, which works under the Quality Council of India. Ask the seller directly: "Is your certifying body accredited by NABCB for this standard?" Then ask for proof and confirm it yourself with the accreditation body.

Also note that some agents are only middlemen. They take your fee and pass the work to someone else. Ask clearly who will audit you and who will issue the certificate. Some tenders or buyers may specifically ask for an accredited certificate, so check their terms before you choose.

How to verify an ISO certificate is genuine

A genuine certificate can be checked with the issuing certifying body. Ask how you or your buyer can do this before you pay. A good body will tell you without hesitation.

Then read the certificate itself. Many weak certificates look impressive but say very little.

• Check the name and address of your business. They must match your registration documents.
• Read the scope. It should describe your actual products or services, not a vague line that could fit any business.
• Check the standard, the issue date and the validity period.
• Look for the name of the certifying body and a certificate number that can be verified.
• Check whether the body's accreditation mark appears and whether it is real. A logo alone is not proof.

What a real ISO audit and its cost look like

Expect a real audit. The auditor should ask for your documents and records, speak to your people and look at how work is done. If nobody asks for your records or visits your process, doubt the certificate.

A typical genuine process includes preparing your system, an audit by the certifying body, fixing any gaps found, and then issue of the certificate. After that, the certificate usually runs on a cycle of several years, with yearly surveillance audits in between and a renewal audit at the end. If you skip these, the certificate may be suspended or may lapse.

So ask for the full cost in writing before you start. A low first-year fee can hide the later costs.

• Initial audit and certificate fee
• Yearly surveillance audit fee
• Renewal or recertification fee
• Any consultancy or documentation charges
• Travel or extra audit charges, if any

What happens if you buy a fake or weak ISO certificate?

The biggest risk is that the certificate fails exactly when you need it. A buyer may reject it during vendor approval. A tender authority may reject your bid or raise questions later. Depending on the tender terms, a false document can create more serious trouble than having no certificate at all.

If you have already paid for a certificate and have doubts, do not use it in any tender or bid until it is checked. The right steps depend on your facts, the contract terms and what you have already submitted.

At CGA, our team of CAs and Advocates can help you choose the right standard, understand the tender or buyer requirement, review a certificate you have received, and guide you through the process properly. Contact CGA through our website to discuss your case.

Frequently asked questions