Put two ISO 9001 certificates side by side. Same standard, same look, same official phrasing, same logos. One of them is recognised by buyers and tender committees across dozens of economies. The other is a printed document with no standing anywhere.
Nothing on the certificate itself reliably tells you which is which. The difference sits one layer behind it, in whether the body that issued it was accredited to issue it.
Pakistani businesses buy certification constantly, frequently on price, and a meaningful share end up holding the second kind. This is a checking procedure. Four checks, ten minutes, and you will know what you have.
The chain behind the paper
Understanding why accreditation matters requires seeing the three layers, because most buyers only see the last one.
ISO writes the standard. The International Organization for Standardization publishes ISO 9001, ISO 14001, ISO 45001 and the rest. ISO does not certify anyone. It writes the document.
Accreditation bodies oversee the certifiers. In Pakistan that is the Pakistan National Accreditation Council, established in 1998 following Pakistan’s accession to the World Trade Organization, operating under the Ministry of Science and Technology from Constitution Avenue in Islamabad. PNAC is the national apex body for accrediting conformity assessment bodies, meaning laboratories, inspection bodies and certification bodies.
Certification bodies audit and certify you. They are the ones who visit your premises, examine your system and issue the certificate.
The link that makes a certificate mean something is between the middle layer and the bottom one. A certification body seeking accreditation is assessed against ISO/IEC 17021, the standard covering bodies that audit and certify management systems, along with the mandatory documents of the International Accreditation Forum. The assessment looks at independence, integrity and technical competence.
Accreditation bodies themselves are held to a standard, ISO/IEC 17011, and are peer evaluated by their international peers. That peer evaluation is what allows certificates to travel.
Why this is not a technicality
PNAC holds signatory status in the International Accreditation Forum’s Multilateral Recognition Arrangement for quality management systems, environmental management systems and product certification. It holds equivalent status in the regional arrangement, and separately holds mutual recognition status with the International Laboratory Accreditation Cooperation for testing and calibration laboratories.
What that means commercially is straightforward. A certificate issued by a PNAC accredited certification body is recognised by the other members of those arrangements, spanning by PNAC’s own account more than thirty eight economies. A certificate issued by a body with no accreditation carries none of that. It is an opinion from a company you paid.
Buyers know this. Procurement committees know this. Overseas customers running supplier audits certainly know this, and checking is now a few clicks rather than a phone call.
Check one: is the certification body accredited at all?
Start here, because everything else depends on it.
Look for an accreditation body’s mark on the certificate alongside the certification body’s own logo, and for an accreditation number. Then verify it rather than trusting it, because a logo is an image file.
PNAC publishes a live register of active accredited certification bodies. You can look up whether the body that issued your certificate appears on it. If it does not, ask them which accreditation body they work under, because some legitimate certifiers are accredited by overseas accreditation bodies rather than by PNAC.
The International Accreditation Forum operates a global certificate database. Certificates issued under accredited schemes can be checked there, which is a useful cross reference when the certifier claims foreign accreditation.
The answer you do not want is a certifier who becomes vague at this question, or who tells you accreditation is unnecessary, or who offers an accredited certificate at a higher price and an unaccredited one at a lower price without explaining the difference. That last version is at least honest about what it is selling.
Check two: is the accreditation in scope?
This is the check almost nobody runs, and it is the one that catches otherwise sound certificates.
Accreditation is granted for defined schemes and defined scopes. A body accredited for quality management systems is not automatically accredited for environmental or occupational health and safety management systems, and accreditation may be limited to particular industry sectors.
So a body may be genuinely accredited, appear correctly on the register, and still not be accredited for the standard it issued you a certificate against.
Ask for the certification body’s accreditation certificate and read its scope. If your standard and your sector are not on it, your certificate is not accredited in any way that helps you, whatever the letterhead suggests.
This is the same principle we set out in our guidance on halal certification services for exporters, where recognition is granted body by body and category by category. It applies identically here, and for the same reason.
Check three: is it current?
Accreditation and certification both expire, and both can be suspended.
Your certificate has a validity period and depends on surveillance audits during the cycle. A certificate that has passed its surveillance date without an audit is not in good standing, whatever the printed expiry says.
Your certification body’s accreditation also has a validity period. If it lapses mid way through your certificate’s life, your position weakens through no fault of your own. Registers show status and dates, so it is worth checking once a year rather than once.
Check four: does it match you?
Certificates name a legal entity, a scope of activities, and often specific sites.
Entity name. It must match your incorporation documents exactly. Trading names and abbreviations cause rejections in tender evaluation that feel unfair and are entirely mechanical, a problem we see constantly in PPRA public procurement registration work.
Scope wording. The certificate describes what is certified. If it says one activity and you are tendering for another, the evaluator reads the certificate rather than your intention.
Sites. Multi site businesses need the relevant sites covered. A certificate covering your head office does not cover a factory the buyer wants audited.
Which standard do you actually need?
Before verifying anything, it is worth asking whether you are buying the right certificate. Businesses often certify to the standard they have heard of rather than the one their buyer wants.
| Standard | What it covers | Who asks for it |
|---|---|---|
| ISO 9001 | Quality management system | The broadest requirement. Tender scorecards, institutional buyers, most export customers |
| ISO 14001 | Environmental management system | Larger buyers, donor funded work, and increasingly supply chain requirements |
| ISO 45001 | Occupational health and safety | Contractors, industrial sites, and clients with their own safety obligations |
| ISO 22000 | Food safety management | Food and beverage buyers, retail chains, food exporters |
| ISO 13485 | Medical device quality management | Required in device regulatory files rather than merely requested |
| ISO 22716 | Cosmetics good manufacturing practice | Cosmetics buyers and export customers |
| ISO/IEC 27001 | Information security management | Technology clients, financial sector work, international contracts |
Two points worth taking from that table.
Ask your buyer before you buy. The commercially useful standard is the one your customer or your tender actually names. Certifying to something adjacent because it was cheaper achieves nothing.
Some of these are not really optional. Where a standard is written into a regulatory file rather than a purchase preference, it stops being commercial leverage and becomes a requirement. Device and cosmetics work is the clearest example.
Integrating two or three standards is common and usually sensible, because the underlying structure is shared. It is still two or three assessments.
Warning signs when buying certification
Six things worth treating as questions rather than conclusions.
Certification without a real audit. If nobody needs to visit, nothing has been assessed.
A very short timeline. Implementing a management system takes time, because there has to be a system to audit. Certification promised in days describes paperwork, not a system.
Price far below the market. Auditor time is the main cost. A price that cannot cover it implies there is not much of it.
Evasion about accreditation. Covered above, and the single most useful question you can ask.
A package deal across many standards at once. Possible and sometimes sensible, but each standard requires its own assessment.
Guaranteed certification. An audit with a predetermined outcome is not an audit.
None of these proves bad faith on its own. Together they describe a certificate that will not survive scrutiny at the moment you need it to.
Now run the checks in the other direction
The same procedure works on certificates your suppliers send you, and this is where it earns money rather than costing it.
If you rely on a supplier’s certification as part of your own quality position, and their certificate turns out to be unaccredited, the gap is yours to explain during your audit rather than theirs. Requesting a certificate is a formality. Verifying it is diligence, and it takes the same ten minutes.
This applies with particular force where supplier documentation forms part of a regulatory file. Ingredient certificates, laboratory reports and test data all rest on the standing of the body that issued them, which is why laboratory compliance and lab equipment specification matter to businesses that will never run a laboratory themselves.
What accreditation does not tell you
An honest article includes this, because accreditation is a floor rather than a guarantee.
It is not a quality mark for your product. A management system certificate says you run a system to a standard. It says nothing about whether your product meets a specification. That is what PSQCA product certification does, and the two are frequently confused by buyers and occasionally by sellers.
It is not a legal licence. ISO standards are voluntary unless a law or a contract makes them mandatory. No regulator will stop you trading because you lack ISO 9001.
It does not mean your system is good. It means an accredited third party found it conformed at the time of audit. A system maintained for the auditor and ignored otherwise will conform and deliver nothing.
It does not replace your own supplier checks. It raises the floor. It does not remove your responsibility.
The honest position on management system certification has not changed across everything we publish. It is commercial leverage with a compliance shape. It wins tender points, satisfies export customers and reassures institutional buyers. It is worth doing properly, and it is worth not doing at all rather than doing badly, because an unaccredited certificate costs money, creates a false sense of position, and fails at exactly the moment you were relying on it.
If your certificate does not survive the checks
This happens, and it is recoverable.
Do not panic and do not assume fraud. Plenty of businesses were sold an unaccredited certificate without being told the difference, and plenty of certifiers sell them openly and legally.
Find out what you actually have. Which body, what accreditation status, what scope, what dates.
Decide what you need it for. If it was for a wall and a website, the commercial loss is small. If a tender, a buyer or an export customer relies on it, you have a live problem and a deadline.
Plan a proper certification cycle. Implementation, internal audit, management review, then a certification audit by an accredited body. That sequence takes months, not days, which is the whole point.
Keep the work you did. If you built genuine procedures during the first attempt, they are not wasted. The system carries across even when the certificate does not.
Where PakCEC fits
PakCEC advises on ISO certification alongside the registration, licensing and product certification work that sits around it. We are consultants rather than a certification body, which is the correct separation, since the organisation implementing your system should not be the one auditing it.
What we will do is tell you whether you need certification at all, which standard actually serves your commercial position, and how to check that the certifier you are considering is accredited for what you are buying. Twenty years, more than 3,000 completed registrations and certifications, and a preference for telling clients what they do not need.
If you already hold a certificate and want to know what it is worth, send it over. That is a short conversation and a useful one.
See our wider business consultancy in Pakistan range, or talk to the PakCEC team.
