Accredited and unaccredited certification are not the same product

A certification body audits you. An accreditation body audits the certification body — against ISO/IEC 17021-1, the standard that governs impartiality, competence, how audits are planned and timed, how nonconformities are graded and how certification decisions are made. That assessment is not a one-off; accredited bodies are monitored on an ongoing basis, including by being observed while they audit clients.

So the thing accreditation adds is not rigour in the abstract. It is a specific, checkable answer to "who audited the auditor", and a body of rules the auditor can be held to. Without it, every judgement in your audit — how many days it took, whether the auditor was competent in information security, whether a finding was graded major or minor, whether the person who audited you also sold you consultancy — rests on the good intentions of the firm you paid.

That last one deserves naming. ISO/IEC 17021-1 bars a certification body from consulting on a management system it certifies, because you cannot independently assess your own advice. An unaccredited body is not bound by that, and the combination of "we will help you build it and then certify it" is precisely what accreditation exists to prevent.

Look at the certificate itself first. An accredited certificate normally carries two marks: the certification body’s own, and the accreditation symbol of the accreditation body that accredits them — sometimes with the IAF MLA mark alongside. A certificate carrying only the issuer’s branding is telling you something.

Then check the registers. Accreditation bodies publish the certification bodies they accredit and the scopes they are accredited for, and IAF CertSearch is a global database of accredited certifications searchable by company name or certificate number. If a certificate cannot be found in those places, the likeliest explanation is that it is unaccredited.

Then check the scope of the accreditation, not just its existence. A body can be accredited for one standard and not another, so "we are accredited" is not the same as "we are accredited to certify ISO/IEC 27001". Ask which accreditation body, and for which standard.

And ask the question directly. A body with accreditation answers immediately and precisely, because it is their main commercial asset. Evasion, or an answer naming an organisation you cannot find in any register, is the answer.

This phrase appears in a lot of marketing and it is wrong in a way that is worth understanding, because it signals how carefully the person using it has read the arrangement they are invoking.

The International Accreditation Forum does not certify organisations and does not accredit certification bodies. It is an arrangement between accreditation bodies — the MLA — in which each signatory agrees to recognise accredited certifications issued under the others. The chain runs: IAF MLA, then a national accreditation body that is a signatory, then a certification body it accredits, then you.

So the accurate claim is that you hold a certificate from a body accredited by a named accreditation body which is an IAF MLA signatory. "IAF certified" and "IAF approved" describe nothing that exists.

Rarely, but it is worth being fair about. If certification is genuinely internal — you want a structured external opinion on a management system and no customer will ever be shown the certificate — then an unaccredited body may be a reasonable, cheaper way to buy that opinion, provided you know that is what you are buying.

The failure is buying it as a commercial credential. Enterprise procurement teams increasingly check, government and regulated buyers frequently require accredited certification explicitly, and the moment somebody asks which accreditation body stands behind your certificate, an unaccredited one stops working. Discovering this during a customer security review, with a renewal attached, is an expensive way to have saved money eighteen months earlier.

There is also a switching cost. Moving to an accredited body is not a transfer — an accredited body cannot simply adopt someone else’s certificate — so you begin the certification sequence again, having already paid once.