A supplier sends you an ISO 9001 certificate as a PDF. It has a logo, a certificate number and a seal. Almost every buying guide stops there and tells you to check that the number exists. That check answers one question out of three, and it is not the question that protects your order. What matters is whether the certificate covers the factory that will actually build your units, and whether there is evidence the system is still being run. This article works through those three layers in order, lists six ways a genuine certificate can still leave you unprotected, and sets out what to look at on a factory visit so the audit is a verification rather than a tour.
Start with the document itself and read twelve fields. Any one of them being wrong is a reason to ask a question before it is a reason to walk away - certificates get reissued, names get translated, and sites get added. But you should see all twelve.
| Field | What you are checking |
|---|---|
| 1. Certificate number | Matches the register entry exactly, including any suffix |
| 2. Certified organisation name | Matches the legal entity on your contract or proforma invoice |
| 3. Address on the certificate | Is the manufacturing address, not a trading office |
| 4. Standard and version | ISO 9001 with an edition number; confirm that edition is current in your market |
| 5. Scope statement | Covers manufacture of the product you are buying - see layer two |
| 6. Certification body | A recognisable accredited body, and one that appears on its own register |
| 7. Accreditation mark | IAF, CNAS or a national equivalent; absence limits international recognition |
| 8. Original certification date | How long the system has been running, not just renewed |
| 9. Expiry date | Still valid at the date you place the order, not at the date of the enquiry |
| 10. Surveillance audit history | Annual audits were actually held, not just scheduled |
| 11. Authorised signatory | Present and consistent with the body's register |
| 12. Multi-site annex, if any | Which specific sites are inside the certified scope |
For the online check, go to the certification body's own register rather than to a third-party aggregator. TUV, SGS, Bureau Veritas, BSI and Intertek all publish searchable certificate registers, and the entry there is the authoritative record. If your supplier is certified in China, the CNCA national certification and accreditation public service platform is an additional route - the site is cx.cnca.cn. It is worth knowing that this platform is not always reachable from overseas networks, and that it has been unresponsive at times; if you cannot open it, the certification body's register remains the primary source. For certificates carrying an IAF multilateral recognition mark, the IAF CertSearch database is a further cross-check.
A note on version. Certificates are issued against a specific edition of the standard, and editions are revised. Confirm that the edition on your certificate is the one currently recognised where the units will be used, rather than assuming the format you saw three years ago is still current.
This is where most checks stop, and where most exposure sits. A certificate is issued for a defined scope at a defined location for a defined legal entity. Three things can be perfectly true on paper and still leave your order outside the system.
The scope covers trading, not manufacturing. A scope wording that runs along the lines of "sales of prefabricated buildings" is a different certificate from one covering "design and manufacture of prefabricated buildings". Trading companies commonly hold the first. It is genuine, and it says nothing about a factory floor. Read the scope sentence and ask which verb is in it.
The scope covers a different product. A factory certified for steel structures is not thereby certified for insulated modular housing, because the processes, inspection points and competences differ. If your supplier runs several product lines, ask for the scope statement that names the product category you are buying, and check that the units you want are inside it rather than alongside it.
The scope covers a different site. This is the most common gap in groups with more than one plant. A certificate for the head office address, or for one production base, does not automatically extend to the base that will build your order. Note that our own group operates five production bases, so when a buyer asks us for a certificate we have to answer a second question as well: which base is running your units, and is that base inside the certified scope? Any supplier with more than one plant should be able to answer the same question without hesitation.
The practical action is unglamorous: put the certificate's organisation name, address and scope sentence next to the supplier's name, address and product description on the proforma invoice, and compare them word by word. Where they differ, ask for the document that reconciles them - a multi-site annex, a name-change certificate, or an explanation of which entity contracts and which entity manufactures.
ISO 9001 certifies a quality management system. It does not certify a product, and it does not certify that a particular unit will meet a performance claim. What it should give you is evidence that defined processes exist, are followed, and are reviewed. That evidence is auditable from the outside, if you ask for the right records.
Under the accreditation rules most certification bodies work to, a certificate runs on a three-year cycle with annual surveillance audits in between. That structure exists precisely because a certificate on its own does not prove the system is alive. Ask for the surveillance audit dates and the outcome of the most recent one. A supplier who can produce a current certificate but no audit history has given you a photograph, not a process.
Then ask for five records, which any certified manufacturer should be able to pull without a week of preparation:
Incoming material inspection. What is checked when steel coil, panel, glass or fittings arrive, and what happens when a batch fails.
In-process inspection points. Where in the build quality is verified, and who signs it off. On our own line the sequence runs from raw material incoming inspection through in-process checks to finished-unit testing.
Non-conformance handling. Ask for one real example from the last few months: what went wrong, what was done with the product, and what changed afterwards. The quality of the answer tells you more than the certificate does.
Supplier evaluation. How component suppliers are approved and re-evaluated, since the quality of a modular unit is largely the quality of what goes into it.
Traceability by batch. Whether a finished unit can be tied back to the material batches that went into it. This is the record that lets a problem be contained instead of becoming a recall.
| Situation | Why the certificate does not help |
|---|---|
| Certificate covers sales only | The factory making your units is outside the certified system |
| Certificate is for a different plant in the group | Your production base is not audited under that scope |
| Expired or suspended, PDF still circulating | The system may have lapsed; only the register shows current status |
| Product performance is not in scope | ISO 9001 is a management system standard, not a product standard |
| Subcontracted processes | Welding, coating or fit-out may be outsourced to an unaudited workshop |
| System exists, records do not | Documents written for the audit are not evidence of daily practice |
A factory tour is designed to show you the impressive parts. To turn it into a verification, decide in advance on four physical things you want to see, and ask for each one where it is actually used rather than in the meeting room.
One: the inspection station, in operation. Not the form template - the clipboard or terminal where a check is being recorded on the line you are standing on, against a unit that is being built. Ask what happens to the unit if the check fails.
Two: welding and structural work. Who does it, what qualification they hold, and whether the procedure is written down. This is the part of a modular unit where a defect is expensive and invisible later.
Three: wet-area and electrical testing. Whether bathrooms are assembled and water-tested before dispatch, and whether electrical circuits are tested and recorded. These are the two areas that generate most post-handover complaints in modular accommodation.
Four: batch identification on finished units. Pick a unit waiting for dispatch and ask which material batches went into it. If the answer takes twenty minutes and a phone call, traceability is a binder rather than a system.
Then ask for a reference you can actually contact: an owner or main contractor on a project comparable in scale and climate to yours. A reference that cannot be contacted is a logo.
ISO 9001 is one document among several, and it is not the one that decides whether your units can enter your market. Keep the categories separate, because suppliers often blend them in one sentence.
Management system versus product conformity. ISO 9001, ISO 14001 and ISO 45001 describe how a company manages quality, environment and safety. CE marking and similar market-access marks relate to product conformity against applicable directives or standards. Holding the first does not confer the second, and no supplier can confirm that your specific installation satisfies local building rules. That determination belongs to your local authority or engineer.
A certificate set that matches the claim. Our own certificate set covers ISO 9001, ISO 14001, ISO 45001 and EU CE. If a supplier lists four certifications in an email, ask for four documents - and check that the entity and site on each one is the same entity and site you are contracting.
Consistency between the paperwork and the product page. Where a specification claims a fire classification, a structural grade or a test result, ask which laboratory produced it and whether the report covers the assembly or only a component. This is the same discipline as checking the scope sentence, applied one level down.
You can review the certificates we publish on our honor certificates page, and the company and manufacturing structure they apply to on our about us page.
The document check and the register lookup are an afternoon if the supplier cooperates. The scope and site matching takes a further exchange of documents. The records review needs either a factory visit or a video walk-through with someone who can open the actual files. Treat it as days rather than weeks - which is why there is little excuse for skipping it.
It is not a customs or market-access requirement in most destinations, and plenty of factories trade without it. It is a useful proxy for whether a supplier has defined processes and can be audited. A supplier without it is not automatically unsafe; a supplier with it who cannot produce records when asked is a warning sign regardless.
No. It indicates that a documented system exists and is audited. The actual outcome for your order depends on the specification you agreed, the inspection points written into the contract, and whether those points were executed. That is why the certificate should sit alongside a witness inspection plan rather than replace one.
Ask the certification body directly, through its public register, rather than through the supplier. The register shows current status including suspension or withdrawal. If the register and the PDF disagree, the register is correct.
Want the documents before you shortlist?
Tell us your destination country, the product type and quantity, and which production base you would want to visit or audit remotely. We will send the certificates with the entity name, site and scope visible, the surveillance audit history, and the inspection plan for the process that will build your units. Requesting documents does not commit you to an order, and it does not constitute confirmation of compliance in your jurisdiction.
Related reading: EPS vs rock wool insulation
Hi! Click one of our members below to chat on