Three levels of claim, in ascending strength
- Compliant (self-declared). You state that your system meets ISO 9001 requirements. Nobody outside the organization has verified it. Legitimate under ISO rules (conformity self-declaration exists), but it is only as credible as you are.
- Certified by a non-IAF certification body. An independent third party audited you and issued a certificate, but the certification body is not overseen by an IAF-member accreditation body. This tier spans a wide range: legitimate certifiers that run genuine Stage 1 and Stage 2 audits and simply operate outside the IAF scheme, down to certificate mills that sell paper without auditing. The certificate's value rests on the body's actual audit rigor and reputation, and on whether your customers accept non-IAF certification.
- Certified by an accredited body. The certification body is accredited by an IAF-member accreditation body (ANAB in the US, UKAS in the UK, and equivalents worldwide) to audit against ISO 9001 under ISO/IEC 17021-1. This is the claim procurement teams mean when they ask for "ISO 9001 certification".
When compliance without certification is enough
If no customer or regulator requires the certificate, running a compliant system delivers the operational benefits (process discipline, measurement, corrective action) without audit fees. Many small businesses sensibly operate this way until a contract demands more. Just be precise in your marketing language: claiming to be "certified" when you are self-declared compliant is a misrepresentation that can void contracts and, in some jurisdictions, attract legal consequences.
What certification adds beyond the logo
An external audit every year (surveillance) plus recertification every three years creates pressure that keeps systems honest. In my experience auditing organizations of every size, the discipline of knowing a competent outsider will trace your records annually does more to prevent system decay than any internal policy. That ongoing verification, not the framed certificate, is what customers are actually paying a premium for when they prefer certified suppliers.