Indian supplier certifications: ISO, IATF and BIS

The certificate is only as good as its scope

Indian suppliers often list several certificates in a quotation pack. Buyers scan the logos and move on. The useful information is in the scope statement: which site, which processes and which product families are covered. A certificate issued to a machining division does not cover a plating line in another building, even when both belong to the same company.

Check the legal entity and the address as well. Groups often hold certificates through one company and trade through another. If your purchase order goes to an entity that is not on the certificate, the quality system you relied on may not be the system that makes the part.

A certificate also has a date. Certification bodies issue a three year cycle with surveillance audits, and a certificate can be suspended. An expired or suspended certificate is easy to miss in a PDF pack, so check the number on the issuer's database rather than trusting the copy.

ISO 9001: the baseline quality system

ISO 9001 is the general quality management standard. It asks a supplier to define its processes, control documents, manage competence, calibrate measuring equipment, handle non-conforming output and improve through corrective action. For a buyer, it is the minimum evidence that a system exists and is audited.

It does not tell you whether the supplier can hold your tolerance, and it does not approve a product. A job shop with ISO 9001 can still have no experience of your material or your finish. Use the certificate to open the conversation about process capability, then ask for a comparable part and a first article.

The certificate is issued by a certification body, and that body should itself be accredited. Accreditation is the check behind the check. If the logo on the certificate does not come from an accredited body, treat the document as a supplier claim rather than third-party evidence.

ISO 14001 and ISO 45001: the site behind the part

ISO 14001 covers environmental management. For a plating, coating, heat treatment or casting supplier, it is a useful signal that waste, effluent and permits are managed as a system. It does not replace the consent to operate or the waste handling records, which you should still ask to see.

ISO 45001 covers occupational health and safety. It matters when you buy from a foundry, a press shop or a finishing line, because the safety system often correlates with how seriously the plant manages risk and training. Neither standard certifies the product, and neither guarantees that the plant is compliant with every local rule.

These certificates are most useful as a reason to ask for the underlying records: the current consent, the last inspection, the effluent test result and the incident log. The certificate says a system exists. The records say it is working.

IATF 16949: the automotive layer

IATF 16949 is the automotive quality management standard. It builds on ISO 9001 and adds requirements for product approval, advanced quality planning, control plans, traceability, maintenance and supplier management. It is the certificate most automotive buyers ask for, and it is issued under rules set by the International Automotive Task Force.

The scope matters more here than anywhere else. A site certified for stamping does not automatically cover a welding line added later, and a certificate for a Tier 2 supplier does not make the Tier 3 processor compliant. Ask which processes and which product families are in scope, and ask for the latest audit report summary.

IATF 16949 also expects a production part approval process for new parts. If the supplier holds the certificate but cannot show a PPAP pack for a comparable part, the system is not being used on the work you are buying. The certificate is the entry ticket, not the evidence for your part.

BIS, the ISI mark and compulsory registration

The Bureau of Indian Standards is the national standards body. Some products must carry the ISI mark before they can be sold in India, and certain electronics and information technology goods must be registered under the Compulsory Registration Scheme. The rules are product specific, so the first question is whether your product falls inside a notified standard.

A BIS licence is tied to a manufacturing address and a standard. It is not a general quality certificate and it does not cover every product the plant makes. If a supplier shows an ISI mark, ask for the licence number, the standard and the product it covers, then check the number on the BIS listing.

For an overseas buyer, BIS matters in two ways. If you are importing into India, the product may need the mark or the registration. If you are buying an Indian made part for another market, the BIS mark says little about your destination's requirements, which may need a different approval entirely.

NABL and test reports

NABL is the National Accreditation Board for Testing and Calibration Laboratories. A laboratory accredited to ISO/IEC 17025 for a named test is stating that it can run that test competently. This matters when a supplier sends a material certificate, a salt spray result or a pull test report.

Read the test report, not only the logo. Check the laboratory name, the accreditation number, the test method, the sample identification and the date. A report that lists a method the laboratory is not accredited for is still a result, but it is not accredited evidence.

Calibration certificates deserve the same treatment. The certificate should name the instrument, the serial number, the standard used and the uncertainty. If the supplier's gauge is calibrated by an internal lab, ask how that lab is controlled and whether it takes part in a proficiency scheme.

How to verify a certificate in ten minutes

Start with the number and the issuer. Search the issuer's online directory, confirm the legal entity, the site address, the scope and the expiry date. Then check the surveillance history. A certificate that is valid but has a missed surveillance audit is a warning sign.

Ask the supplier for the latest audit report summary and the open findings. A good supplier will share the summary with customer data redacted. A refusal to share anything beyond the certificate is a signal about how the system is used.

Finally, test the system against your part. Ask for the control plan, the inspection plan and a first article for a comparable product. The certificate tells you what the supplier has committed to. The documents tell you whether the commitment reaches the machine that will run your order.

• Certificate number and issuer checked online
• Legal entity and site address confirmed
• Scope covers your process and product family
• Expiry and surveillance audit current
• Latest audit summary and open findings reviewed
• Control plan and first article for a comparable part

What a certificate does not replace

A certificate does not replace a sample. It does not replace a capability study on your critical dimension, a material certificate for your lot or a pre-shipment inspection. It also does not replace the contract terms on tooling ownership, change control and non-conformance.

The practical rule is simple. Use certificates to shortlist, use audits to confirm the system, and use parts to confirm the process. Each one answers a different question, and a programme that skips the third step is relying on paper for the result.