Field guide
Check the certificate against the service you are buying
A practical review of certificate identity, scope, dates and the supplier service boundary.
Start with the proposed purchase
Put the purchase description beside the certificate before checking its logo. Record the service name, supplier legal entity, delivery locations and the activities your team will rely on. A certificate for one organisation or activity is evidence about that stated scope. Record the connection to your purchase instead of assuming that a shared brand name settles it.
Read the document as a set of fields
Capture the certificate number, issuing body, named organisation, applicable standard, stated scope, issue date and expiry date. Follow references to a scope schedule or annex. A short front page often needs another document to explain which sites or activities it covers. Keep the annex with the review record so a colleague can reproduce the decision.
Check the source of the status
Use the issuer's official verification route and record the date of your check. If the issuer publishes a directory, compare its entry with the document provided by the supplier. If the record is absent or inconsistent, mark the status unverified and ask the supplier for clarification. A missing directory entry alone does not establish fraud. Do not turn an unresolved check into an approval.
Write down the gap
Fictional example: a company supplies an administrator support service and a separate hosted file platform. Its certificate scope names the support activity. The purchasing team records that the file platform is outside the demonstrated scope, requests evidence for that platform and keeps the approval decision open. This is an example of a review record, not a finding about a real supplier.
Keep a bounded conclusion
Use a conclusion such as: the certificate identity was checked on the recorded date; the named activity matches the support service; coverage of the hosted platform remains unverified. Give each unresolved item an owner and a due date. Revisit the decision when the service, entity, location or certificate status changes. A certificate check does not test every security control.
Sources and method
Primary references checked 4 November 2026. The workflow and fictional examples are original editorial guidance; they are not a quoted standard or an endorsement.