Who Can Issue a Training Certificate?

An independent trainer has taught workplace first aid for nine years and issued close to two thousand certificates. A new client, a regional grocery chain, sends over a vendor questionnaire. One line stops her: "Which body authorizes you to issue training certificates?" She has never been asked. The honest answer is either "nobody" or "nobody has to," and she isn't sure which one the client wants to hear.

Both are true. For most training there is no authority to ask, and the certificate is simply the issuer's own statement that someone completed a course. For some training the law names who may issue, and a certificate from anyone else does not count. "Who can issue a training certificate" is really three questions: whether you may issue one at all, what it may claim, and whether the person it is shown to will accept it.

For Most Training, Anyone Can

A training certificate is a statement by whoever ran the training that a named person attended it, took part in it or completed it. No license is needed to make that statement. A software consultancy can certify that a client's finance team completed its two-day Excel course. A gym can certify that an instructor completed its kettlebell workshop. An employer can certify that a new hire completed its own orientation. The certificate is worth exactly what the issuer's word is worth, and nothing in the law stops the issuer from giving it.

The workplace safety rules that come up most often say the same thing in a more exact way. They care who is accountable for the training, not who printed the paper, and they usually make the employer accountable.

OSHA's forklift standard is the clearest case. Under 29 CFR 1910.178(l)(6), "the employer shall certify that each operator has been trained and evaluated." Nobody licenses the trainer; the rule asks only for people "who have the knowledge, training, and experience to train operators and evaluate their competence." A training provider's certificate is useful evidence, but the certification the rule describes is the employer's.

Fall protection in construction works the same way. 29 CFR 1926.503(b) has the employer prepare "a written certification record," signed by "the person who conducted the training" or by the employer.

Hazardous waste operations go one step further and still name no outside body. Under 29 CFR 1910.120(e), trainers must have "satisfactorily completed a training program for teaching the subjects they are expected to teach," or have "the academic credentials and instructional experience necessary," and the instructor certifies each person who completes the course: "A written certificate shall be given to each person so certified." Who checks the instructor's qualifications? The employer, when it chooses the course.

First aid is the loosest of all. 29 CFR 1910.151(b) asks only that "a person or persons shall be adequately trained to render first aid." It names no provider, no curriculum and no card, which is why employers fall back on names they recognize.

So for the trainer in the opening, the first answer is that nobody authorizes her, because the rule her clients work under never asked anyone to. What her certificate has to do is help the employer meet its own duty: show who trained whom, in what, on which date, and who is accountable for it.

Where the Rules Name the Issuer

Some training is different. A regulator has decided that the certificate itself is the proof, and so it has also decided who may issue one. These rules are specific, and a certificate from anyone else does not satisfy them, however good the course was.

The lead-paint rule is the strictest. Under 40 CFR 745.90, to become a certified renovator "an individual must successfully complete the appropriate course accredited by EPA," or by an authorized state or tribal program, and "the course completion certificate serves as proof of certification." The accreditation rules in 745.225 then dictate the certificate's contents down to a unique identification number and, for online courses, that it "must not be susceptible to easy editing." An unaccredited provider can teach the same material, and its certificate proves nothing to the EPA.

OSHA's 10- and 30-hour cards show that the right to issue can be narrow even when the training itself is voluntary. OSHA's own FAQ says that "OSHA-authorized trainers issue student course completion cards," that trainers "are authorized (not certified) through this program," and that "the Outreach Training Program is voluntary and OSHA does not require Outreach training." It also says something every certificate issuer should read twice: "an OSHA card is not considered a certification or license." Where a state, a city or a general contractor requires the card, OSHA leaves the decision about what counts to them: "Any determination on what will be accepted in order to meet mandatory training requirements must be made by the organization mandating the training."

Continuing professional education is regulated by the licensing boards, and they tend to delegate. For CPAs, NASBA says state boards "often rely on the National Registry when evaluating whether to accept CPE courses for CPA license renewal." A provider that is not on the registry may still run an excellent course; the CPA then has to argue the credit with their board. Our piece on certificates for event participants covers what a CPE certificate has to show.

Food safety is regulated state by state, and some states name the issuer in statute. California's Health and Safety Code 113948 says a food handler "shall obtain a food handler card only from an American National Standards Institute (ANSI) accredited training provider that meets ASTM International E2659-09 Standard Practice for Certificate Programs."

Ontario's working at heights training must be "approved by the Ministry of Labour, Immigration, Training and Skills Development's Chief Prevention Officer" and "delivered by a training provider who has been approved by the Chief Prevention Officer." The same page warns about "fraudulent training providers who may accept fees and issue cards despite not providing valid training," a reminder that an approved-issuer rule only works when the card in someone's hand can be checked against the provider's own records.

These rules share three things. The authority publishes a list of who may issue, so anyone can check. It usually says what the certificate must contain. And a certificate from outside the list is not illegal; it just does not do the job that rule exists for.

What You May Call It

Being allowed to issue a certificate is not the same as being allowed to call it anything. The words on the page are claims, and some of them belong to other people.

Attendance, participation, completion. These say progressively more. Attendance says the person was there. Participation says they took an active part. Completion says they finished a defined program, which usually implies they were assessed. Use the one you can back up with a record. A "certificate of completion" for a webinar nobody had to stay for is a claim you cannot support.

Certified and certification. The Institute for Credentialing Excellence, which accredits both kinds of program, keeps the two apart. A certificate program teaches something, tests whether the learner got it, and awards a certificate for that specific learning; ICE adds that this "is NOT a certificate of attendance or participation." A certification validates competence "through a conformity assessment system" that is "independent of a specific learning event," usually with eligibility rules and a requirement to recertify. If your course has no assessment, it does not produce a "Certified Forklift Operator" or a "Certified Project Manager." Even OSHA, which has every reason to flatter its own cards, says they are not a certification.

Approved, accredited, recognized. Use these only when a named body has in fact approved, accredited or recognized the course, and be ready to name it. The same goes for logos. A regulator's seal on a private certificate implies an approval that was never given.

Diploma and degree. These belong to institutions. A degree is granted by a school approved by a state or provincial higher-education agency, usually with an accreditor on top. Colorado's higher-education department keeps a form to "Report an Illegal School or Diploma Mill", and it is not the only state that does. A training company whose students complete a 40-hour course does not issue a diploma in the academic sense, and should not borrow the word.

Who Decides Whether It Counts

OSHA's sentence about mandated training is the general rule for every certificate: the organization that requires the training decides what it will accept. For the trainer in the opening, that is the grocery chain's HR department. For a contractor, it is the general contractor's site safety manager. For a professional, it is their board. None of them is bound by what the issuer thinks the certificate is worth.

What they look for is consistent. What HR teams check before approving a training provider goes through the full list; the short form is four questions. Who issued this, and can I reach them? What exactly does it say was done, and was anything assessed? When does it stop being valid? And can I confirm it is real without a phone call?

A certificate from an unaccredited provider that answers all four is accepted every day. A card from an approved issuer that answers none of them gets a call to the provider, or a request to retrain, which is what Ontario's fraud warning is about. Accreditation changes who may issue. It does not do the acceptor's checking for them.

Making a Certificate Credible Without a Body Behind It

If no rule names an issuer for what you teach, the credibility of your certificate is yours to build. The pieces are not expensive.

1. Name a person and an organization. The instructor's name, the organization's name, an address and a way to make contact. "Issued by" followed only by a logo is the first thing a careful reader distrusts.
2. State what was done, not what it felt like. The course title, specific enough to show which requirement it meets; the hours; whether there was an assessment and whether the person passed it. Our list of what a training certificate should include covers the fields the regulations ask for.
3. Give it a date and a shelf life. An issue date always, and an expiry or re-evaluation date wherever the subject has one. Forklift evaluations and hazmat training both run on three-year cycles, and the reader should not have to know that.
4. Number it. One unique number per certificate, so a question can be about this certificate and not about "a J. Smith who took a course in March."
5. Make it checkable. A page the issuer controls, reached by a link or a QR code, that shows the same facts and whether the certificate is still valid. This is the one thing that separates a certificate anyone can check from a PDF anyone can edit. How training providers fight certificate fraud is about this step.
6. Keep the record. A certificate is a copy of a record, and the record is what you will be asked for in three years. How long to keep training records sets out the periods.
7. Claim only what you have. If a client's rule needs an approved issuer and you are not one, say so before the course, and either get on the list or partner with someone who is.

Where CertLister Fits

Items 1 through 6 are what a credential platform does by default, which is the reason small training providers use one. In CertLister each credential carries the issuing organization, the recipient's name, the title, the issue and expiry dates and a unique credential number as data, and the certificate PDF is generated from that data. Hours, the instructor or the result of an assessment can be added as custom attributes and placed on the design. A QR code on the certificate opens a verification page that names the issuer and shows whether the credential is active, expired, revoked or replaced by a renewal. The grocery chain's HR manager can check the trainer's certificates herself, all two thousand of them, without sending a single email.

The Short Version

Before you print "certificate" on anything, or decide whether to accept one, check three things:

• Does a rule name who may issue this? If so, only a certificate from that list counts, and the list is public.
• If not, does the certificate say who is accountable, what was done, when it expires, and how to check it?
• Does it claim only what the issuer can back up: completion if there was an assessment, attendance if there was not, and never "certified," "accredited" or "approved" without a body that said so?

This is a summary of published rules, not legal advice. The examples are US federal rules, one California statute and one Ontario program; requirements differ by state, province and sector, and many regulators not covered here name their own issuers. Check the rules that apply to the people you train.

CertLister is a digital credential platform for training providers and the organizations that rely on their certificates. Issue credentials under your own name, with unique numbers and a verification page anyone can check, and keep the record behind every certificate. Start free →