How To Ensure Your Certification Body Uses the Right Industry Codes, and Why It’s Important

UPDATED June 2022.

An arcane detail that nearly every ISO 9001 certified company misses is the assignment of industry codes to your QMS scope by your Certification Body (CB) These are typically expressed as a set of SIC and NACE codes, and are then used to determine which IAF Code your QMS falls under. The IAF is the International Accreditation Forum, and oversees the overall accreditation scheme for ISO 9001 and other management system certifications; they also establish some of the rules governing your CB. IAF Codes are used to “hone in” the scope of your company’s business, so a CB auditor with appropriate experience can be assigned to your company. If you develop software, then an auditor who only has experience in woodworking is not supposed to be assigned; usage of the IAF Codes helps ensure this.

The IAF Codes are, however, largely a joke. Whereas the world has developed the SIC (Standard Industrial Classification) system, which comprised over 2,300 industry classifications, and the NACE (“nomenclature statistique des activités économiques dans la Communauté européenne“) system, which comprised about 1,000 codes, the IAF codes total only 39. 

To some extent, the IAF can be excused for dumbing this down, since had they attempted to create a system that matched auditors and clients by SIC or NACE alone, it would be nearly impossible; some generalization had to be done. But the reduction of all human endeavors to less than forty codes is a bit of a stretch, and allows auditors to assess systems for things they really have no experience in.

But they are the law of the land, for now.

Auditor Assignments

The accreditation rules require, as I said, that auditors be assigned only when they have relevant industry experience and/or training within the industry served by the client. To do this, CBs are supposed to request the SIC and/or NACE codes from the client during intake; typically your accountant has these, since they impact on accounting and taxes. Then, the CBs use an official IAF guide to convert SIC or NACE to the appropriate IAF Code. Once they have that, they can assign a Lead Auditor who has the IAF Codes under his or her qualification.

But CBs routinely fail to obtain your industry codes beforehand, and — to save time — often just skim your company website and assign their own, based on a rough idea of what you do. This is very, very bad practice.

What happens next, then, is that they will assign an auditor based on their own assumptions, and that auditor may have no actual experience in your industry. That causes chaos during the audit itself, and can lead to the unqualified auditor writing improper nonconformities, costing you money to resolve them.

Do Your Own Heavy Lifting

To keep tabs on this, you must take some really simple, basic steps.

If you’re a new client, then as part of the CB’s client intake, be sure to provide your CB with the SIC and NACE codes that apply to your industry. Better yet, hand them the actual IAF codes yourself. The table below is taken from the official listing of IAF codes, published as IAF ID1 on the IAF website.

Then, before the auditor shows up, verify the industry codes and make sure they have inputted them correctly.

If you’re a current CB client, then ask your CB rep what IAF codes have been assigned to your company, and compare them against the table below. If something looks wonky, then ask them to change their records. If the CB claims this is a “change in scope” – -and thus tries to force you to buy a special audit — refuse. Clarify that you are correcting their mistake, and that your actual scope of activity has not changed.

Be prepared, though: this may trigger a change for the auditor assigned to you. That may be a good thing, or a bad thing. But if you’re having problems with an incompetent auditor, having your IAF Codes properly assigned may fix the problem for you.

NACE and SIC Codes

It’s also important to point out that the CBs must use NACE 2.0 codes, and not the obsolete NACE 1.1 codes. Recently, I caught a CB still calculating an IAF code based on NACE 1.1 codes, which have been obsolete for over a decade. For a listing of NACE 2.0 codes, click here. The IAF document specifically mandates that CBs use NACE 2.0, and not 1.1, but that doesn’t stop them from forgetting to update their procedures.

For a listing of SIC codes, click here.

If you see a CB using “NAICS” codes, be sure not to confuse them with NACE. These are, instead, from the North American Industry Classification System, and are occasionally used by some CBs; you can find a list of NAICS codes here. These should not be used becaue they are specific to North America, and not truly international. There is no matrix of IAF to NAICS codes, so you may have to do a few jumps (calculate NAICS to SIC, then SIC to NACE, then NACE to IAF.) Still, it should take all of five or ten minutes.

[ultimatetables 4 /]

[This article was originally written in 2017 and updated with more current information.]