With the wrong IAF codes assigned, you may not be able to dodge bullets.

An arcane detail that nearly every ISO 9001 certified company misses is the assignment of industry codes to your QMS scope by your Certification Body (CB, or “registrar.”) These are typically expressed as a set of SIC and NACE codes, and are then used to determine which IAF Code your QMS falls under. The IAF is the International Accreditation Forum, and oversees the overall accreditation scheme for ISO 9001 and other management system certifications; they also establish some of the rules governing your registrar. The IAF Codes are used to “hone in” the scope of your company’s business, so a registrar auditor with appropriate experience can be assigned to your company. If you develop software, than an auditor who only has experience in woodworking is not supposed to be assigned; usage of the IAF Codes helps ensure this.

The IAF Codes are, however, largely a joke. Whereas the world has developed the SIC (Standard Industrial Classification) system, comprised of over 2,300 industry classifications, and the NACE (“nomenclature statistique des activités économiques dans la Communauté européenne“) system, comprised of about 1,000 codes, the IAF codes total …. get ready … 39. As in thirty-nine. One less than forty. Three niner. The age you still tell people you are. You get the picture…

To some extent, the IAF can be excused for dumbing this down, since had they attempted to create a system which matched auditors and clients by SIC or NACE alone, it would be nearly impossible; some generalization had to be done. But the reduction of all human endeavors to less than forty codes is somewhat ludicrous, and as a result a veterinary doctor who worked on farm cows can audit medical facilities and psychologists’ officers under IAF Code 38 “Health and Social Services.” Anyone involved in any aspect of anything having to do with technology can audit under IAF Code 33 “Information Technology,” meaning a guy who designed HTML 1.0 websites using GeoCities back in 1998 is fully qualified to audit a company developing targeting software for jet fighters in 2017.

But let’s assume for a minute that the IAF Codes are acceptable; there are still significant problems lurking, and as usual, the Certification Bodies (CBs, or “registrars”) are to blame.

Send In The Clowns

The accreditation rules require, as I said, that auditors be assigned only when they have relevant industry experience and/or training within the industry served by the client. To do this, CBs are supposed to request the SIC and/or NACE codes from the client during intake; typically your accountant has these, since they impact on accounting and taxes. Then, the CBs use the official IAF ID1:2014 guide to convert SIC or NACE to the appropriate IAF Code. Once they have that, they can assign a Lead Auditor who has the IAF Codes under his or her qualification.

(Note: that IAF guidance document applies to QMS and EMS audits, so this article is equally applicable to users of ISO 14001.)

Naturally, the CBs can’t even get that right. Because auditor pools are shrinking, and they refuse to pay auditors well enough to refill the ranks, your CB is unlikely to have a robust population of auditors eligible for each IAF Code. Even if they do, many of the auditors are overbooked, and not available. So the CBs have to assign whomever happens to be breathing at the moment, and that means they need to fudge the IAF Codes.

So what you’re likely to see — or not see, rather — is that they have assigned the SIC and NACE codes for you, and from that they determined an IAF Code that matches whatever auditor they had already determined was available for your contract, whether or not that auditor is qualified for your actual industry. Then you’re surprised when the drooling clown shows up and can’t speak your industry’s language, and nearly explodes the building when trying to use the hand dryer in the bathroom.

Do Your Own Heavy Lifting

To keep tabs on this, you must take some really simple, basic steps. If you’re a new client, then as part of the CB’s client intake, you should be sure to provide your registrar with the SIC and NACE codes that apply to your industry. If you want to be really clever, then check the table below (derived from IAF ID1:2014) and supply them the IAF Codes as well. Then, be sure those numbers are entered into the CB’s records, which you can usually confirm by checking your “Client Information Sheet” the CB will maintain for you. They always have some record like this, and it may have a different name, but it’s in your file somewhere because the CB has to produce it when they get audited by their Accreditation Body.

If you’re a current CB client, then ask your CB rep what IAF codes have been assigned to your company, and compare them against the table below. If something looks wonky, then ask them to change their records, and provide them the right SIC/NACE/IAF combination. Be prepared: this may trigger a change in which auditor is assigned to you. That may be a good thing, or a bad thing. But if you’re having problems with an incompetent auditor, having your IAF Codes properly assigned may fix the problem for you.

It’s also important to point out that the CBs must use NACE 2.0 codes, and not the obsolete NACE 1.1 codes. As recently as this week, I caught a CB still calculating an IAF code based on NACE 1.1 codes, which have been obsolete for over a decade. For a listing of NACE 2.0 codes, click here. The IAF document specifically mandates that CBs use NACE 2.0, and not 1.1, but that doesn’t stop them from forgetting to update their procedures.

For a listing of SIC codes, click here.

If you see a CB using NAICS codes, be sure not to confuse them with NACE. These are, instead, from the North American Industry Classification System, and are occasionally used by some registrars; you can find a list of NAICS codes here. There is no matrix of IAF to NAICS codes, so you may have to do a few jumps (calculate NAICS to SIC, then SIC to NACE, then NACE to IAF.) Still, it should take all of five or ten minutes.

As usual, the accreditation bodies like ANAB could catch these problems in a few minutes, simply by checking if a CB’s clients had the proper NACE and IAF codes they assigned to them; it took me all of five minutes to find that the CB from this week had improperly assigned an auditor because they used an obsolete NACE 1.1 code, and wound up with the totally wrong IAF code. It defies explanation that CBs can be so routinely wrong about this basic task, but we can’t rely on the Accreditation Bodies to do the only job they have, so you’ll have to do it for them. That means, as I said, double checking to ensure all the right codes are assigned, and if not, having them corrected.

Here’s a table of the IAF Codes, and their NACE 2.0 equivalents:

#Description of economic sector / activityNACE 2.0 Equivalent(s)
1Agriculture, forestry and fishing01, 02, 03
2Mining and quarrying05, 06, 07, 08, 09
3Food products, beverages and tobacco10, 11, 12
4Textiles and textile products13, 14
5Textiles and textile products15
6Textiles and textile products16
7Pulp, paper and paper products17
8Publishing companies58.1, 59.2
9Printing companies18
10Manufacture of coke and refined petroleum products19
11Nuclear fuel24.46
12Chemicals, chemical products and fibres20
14Rubber and plastic products22
15Non-metallic mineral products23, except 23.5 and 23.6
16Concrete, cement, lime, plaster etc23.5, 23.6
17Basic metals and fabricated metal products24 except 24.46, 25 except 25.4, 33.11
18Machinery and equipment25.4, 28, 30.4, 33.12, 33.2
19Electrical and optical equipment26, 27, 33.13, 33.14, 95.1
20Shipbuilding30.1, 33.15
21Aerospace30.3, 33.16
22Other transport equipment29, 30.2, 30.9, 33.17
23Manufacturing not elsewhere classified31, 32, 33.19
25Electricity supply35.1
26Gas supply35.2
27Water supply35.3, 36
28Construction41, 42, 43
29Wholesale and retail trade; Repair of motor vehicles, motorcycles and personal and household goods45, 46, 47, 95.2
30Hotels and restaurants55, 56
31Transport, storage and communication49, 50, 51, 52, 53, 61
32Financial intermediation; real estate; renting64, 65, 66, 68, 77
33Information technology58.2, 62, 63.1
34Engineering services71, 72, 74 except 74.2 and 74.3
35Other services69, 70, 73, 74.2, 74.3, 78, 80, 81, 82
36Public administration84
38Health and social work75, 86, 87, 88
39Other social services37, 38.1, 38.2, 39, 59.1, 60, 63.9, 79, 90, 91, 92, 93, 94, 96


About Christopher Paris

Christopher Paris is the founder and VP Operations of Oxebridge. He has over 30 years' experience implementing ISO 9001 and AS9100 systems, and is a vocal advocate for the development and use of standards from the point of view of actual users. He is the author of Surviving ISO 9001 and Surviving AS9100. He reviews wines for the irreverent wine blog, Winepisser.


Surviving ISO 9001 Book