How to Audit Competence in ISO 9001: Records, Matrices and Evaluation

Why Competence Is One of the Most Misaudited Clauses in ISO 9001

Auditing competence under ISO 9001 Clause 7.2 sounds straightforward on paper. The organisation must determine what competence is needed, ensure people have it, take action where they do not, and keep documented information as evidence. Four requirements. Simple enough.

In practice, this clause trips up organisations and auditors alike. Organisations confuse training records with competence evidence. Auditors tick the box when they see a training register and move on. Neither approach gets to what the clause actually demands.

Competence is not the same as training. A person can attend a course and still be unable to do the job effectively. The standard asks whether people are actually capable of performing their work in a way that affects quality outcomes. That is a much higher bar than attendance at a seminar.

This article walks through how to audit ISO 9001 Clause 7.2 properly. It covers what records to request, how to read a competence matrix, how to evaluate whether the organisation has genuinely assessed capability, and the nonconformities that come up most often. If you are an internal auditor preparing for your next QMS audit, or a lead auditor wanting to sharpen your approach, this is the practical guidance you need.

What Clause 7.2 Actually Requires

Before looking at how to audit the clause, it helps to be precise about what it asks. ISO 9001 Clause 7.2 has four requirements:

• Determine the necessary competence of persons doing work under the organisation's control that affects the performance and effectiveness of the QMS
• Ensure those persons are competent on the basis of appropriate education, training, or experience
• Where applicable, take actions to acquire the necessary competence and evaluate the effectiveness of those actions
• Retain appropriate documented information as evidence of competence

Two phrases deserve particular attention. Persons doing work under the organisation's control extends beyond direct employees. It includes contractors, labour hire staff, and subcontractors whose work affects quality. Many organisations overlook this entirely.

Evaluate the effectiveness of those actions is the requirement that most organisations fail to meet. They document training. They do not evaluate whether the training worked. For a detailed explanation of what the clause requires, see our post on ISO 9001 Clause 7.2 Competence Explained.

Starting the Audit: What to Request Before You Walk In

Good competence auditing starts before you arrive on site. Request the following documents in advance so you can review them before interviews begin.

The Competence Matrix or Skills Matrix

This is the central document for any competence audit. A competence matrix maps roles or individual positions against the competencies required for each. It should show what is required, what is currently held, and any gaps. Some organisations use a simple spreadsheet. Others use purpose built software. The format is less important than the content.

When you receive the matrix, look for these things before the audit day:

• Are all roles that affect quality outcomes included, not just production roles?
• Does it cover contractors and labour hire staff, or only direct employees?
• Are the competency requirements specific, or are they vague descriptions like “good communication skills”?
• Does it show current status, not just what is required?
• Is there evidence it has been reviewed and updated recently?

A matrix that was created for certification and never touched again is a red flag. You will often spot this because the date has not changed in years, or because the role list does not match the current organisational structure.

Training Records and Certificates

Request a sample of training records across different roles and departments. Do not let the organisation select the sample for you. Ask for records covering roles in high risk processes, recently hired staff, and staff who have changed roles. This is where gaps tend to appear.

Position Descriptions or Role Profiles

These should define the competency requirements for each role. If the organisation cannot produce them, or if they are generic documents that bear no relation to what people actually do, that is worth noting before you start your interviews.

Evaluation Records

Ask for records showing how the organisation evaluated the effectiveness of training or other actions taken to address competence gaps. This is the requirement most organisations cannot demonstrate. Knowing this before you arrive shapes your interview questions.

Reading a Competence Matrix: What Auditors Should Look For

A competence matrix can look impressive and still tell you very little. Here is how to read one critically.

Are the Competency Requirements Meaningful?

A matrix that lists competencies as “forklift operation,” “product knowledge,” and “customer service” without any further definition is not useful. What level of forklift operation? Which products? What does competent customer service look like in this context?

The better organisations define competency levels. For example, a matrix might use a four level scale: awareness, basic, proficient, and expert. Each role has a required level for each competency, and each person has an assessed current level. Gaps are immediately visible.

If the matrix has no defined levels and simply uses ticks and crosses, ask how the organisation determined that a tick is warranted. The answer will tell you a great deal about the rigour of the system.

Does the Matrix Match the Actual Workforce?

Cross reference the matrix against the organisation's current employee list or organisational chart. Are all people in quality affecting roles captured? Are there contractors on site whose names do not appear anywhere?

In a manufacturing audit I conducted, the competence matrix covered all direct production staff but made no mention of the maintenance team. The maintenance technicians were responsible for calibrating critical measuring equipment. Their competence was entirely undocumented. That became a nonconformity.

How Current Is the Information?

Check the dates on competency assessments and training records against the matrix. If the matrix shows someone as competent in a process, but their last assessed training was four years ago and the process has since changed, the matrix is misleading rather than helpful.

Interview Techniques for Auditing Competence

Document review alone will not give you a complete picture. Interviews are essential for auditing competence, and they need to be conducted carefully.

Interview the Manager, Then the Worker

Start with the area manager or supervisor. Ask them how they determined what competencies are needed for the roles in their area. Ask how they assess whether someone is competent before allowing them to work independently. Ask what they do when a gap is identified.

Then speak with workers directly. This is where the real picture emerges. Ask open questions. How did you learn to do this job? How did your manager check that you were ready to work on your own? What happens if you are unsure about something?

The gap between what managers describe and what workers experience is often significant. For guidance on getting useful answers from people on the floor, see our post on interviewing shop floor workers.

Questions That Reveal Genuine Competence

Avoid questions that can be answered with yes or no. Instead, use questions like these:

• Walk me through how you would handle a situation where you noticed a product defect during your process.
• What are the critical quality requirements for this step, and how do you know if you are meeting them?
• When you started in this role, how did the organisation check that you were ready to work independently?
• If you were unsure whether a product met specification, what would you do?

A worker who can answer these questions with specifics is demonstrating real competence. A worker who gives vague or uncertain responses, despite the matrix showing them as fully competent, is telling you something important about the organisation's evaluation process.

Probe the Evaluation of Training Effectiveness

This is the area where most organisations fall short. Ask the manager directly: after someone completes training, how does the organisation check whether it worked? Common answers include:

• We observe them during a supervised period
• We test them with a written assessment
• Their supervisor signs off after a set period
• We monitor their output quality for a period after training

All of these can be legitimate approaches. The question is whether there is any documented evidence that the evaluation actually occurred. If the answer is that the supervisor just knows when someone is ready, and there is no record of that assessment, you have a gap between the requirement and the practice.

Common Nonconformities Under Clause 7.2

After conducting hundreds of external audits, these are the nonconformities that appear most consistently under this clause.

No Competence Requirements Defined for the Role

The organisation has training records but has never formally determined what competencies are required for each role. Without defined requirements, you cannot assess whether a person is competent or not. You have no baseline to measure against. This is a fundamental gap and typically results in a nonconformity against the first requirement of the clause.

Training Attendance Treated as Competence Evidence

A training register showing that someone attended a course is not evidence of competence. It is evidence of attendance. The clause requires evidence that the person is competent, which means there must be some form of assessment or evaluation. Organisations that rely solely on attendance records are not meeting the requirement.

Contractors and Labour Hire Staff Excluded

The clause applies to persons doing work under the organisation's control. This includes contractors and labour hire workers whose activities affect quality outcomes. Organisations that have robust competence systems for direct employees but nothing for contractors are only partially compliant.

No Evidence of Effectiveness Evaluation

This is the most common gap. The organisation takes action to address a competence gap, such as sending someone on a course, but there is no record of evaluating whether the action worked. The clause explicitly requires this evaluation. A training record without a subsequent assessment or observation record does not satisfy the requirement.

Competence Matrix Not Maintained

The matrix exists but has not been updated when roles changed, when new processes were introduced, or when staff moved between positions. A stale matrix is not useful evidence. It may actually work against the organisation by showing requirements that no longer reflect reality.

Sampling Strategy for Competence Audits

You cannot review every person's competence records in a typical audit. You need a sampling strategy that gives you confidence in your conclusions. Here is a practical approach.

Select roles based on risk to quality outcomes. Prioritise roles where incompetence would have the most significant impact on product or service quality. In a manufacturing context, this might be machine operators on critical processes, quality inspectors, and calibration technicians. In a service organisation, it might be the people who directly interact with customers or who make decisions about service delivery.

Within each selected role, sample across different experience levels. Review records for someone who recently joined the organisation, someone who changed roles recently, and someone who has been in the role for a long time. Recent joiners and role changers are where gaps tend to appear. Long serving staff can reveal whether the organisation has mechanisms for maintaining and updating competence over time.

Sample across departments, not just the main production or service delivery area. Support functions like maintenance, purchasing, and administration often affect quality outcomes but are overlooked in competence systems.

For practical guidance on sampling approaches, the post on audit sample sizes covers how to think about this across different types of evidence.

Linking Competence to Other Clauses

Clause 7.2 does not exist in isolation. Competence connects to several other parts of the standard, and good auditing follows these connections.

Clause 6.1 Risks and Opportunities

If the organisation has identified a risk related to product quality, and that risk is influenced by human performance, then competence requirements should reflect that risk. Ask whether the competence requirements for high risk roles are more stringent than for lower risk roles. If every role has the same generic competency requirements regardless of risk, the system is not risk based.

Clause 8.1 Operational Planning and Control

The operational processes should have defined competency requirements embedded in work instructions or process controls. If a work instruction says that a particular inspection must be performed by a qualified inspector, there should be a corresponding competency requirement in the system and evidence that the person performing the inspection meets it.

Clause 9.1 Monitoring, Measurement, Analysis and Evaluation

Quality performance data can serve as indirect evidence of competence effectiveness. High rates of rework, customer complaints, or nonconforming product in a particular area might indicate a competence gap. Ask the organisation whether they analyse performance data to identify potential competence issues. This links the evaluation of training effectiveness to real quality outcomes rather than just post course assessments.

Writing Up Your Findings

When you write findings from a competence audit, be specific. A finding that says “training records were incomplete” is not useful. A finding that says the following is much more effective:

Three of the five sampled production operators in the pressing area had no documented evidence that the effectiveness of their induction training was evaluated prior to unsupervised work commencing. The competence matrix indicates all five as fully competent, but no assessment records, observation checklists, or supervisor sign off records could be produced to support this status.

This kind of finding identifies the specific gap, the evidence reviewed, the requirement not met, and the scope of the issue. It gives the organisation something concrete to address rather than a vague direction to improve their training records.

For internal auditors, findings like this are also useful for management review. They give top management a clear picture of where the competence system is working and where it is not. See the related post on auditing resources under ISO 9001 Clause 7.1 for how competence fits into the broader resource picture that management needs to understand.

Practical Tips for Getting This Right Every Time

A few habits that make competence audits more effective:

• Always ask to see the competency requirements before you ask to see the records. If you look at records first, you might accept them at face value. If you understand what is required first, you can assess whether the records actually demonstrate it.
• Follow the trail from requirement to evidence. Start with the defined competency requirement, then ask for the evidence that the person meets it. Do not let the organisation reverse this by showing you a pile of training records and asking you to conclude they are competent.
• Ask about competence for new and changed processes. When a new machine is installed or a process changes, does the organisation update its competence requirements and reassess affected staff? This is a common gap.
• Look for the effectiveness evaluation specifically. Do not accept training records as a substitute. Ask directly: after this training, how did you check that it worked? Then ask for the record of that check.
• Check that the person doing the competency assessment is themselves competent to make that assessment. This sounds recursive but it matters. A supervisor signing off on a welder's competence should have the knowledge to make that judgement.