How to Audit Organisational Knowledge Under Clause 7.1.6

Why Clause 7.1.6 Trips Up So Many Auditors

Organisational knowledge is one of those requirements that looks straightforward on paper but becomes genuinely difficult to audit in practice. Clause 7.1.6 of ISO 9001 asks organisations to determine the knowledge necessary for the operation of its processes and to achieve conformity of products and services. It also requires the organisation to maintain that knowledge and make it available to the extent necessary. When knowledge needs to change, the organisation must consider how to acquire it.

That sounds clear enough. But when you sit down in front of an operations manager and ask them to show you how they manage organisational knowledge, you will often get a blank stare, a folder of training records, or a tour of a shared drive. None of those things, on their own, tell you whether the organisation has actually thought about what it knows, what it needs to know, and what would happen if that knowledge walked out the door.

This article walks through what the clause actually requires, what good looks like in practice, and the specific questions and evidence you should be pursuing when you audit it. It is written for internal auditors, quality managers preparing for certification audits, and lead auditors who want to approach this clause with more precision. If you want to understand the broader resources clause, the article on auditing resources under ISO 9001 Clause 7.1 gives useful context.

What the Clause Actually Requires

Before you can audit something, you need to be clear on what it demands. Clause 7.1.6 has three distinct requirements that are easy to blur together.

Determining the Necessary Knowledge

The organisation must identify what knowledge is needed to run its processes and deliver conforming products or services. This is not a passive exercise. It requires someone to have actually thought about the question: what do our people need to know to do this work correctly?

The standard uses the term knowledge in a specific way. The note in the clause distinguishes between information that becomes knowledge through learning and experience, and knowledge that is specific to the organisation, gained through experience. It gives examples such as intellectual property, lessons learned from failures, the results of improvement, and knowledge gained from customers.

This is not the same as competence, which is covered separately in Clause 7.2. Competence is about whether individuals can demonstrate their ability. Knowledge under Clause 7.1.6 is about whether the organisation as a whole has captured and maintained what it needs to know. A person can be competent and then leave. The question Clause 7.1.6 asks is: what happens to that knowledge when they go?

Maintaining and Making Knowledge Available

Once identified, the knowledge must be maintained. This means it needs to be protected from loss and made accessible to those who need it. The organisation does not have to document everything, but it does need to have a credible approach to keeping critical knowledge available. That might mean documented procedures, mentoring arrangements, knowledge transfer processes, or internal wikis. The method matters less than the outcome.

Acquiring New Knowledge When Needed

When the organisation identifies a gap between what it knows and what it needs to know, it must consider how to address that gap. This could mean hiring, training, engaging consultants, or building partnerships. The requirement is not that every gap is immediately closed, but that the organisation has a process for recognising gaps and deciding how to respond.

Common Audit Findings Under Clause 7.1.6

Before getting into how to audit this clause well, it helps to understand what tends to go wrong. These are the patterns that come up repeatedly in both internal and certification audits.

Treating Training Records as Sufficient Evidence

The most common mistake organisations make is pointing to their training matrix as evidence that they comply with Clause 7.1.6. Training records show that people attended a course. They do not show that the organisation has identified what knowledge is critical, how that knowledge is retained when people leave, or what would happen if a key person became unavailable tomorrow.

This is not a nonconformity on its own, but it is a signal that the organisation has not fully engaged with what the clause is asking. A good auditor will probe further.

No Identification of Critical Knowledge

Many organisations have never formally asked the question: which knowledge, if lost, would most seriously affect our ability to operate? They may have job descriptions, procedures, and training plans, but no analysis of where knowledge risk sits. This is a genuine gap against the first requirement of the clause.

Knowledge Held Only in People’s Heads

In smaller organisations especially, critical operational knowledge often lives entirely with one or two individuals. There is no backup, no documented process, and no succession plan. When auditors find this situation, it is worth exploring whether the organisation is aware of the risk and whether it has considered any response, even if informal.

No Response to Knowledge Gaps

Some organisations have identified that they lack knowledge in a particular area but have taken no action and have no plan. If the gap is material to process operation or product conformity, this is a potential nonconformity. The standard requires the organisation to consider how to acquire needed knowledge, which implies some deliberate response to a recognised gap.

How to Audit Organisational Knowledge Effectively

The key to auditing Clause 7.1.6 well is to approach it as a risk conversation, not a documentation review. You are trying to understand whether the organisation has thought seriously about its knowledge, where it sits, and what protects it.

Start With the Process Map

Before your interviews, review the process map or process descriptions for the scope you are auditing. Identify the processes that are most critical to product or service conformity. These are the processes where knowledge risk matters most. If the organisation makes a specialised product, the knowledge embedded in the production process is likely critical. If it delivers a professional service, the knowledge held by individual practitioners is the main asset.

Going into interviews with this context means you can ask targeted questions rather than generic ones.

Questions to Ask in Interviews

The following questions are useful starting points. Adapt them to the context of the organisation.

• What would happen if your most experienced person in this process left tomorrow? How would you manage?
• Has the organisation ever lost critical knowledge because someone left or retired? What happened?
• Where is the knowledge for this process documented? Can I see it?
• How do you bring a new person up to speed in this role? What do they need to know that is not written down anywhere?
• Have you identified any areas where the organisation needs knowledge it does not currently have? What is being done about it?
• When a project goes wrong or a product fails, how does the organisation capture what it learned so it does not happen again?
• How is knowledge from customers, suppliers, or industry shared internally?

These questions are designed to surface real thinking, not rehearsed answers. If a quality manager gives you a polished response about their knowledge management system, follow up by asking to see it in action. Ask a process operator the same questions independently. The gap between what the system says and what workers actually experience is often where the real audit story lives.

Evidence to Request

ISO 9001 does not require specific documented information for Clause 7.1.6, but organisations typically produce evidence in several forms. Ask to see:

• Any documented analysis of critical knowledge or knowledge risk assessments
• Knowledge transfer plans for key roles, particularly where succession risk has been identified
• Lessons learned registers or similar records that capture organisational learning
• Documented procedures, work instructions, or standard operating procedures for critical processes
• Records of how knowledge gaps have been identified and addressed
• Onboarding or induction materials that capture institutional knowledge
• Minutes from management reviews or team meetings where knowledge risk has been discussed

The absence of any of these is not automatically a nonconformity. The standard does not prescribe how knowledge must be managed. But if you cannot find any evidence that the organisation has thought about this question, that is a problem.

Walk the Process

One of the most effective audit techniques for this clause is to walk a process from start to finish and ask the people doing the work what they know that is not written down anywhere. In almost every organisation, there is a gap between the documented procedure and the actual practice. Some of that gap is fine. Some of it represents critical knowledge that exists only in the heads of experienced workers.

When you find that gap, the audit question is not whether the gap exists, but whether the organisation is aware of it and has considered the risk. If a process relies on an experienced operator making judgement calls that no one else could replicate, and the organisation has no plan for what happens when that person leaves, you have a finding worth raising.

Sector Specific Considerations

The way Clause 7.1.6 plays out varies significantly by sector. Adjusting your approach to the context of the organisation will make your audit more effective.

Professional Services

In consulting, legal, engineering, and similar firms, knowledge is the product. The risk of knowledge loss is high because the knowledge is highly individual. Look for evidence that the organisation captures project learnings, maintains client relationship knowledge beyond individual account managers, and has considered what happens when senior practitioners leave. Mentoring arrangements, internal knowledge sharing sessions, and documented methodologies are all relevant evidence.

Manufacturing

In manufacturing, the critical knowledge often lives in the heads of long serving production staff. Set up procedures, machine parameters, troubleshooting knowledge, and quality judgement calls are all areas where institutional knowledge accumulates. Look for how that knowledge is captured in work instructions and standard operating procedures, and whether those documents are actually used or just filed. The article on auditing a manufacturing quality management system covers related areas in more detail.

Construction and Project Based Work

In project based industries, the challenge is capturing knowledge between projects. What went wrong on the last job? What worked well? Is that learning available to the team on the next project, or does it disappear when the project closes out? Look for lessons learned processes, project close out reviews, and how that information feeds back into future planning.

Small Organisations

In small businesses, the owner or a small group of key people often hold most of the critical knowledge. The organisation may not have the resources for formal knowledge management systems, but the risk is arguably higher because there are fewer people to absorb the impact of knowledge loss. Look for any evidence that the organisation has thought about this risk, even informally. A conversation with the owner about succession planning or business continuity can reveal a lot.

Linking Clause 7.1.6 to Other Parts of the Audit

Organisational knowledge does not sit in isolation. When you audit this clause, you will often find connections to other parts of the management system.

Clause 7.2 Competence

Competence and knowledge are related but distinct. Competence is about whether individuals can demonstrate the ability to do their work. Knowledge under 7.1.6 is about whether the organisation retains what it needs to know. A finding under one clause may point to a gap in the other. If you find that a critical process relies on one person who has never been assessed for competence and whose knowledge has never been documented, you may have findings under both clauses.

Clause 6.1 Risks and Opportunities

Knowledge loss is a risk. If the organisation has conducted a risk assessment under Clause 6.1 but has not considered the risk of losing critical knowledge, that is worth noting. Conversely, if the risk assessment has identified knowledge risk but no action has been taken, follow that thread.

Clause 10.2 Corrective Action and Continual Improvement

Lessons learned processes are a key mechanism for building organisational knowledge. When something goes wrong, the corrective action process should capture not just what was done to fix the problem, but what the organisation learned and how that learning has been preserved. If corrective actions are being closed without any evidence of learning being captured, that is a gap worth raising. The article on auditing corrective action and root cause under Clause 10.2 covers this in more detail.

Management Review

Management review inputs under Clause 9.3 include the adequacy of resources. Knowledge is a resource. If management review has never considered whether the organisation has the knowledge it needs, or whether knowledge risk has been assessed, that is worth noting in your audit.

Writing Up Findings Under Clause 7.1.6

When you raise a finding against this clause, be specific about which of the three requirements has not been met. Vague findings like organisational knowledge is not adequately managed are hard to act on. A well written finding will identify exactly what evidence was sought, what was found, and which specific requirement has not been met.

For example:

During interviews with the production supervisor and two process operators, it was confirmed that critical set up parameters for the extrusion line are not documented anywhere and are known only to one operator who has worked on the line for 14 years. The organisation has not identified this as a knowledge risk and has no plan for how this knowledge would be retained if the operator were to leave. This does not demonstrate that the organisation is maintaining the knowledge necessary for the operation of its processes in accordance with Clause 7.1.6.

That is a finding that a quality manager can act on. Compare it to a vague observation that knowledge management could be improved, which tells nobody anything useful.

For guidance on writing findings that actually drive improvement, the article on how to write audit findings that stand up to challenge is worth reading.

What Good Looks Like

Not every organisation will have a formal knowledge management system, and that is fine. The standard does not require one. What you are looking for is evidence that the organisation has genuinely engaged with the question of what it knows, where that knowledge sits, and how it protects it.

Good practice under Clause 7.1.6 typically includes some combination of the following:

• A documented or at least deliberate analysis of which knowledge is critical to process operation and product conformity
• Documented procedures and work instructions that capture critical process knowledge, kept current and actually used
• A lessons learned process that captures organisational learning from projects, incidents, and improvements
• Knowledge transfer arrangements for key roles, including mentoring, job shadowing, or structured handover processes
• A process for identifying when the organisation lacks knowledge it needs, and a deliberate approach to addressing that gap
• Management awareness of where the key knowledge risks sit in the organisation

When you find an organisation that can demonstrate most of these things, even informally, you can be reasonably confident that the intent of Clause 7.1.6 is being met. The method is less important than the outcome.

Building Your Skills as an Auditor

Auditing Clause 7.1.6 well requires more than knowing what the clause says. It requires the ability to have a genuine conversation about organisational risk, to follow threads through interviews and observations, and to distinguish between an organisation that has genuinely thought about its knowledge and one that has simply ticked a box.

These are skills that develop with practice. If you are building your auditing capability, whether as an internal auditor or working toward lead auditor certification, the Audit Workshop training courses are designed to develop exactly this kind of practical judgement. Courses cover ISO 9001, ISO 14001, ISO 45001, ISO 27001, and more, delivered by an auditor with over 14 years of real audit experience across hundreds of certification audits. You can explore the available courses at auditworkshop.com.