Why Clause 7.1.6 Confuses So Many Organisations
Organisational knowledge is one of those requirements in ISO 9001 that looks simple on the surface but trips up quality managers and auditors alike. Clause 7.1.6 sits inside the resources section of the standard, which is why some people treat it as a documentation exercise. It is not. It is about making sure your organisation retains and uses the knowledge it needs to operate its processes and achieve conformity of products and services.
On this page
In over 14 years of conducting external ISO certification audits, I have seen two common failure modes. The first is organisations that have never really thought about what knowledge they hold and where it lives. The second is organisations that have created a knowledge register, filed it away, and then done nothing with it. Neither approach satisfies the clause. This article explains what the standard actually requires, what auditors look for, and how to build something that genuinely works.
What the Standard Says
The text of Clause 7.1.6 in ISO 9001:2015 is relatively brief. It asks organisations to determine the knowledge necessary for the operation of its processes and to achieve conformity of products and services. That knowledge must be maintained and made available to the extent necessary.
The clause then adds two important considerations. When addressing changing needs and trends, the organisation must consider its current knowledge and determine how to acquire or access any necessary additional knowledge. There are two notes in the standard that provide useful context. Note 1 describes organisational knowledge as knowledge specific to the organisation, generally gained by experience. Note 2 gives examples of sources: internal sources such as intellectual property, lessons learned from failures and successes, and the results of improvements; and external sources such as standards, academia, conferences, and knowledge gathered from customers and external providers.
The clause does not prescribe a method. It does not require a specific register, a knowledge management system, or any particular format of documented information. What it requires is evidence that the organisation has thought about this seriously and put something in place that works.
Exemplar Global Certified Training ProviderRTP No. 310970
What Organisational Knowledge Actually Means
It helps to be clear about what we are talking about before getting into how to manage it.
Knowledge Is Not the Same as Information
Documents, procedures, and records are information. Knowledge is the understanding that allows people to apply that information effectively. A procedure for calibrating a piece of equipment is information. Knowing why a particular tolerance matters for the product, and what happens when it drifts, is knowledge. The clause is asking you to manage both, but the emphasis is on the knowledge that would be lost if the right people walked out the door.
The Risk of Knowledge Walking Out the Door
Think about the people in your organisation who hold critical knowledge. The production supervisor who knows from experience that a particular supplier batch needs to be checked a certain way. The engineer who understands the quirks of a legacy machine. The customer service manager who has built up an understanding of how a major client operates. If any of these people left tomorrow, what would happen?
That is the question Clause 7.1.6 is really asking you to answer. Not as a theoretical exercise, but as a practical risk management activity. The clause sits in the same section as competence and awareness for good reason. Together, these requirements are about making sure your organisation has the human capability it needs to deliver consistent quality.
Sources of Organisational Knowledge
The standard points to several sources worth thinking through carefully.
- Internal sources: Lessons learned from past projects, nonconformities and corrective actions, product failures and their root causes, process improvements, tribal knowledge held by experienced staff, and intellectual property developed internally.
- External sources: Industry standards and technical specifications, supplier and customer knowledge, training and professional development, conferences and industry forums, regulatory guidance, and benchmarking against peers.
Most organisations have more of this knowledge than they realise. The problem is that it is often undocumented, unevenly distributed, and vulnerable to loss.
What Auditors Actually Look For
When I audit Clause 7.1.6, I am not looking for a sophisticated knowledge management platform. I am looking for evidence that the organisation has genuinely engaged with the question of what knowledge it needs, where that knowledge currently lives, and what it is doing to protect and develop it.
The Questions an Auditor Will Ask
Expect an auditor to ask some version of the following during an internal or certification audit:
- How has your organisation determined what knowledge is necessary for your processes?
- Where is critical knowledge currently held, and what would happen if key people left?
- How do you capture lessons learned from nonconformities, customer complaints, and project outcomes?
- How do you identify when your knowledge is becoming outdated or insufficient?
- What have you done recently to acquire new knowledge to address changing needs?
These are open questions designed to test whether the organisation has actually thought about this or just ticked a box. If the quality manager says “we have a knowledge register” and then cannot explain how it is used or maintained, that is a problem.
Common Nonconformities Against Clause 7.1.6
The most frequent findings I raise or observe against this clause fall into a few categories.
No evidence of determination: The organisation cannot demonstrate that it has systematically identified what knowledge is necessary for its processes. There is no analysis, no discussion in management review, and no documented consideration of the question.
Knowledge exists only in people's heads: Critical knowledge is held entirely by one or two individuals with no succession planning, no documentation, and no process for capturing it before those people leave.
Static and unused registers: A knowledge register was created for the certification audit and has not been reviewed since. It does not reflect current operations and nobody refers to it.
No mechanism for acquiring new knowledge: The organisation cannot demonstrate how it identifies and responds to changing knowledge needs. There is no link to training needs analysis, no process for monitoring industry developments, and no evidence that external knowledge sources are being used.
Lessons learned are not captured: Corrective actions are closed without the underlying knowledge being documented in a way that prevents recurrence across the organisation.
Practical Approaches That Actually Work
There is no single right way to manage organisational knowledge. What works for a 15 person engineering consultancy is different from what works for a 500 person manufacturer. The key is that your approach is proportionate, genuinely used, and connected to how your business operates.
Start With a Knowledge Needs Assessment
Begin by mapping your core processes and asking what knowledge is essential for each one to function correctly. This does not need to be a lengthy exercise. For each key process, consider:
- What technical knowledge is required?
- Who currently holds that knowledge?
- Is it documented anywhere accessible?
- What would happen if the primary knowledge holder left?
- What external knowledge sources does this process depend on?
This assessment gives you a baseline. It also gives you something concrete to show an auditor when they ask how you have determined your knowledge requirements.
Connect Lessons Learned to Your QMS
One of the most practical ways to build organisational knowledge is to make sure that lessons from nonconformities, customer complaints, near misses, and project reviews are captured in a usable form. This means more than just closing a corrective action. It means asking: what did we learn, and how do we make sure the rest of the organisation benefits from that learning?
Some organisations do this through a lessons learned log. Others embed it into their corrective action process by adding a field that asks what knowledge was gained and where it should be stored. Either approach works as long as the information is actually accessible to the people who need it.
If you want to understand how to make corrective actions more effective as a knowledge capture mechanism, the article on root cause analysis for corrective actions is worth reading alongside this one.
Address Knowledge Succession Proactively
Succession planning for knowledge is not just a human resources concern. It is a quality risk. Identify your key knowledge holders, document what they know in a format that others can use, and build cross training into your operations where critical knowledge is concentrated in one person.
This does not mean writing a procedure for everything. Sometimes it means creating a technical note, a worked example, a video walkthrough, or a structured mentoring arrangement. The format matters less than the outcome: the knowledge is accessible to more than one person.
Build External Knowledge Gathering Into Your System
The standard explicitly recognises external knowledge as a legitimate source. Many organisations overlook this. Practical mechanisms include:
- Subscribing to relevant industry standards updates and technical bulletins
- Attending industry conferences or webinars and documenting what was learned
- Participating in supplier technical days or customer feedback sessions
- Monitoring regulatory changes and updating your compliance understanding accordingly
- Reviewing competitor incidents or industry case studies where they are publicly available
The key is to close the loop. Gathering external knowledge is only useful if it is assessed for relevance and acted on where necessary. Document that assessment, even briefly, so there is evidence the process is working.
Link Knowledge Management to Training Needs Analysis
Clause 7.1.6 and Clause 7.2 on competence are closely related. When you identify a gap in organisational knowledge, the response is often training or hiring. Make sure your training needs analysis process explicitly considers knowledge gaps, not just skill gaps. These are related but not identical. A person can have a skill without having the deeper knowledge of why things work the way they do, and that deeper knowledge is often what prevents recurrence of problems.
For a deeper look at how auditors assess competence records and training evidence, the article on ISO 9001 Clause 7.2 Competence Explained covers the requirements in detail.
How to Document Organisational Knowledge Without Overcomplicating It
One of the most common mistakes I see is organisations creating elaborate knowledge management frameworks that nobody uses. The documentation you create needs to serve the people who need the knowledge, not just satisfy an auditor.
What to Document
At a minimum, consider documenting:
- The outcomes of your knowledge needs assessment, even as a simple table or matrix
- Your key knowledge holders and the critical knowledge they hold
- Your lessons learned, linked to the processes or products they relate to
- Your process for identifying and responding to new or changing knowledge needs
- Evidence that external knowledge sources are being monitored and assessed
This does not need to be a separate knowledge management system. It can be integrated into your existing QMS documentation, your management review inputs, your corrective action process, and your training records.
What Not to Document
Do not try to document everything your organisation knows. That is neither practical nor what the standard requires. Focus on the knowledge that is critical to process operation and product conformity, the knowledge that is at risk of being lost, and the knowledge that is currently insufficient for your needs.
Clause 7.1.6 in the Context of Management Review
Organisational knowledge is a legitimate input to management review. Clause 9.3 requires top management to review the QMS at planned intervals, and the adequacy of resources is one of the required inputs. Knowledge is a resource. If your management review does not include any consideration of whether the organisation has the knowledge it needs, and whether that knowledge is changing, you are missing an opportunity to demonstrate that this clause is genuinely embedded in your system.
Bring knowledge gaps, succession risks, and new external knowledge to management review. Record the discussion and any decisions made. This creates a clear audit trail showing that knowledge management is an active part of your QMS, not just a document that was created once and forgotten.
For a broader look at how auditors approach the resources section of ISO 9001, the article on Auditing Resources Under ISO 9001 Clause 7.1: From People to Calibration provides useful context on how Clause 7.1.6 fits alongside the other resource requirements.
Clause 7.1.6 in the Context of Common Nonconformities
If you want to understand where organisations typically fall short across the whole standard, the article on Common ISO 9001 Clause 7 Nonconformities Auditors Keep Finding covers the patterns that come up repeatedly in certification and surveillance audits. Clause 7.1.6 features prominently in that list, usually alongside Clause 7.2 on competence.
Exemplar Global Certified Training ProviderRTP No. 310970Preparing for an Audit Against Clause 7.1.6
If you are preparing for a certification audit or an internal audit and want to make sure Clause 7.1.6 is well covered, here is a practical checklist to work through.
- Can you explain how you determined what knowledge is necessary for your processes?
- Do you have documented evidence of that determination, even in a simple format?
- Can you identify where critical knowledge currently lives and who holds it?
- Is there evidence that lessons learned are being captured and used?
- Can you demonstrate how you identify and respond to new or changing knowledge needs?
- Is organisational knowledge discussed in your management review?
- Do your training and competence processes address knowledge gaps, not just skill gaps?
If you can answer yes to all of these with supporting evidence, you are in a strong position. If there are gaps, address them before the audit rather than trying to explain them during it.
Building Real Capability, Not Just Compliance
The organisations that do Clause 7.1.6 well are not the ones with the most sophisticated knowledge management systems. They are the ones where knowledge sharing is part of the culture. Where lessons from problems are genuinely discussed and acted on. Where experienced staff are asked to document what they know before they retire or move on. Where management review includes a real conversation about whether the organisation has what it needs to keep improving.
That kind of culture does not come from a register. It comes from leadership that treats knowledge as a strategic asset and from quality professionals who understand how to make the requirement practical rather than bureaucratic.
If you are building your skills in auditing QMS requirements like this one, or preparing to conduct internal audits against ISO 9001, Audit Workshop offers practical training at Foundation, Internal Auditor, and Lead Auditor levels. The courses are built around real audit scenarios, not just theory, so you leave knowing how to apply requirements like Clause 7.1.6 in the field.
