ISO 9001 Clause 7.2 Competence Explained

What Clause 7.2 Actually Says

ISO 9001 Clause 7.2 Competence is one of the most frequently audited clauses in any quality management system, and one of the most frequently misunderstood. The clause itself is short. It asks organisations to determine the competence required for people whose work affects quality performance, ensure those people are competent, take action when they are not, and retain documented evidence that competence exists. Four requirements. Straightforward on paper. Complicated in practice.

The reason auditors keep raising nonconformities against this clause is not because organisations ignore it. Most organisations have training records. Most have job descriptions. The problem is the gap between having paperwork and demonstrating genuine competence. The standard is not asking for a training register. It is asking you to show that the people doing quality critical work are actually capable of doing it well.

This article walks through each element of Clause 7.2 in plain language, explains what auditors look for, identifies the most common failures, and gives you practical guidance for getting this clause right whether you are managing a QMS or auditing one.

Who Does Clause 7.2 Apply To?

The clause applies to persons doing work under the organisation's control that affects quality performance. That phrase matters. It is broader than most people assume.

It includes employees in quality critical roles, obviously. But it also extends to contractors, temporary workers, and anyone else performing work that could influence whether your products or services meet requirements. If a subcontractor is doing work that directly affects your output, you need to be able to demonstrate their competence is understood and managed.

The clause does not apply to every person in the organisation. A receptionist booking meeting rooms is not in scope. A welder producing structural components absolutely is. The key question is whether the person's work has a direct bearing on quality outcomes. When in doubt, include them. Auditors will question exclusions that look convenient rather than considered.

The Four Requirements of Clause 7.2

Determining Required Competence

Before you can demonstrate that someone is competent, you need to define what competence looks like for their role. The standard requires organisations to determine the necessary competence based on education, training, and experience.

In practice, this means documenting what a person in each quality critical role needs to know, what skills they need to demonstrate, and what experience or qualifications are relevant. This is often captured in job descriptions, role profiles, or competence frameworks. The format does not matter. The substance does.

One of the most common gaps auditors find here is that competence requirements are defined at a generic level but not linked to the specific quality outputs of the role. A job description that says relevant industry experience required is not the same as one that specifies the technical skills, equipment competencies, or regulatory knowledge needed to perform quality critical tasks. Be specific. Vague competence requirements produce vague evidence and vague audits.

Ensuring People Are Competent

Once you have defined what competence looks like, you need to ensure the people in those roles actually have it. The standard lists three routes: appropriate education, training, or experience.

Note that the standard does not say training is the only answer. Experience is explicitly recognised. A tradesperson with fifteen years of relevant experience may be entirely competent without having completed a formal training course in every aspect of their role. Auditors should not penalise organisations for relying on experience where experience is genuinely sufficient and can be evidenced.

That said, experience needs to be verifiable. If you are claiming someone is competent based on experience, you need to be able to show what that experience consists of. A resume or employment record is a starting point. For higher risk roles, you may also want records of performance evaluations, on the job assessments, or supervisor sign offs.

Training records alone are not proof of competence. Attending a course demonstrates attendance. It does not demonstrate that the person can apply what they learned in a work context. Auditors who understand this distinction will probe beyond the training register and ask how the organisation evaluates whether training was effective.

Taking Action When Competence Is Lacking

When the organisation identifies a gap between required competence and actual competence, it must take action. The standard gives examples: providing training, mentoring, reassigning people, or hiring competent staff. These are examples, not an exhaustive list. The key is that the action must be appropriate to the gap.

This is where many organisations stumble. They identify a gap, schedule a training course, tick the box, and move on. What they do not do is evaluate whether the training actually closed the gap. The standard requires action that is effective, not action that is merely documented.

Auditors will look for evidence that when gaps were identified, the organisation thought carefully about the right response and then checked whether it worked. A corrective action that reads booked employee in for refresher training without any follow up evaluation of effectiveness is incomplete. The loop needs to be closed.

Retaining Documented Information as Evidence

The fourth requirement is to retain documented information as evidence of competence. This is the part most organisations focus on, often at the expense of the other three. Records are important, but they are evidence of competence, not competence itself.

What counts as documented evidence? The standard does not prescribe a format. Common examples include training certificates, records of completed inductions, competence assessment results, records of experience verified during recruitment, supervisor assessments, and licences or registrations relevant to the role.

The records need to be retrievable and current. An expired licence does not demonstrate current competence. A training record from ten years ago for a role that has since changed may not be sufficient. When auditors ask for evidence of competence, they are looking for records that are relevant, current, and actually linked to the specific competence requirements of the role.

Common Nonconformities Auditors Raise Against Clause 7.2

Having conducted hundreds of external certification audits, the following patterns come up repeatedly. Understanding them helps you avoid them.

No Defined Competence Requirements for Key Roles

The organisation has training records but has never formally documented what competence is required for each quality critical role. When asked what competence a production operator needs, the answer is vague or inconsistent. Without defined requirements, you cannot demonstrate that people meet them.

Training Records That Are Incomplete or Out of Date

Records exist but they are incomplete. Some staff have records, others do not. Mandatory training has lapsed and nobody noticed. Contractors are not included. The training register has not been updated since the last audit. These gaps are straightforward to find and straightforward to raise.

No Evaluation of Training Effectiveness

The organisation trains people and records it, but never checks whether the training made a difference. When asked how they know the training was effective, the answer is that people attended. Attendance is not effectiveness. The organisation needs some mechanism, however simple, for confirming that training produced the intended competence.

Competence Requirements Not Updated When Roles Change

Processes change, equipment changes, regulatory requirements change, but the competence requirements for roles are not reviewed. People are signed off as competent against outdated criteria. This is particularly common in organisations that have grown quickly or undergone significant operational changes.

Contractors and Temporary Workers Excluded

The organisation has good records for permanent employees but has not considered contractors or labour hire workers performing quality critical tasks. If those workers affect quality performance, they are in scope. Leaving them out is a gap.

What Auditors Actually Check During a Clause 7.2 Audit

When an auditor sits down to audit Clause 7.2, they are not just looking for a training register. Here is a realistic picture of what a thorough audit of this clause involves.

The auditor will start by identifying which roles are quality critical. They will then ask to see the defined competence requirements for those roles. They will compare the requirements against the people currently in those roles and ask for evidence that each person meets the requirements. They will probe how the organisation identified any gaps, what action was taken, and how effectiveness was evaluated.

They will also ask questions of the people themselves. Walking the floor and asking operators what training they have received, whether they feel confident in their role, and what they do when they are unsure about something gives auditors a much richer picture than a document review alone. If the paperwork says everyone is trained but the operator cannot describe the procedure they are supposedly trained on, that is a problem.

If you want a deeper look at what auditors examine when reviewing competence records, the article on How to Audit Competence Records Under Clause 7.2 covers the audit evidence gathering process in detail.

Building a Competence Management System That Satisfies Clause 7.2

Start With a Competence Matrix

A competence matrix is one of the most practical tools for managing Clause 7.2. It maps roles against required competencies and records each person's current status against each competency. At a glance, it shows where gaps exist, where training is due, and where evidence needs to be updated.

The matrix does not need to be sophisticated. A well maintained spreadsheet is entirely adequate. What matters is that it is kept current, that it reflects actual competence requirements rather than generic training topics, and that it is used as a live management tool rather than a document produced for audits and then forgotten.

Link Competence Requirements to Process Risks

Competence requirements should reflect the risks associated with each role. A quality critical role with high consequence of error needs more rigorous competence management than a role with low impact on quality outcomes. Organisations that apply a risk based approach to competence management are better placed to demonstrate that their system is proportionate and effective.

This connects directly to the broader risk based thinking required by ISO 9001 Clause 6.1. If your risk register identifies certain processes as high risk, the competence requirements for people operating those processes should reflect that risk level.

Make Effectiveness Evaluation Practical

Evaluating training effectiveness does not require a formal assessment for every course. For many training activities, a supervisor observation or a short on the job check is sufficient. For higher risk competencies, a more structured assessment may be appropriate.

The key is to close the loop. After training, someone with authority should confirm that the intended competence has been achieved. That confirmation should be recorded. It does not need to be elaborate. A supervisor sign off on a competence checklist is often enough.

Review Competence Requirements Regularly

Build a review of competence requirements into your management review agenda or your internal audit programme. When processes change, when new equipment is introduced, or when regulatory requirements shift, competence requirements should be reviewed and updated accordingly.

For practical guidance on how internal audits should be structured and scheduled, the article on ISO 9001 Internal Audit: A Step by Step Guide is worth reading alongside this one.

Clause 7.2 in the Context of ISO 9001:2026

The upcoming revision of ISO 9001 is expected to bring some changes to how competence is framed, with increased attention on the competence needed to manage risks and opportunities, and potentially greater emphasis on evaluating the effectiveness of actions taken to address competence gaps. The core intent of Clause 7.2 is unlikely to change significantly, but organisations should be prepared for auditors to probe effectiveness more rigorously under the revised standard.

If you are tracking the ISO 9001:2026 revision, the article on ISO 9001:2026 Revision: What Is Changing and When provides a current summary of what to expect.

Clause 7.2 for Internal Auditors: Practical Audit Questions

If you are preparing to audit Clause 7.2 internally, the following questions will help you gather meaningful evidence.

• Which roles in this area affect quality performance?
• What competence is required for each of those roles, and where is that documented?
• Can you show me the evidence of competence for the people currently in those roles?
• Have any competence gaps been identified in the past twelve months? What action was taken?
• How do you evaluate whether training has been effective?
• Are contractors or temporary workers performing quality critical work? How is their competence managed?
• When did you last review the competence requirements for this role? Have the requirements changed?

These questions move beyond the training register and get to the substance of whether the organisation is genuinely managing competence or simply documenting it. For a broader view of common gaps across Clause 7, the article on Common ISO 9001 Clause 7 Nonconformities Auditors Keep Finding is a useful reference.

Summary

ISO 9001 Clause 7.2 is not complicated in concept. Determine what competence is needed, make sure people have it, act when they do not, and keep evidence. The difficulty lies in moving from paperwork compliance to genuine competence management. Organisations that get this right treat competence as a live operational concern, not a documentation exercise. Auditors notice the difference.

If you want to build the skills to audit clauses like 7.2 with confidence, Audit Workshop offers practical ISO 9001 Internal Auditor and Lead Auditor training that covers exactly this kind of clause level analysis. The training is grounded in real audit practice, not just theory, and is available in both live and self paced formats to suit your schedule.