That gap—between attending training and demonstrating competence—is exactly what ISO 9001 Clause 7.2 exists to close. It requires organizations to define what competence a role needs, confirm people actually have it, close any gaps, and keep evidence of the whole process.
Most quality teams run into the same obstacles: vague role requirements, training matrices that track attendance instead of capability, expired licenses nobody flagged, and no clear sense of what an auditor will ask to see.
This article breaks down the four parts of Clause 7.2, shows how to build a working competence process, explains which records actually count as evidence, and walks through how auditors trace that evidence back to real work.
Key Takeaways
- Clause 7.2 covers anyone whose work affects QMS performance, including contractors and temporary staff working under your control
- A certificate proves attendance, not job competence: auditors expect education, training, and experience combined with demonstrated results
- Evidence must show the competence decision, the action taken to close gaps, and whether that action worked
- Training records need to be current, traceable, and controlled, with clear links to defined role requirements
What ISO 9001 Clause 7.2 Requires
Clause 7.2 sits inside Clause 7, Support—the part of ISO 9001 covering resources, competence, awareness, communication, and documented information. Competence is the piece that connects everything else to actual work output. If the people doing the work aren't capable, the rest of the QMS is just paperwork.
The Four Requirements
Clause 7.2 breaks down into four connected steps:
- Determine necessary competence for each role, based on responsibilities, process risk, customer requirements, statutory obligations, special processes, and equipment
- Ensure people are competent, using an appropriate combination of education, training, or experience
- Take action where gaps exist, then evaluate whether that action actually worked
- Retain documented information as evidence of competence
Skip any one of these and the loop doesn't close. Identifying a gap and running a training session isn't enough without proof the person can now do the work.
Competence vs. Awareness vs. Attendance
ISO 9000:2015 defines competence as the ability to apply knowledge and skills to achieve intended results, a definition carried directly into ISO's auditing practices guidance. Attendance only confirms that an activity happened—it says nothing about whether the person can apply what they learned.
A technician who sat through a CAPA workshop hasn't demonstrated competence. A technician who closed three CAPAs with root causes that held up under audit has.
Who Counts as "Persons Under Your Control"
This scope is wider than payroll. It includes:
- Full-time and part-time employees
- Temporary and agency personnel
- Contractors working on-site under your processes
- Anyone else whose work can affect QMS performance
This overlaps with—but isn't the same as—external-provider controls under Clause 8.4. A contractor embedded in your production line raises person-level competence questions. A supplier managing its own independent process raises provider-qualification questions instead. Approving a supplier doesn't automatically prove any one of their people is competent.
How to Build a Clause 7.2 Competence and Training Process
A workable competence process has four stages, and skipping any of them is where most QMS programs fall apart.
Map Roles to Required Competence
Start with job descriptions and process maps, then translate them into specific competence criteria:
- What knowledge does this role require?
- What skills must be demonstrated, not just discussed?
- Are there qualification requirements (licenses, certifications, special-process approvals)?
- What's the documented criteria for authorizing someone to perform a critical task?
A skills matrix works well here, as long as it lists required competence, not just completed courses.
Assess Current Competence Honestly
Compare each person against the requirement using more than one input:
- Supervisor observation of actual work
- Practical demonstrations or examinations
- Review of work results and internal-audit findings
- Documented experience and prior qualification records
Close the Gap With the Right Action
Training isn't the only fix. Depending on the gap, the right action might be:
- Internal or external training
- Mentoring or supervised on-the-job practice
- Reassignment or additional education
- Recruitment or a contracted expert
QMS Learning's ISO 9001 pathway is one example of a targeted action. The 35-lesson internal auditor course is built around every clause, the process approach, and ISO 19011 audit principles. The pathway aims to get a team writing nonconformity statements with objective evidence within 30 days of rollout.
Evaluate Whether It Actually Worked
Satisfaction surveys answer the wrong question. Better evidence includes observed performance, test results, first-pass yield, process outcomes, or successful completion of supervised work.
NIST's 2025 case study on a Montana machining company found that targeted technical and supervisory training led to better quality-assurance decisions and fewer back-and-forth corrections between production and design teams. That is a useful illustration of effectiveness measured through work outcomes, not attendance.
Training Records and Audit Evidence: What to Retain
Auditors aren't looking for a folder of certificates. They're looking for a trail that connects a role's requirement to the person's current, verified capability.
Build One Audit Trail, Not Five Folders
A complete record links:
- The defined competence requirement
- The person or role affected
- Initial assessment results
- Action taken to close any gap
- Completion or qualification record
- Effectiveness evaluation
- Authorization status and any expiration date
Certificates Are Not Competence Records
A certificate shows someone finished a course. It doesn't show they're authorized to perform the related task. QMS Learning's own platform language is deliberate about this distinction: course completion is tracked and shown separately from licensing or accredited certification. The platform guidance is explicit that nobody should be labeled "authorized" without evidence to back it up.
A connected record (training completed, scenario work finished, assessment passed, authorization granted) is what actually holds up. The Manager Dashboard and Audit-Evidence Package are built around that idea: a single export combining training records by employee, completed scenario logs, and time-stamped activity.
That kind of export can make retrieval faster, but it doesn't replace the underlying competence decision. Software organizes evidence; it doesn't create it.
Handle Expiring Credentials Before They Expire
For licenses or certifications with renewal dates, track:
- Who owns the renewal
- When alerts fire before expiration
- Whether interim restrictions apply if a credential lapses
- Evidence that expired credentials aren't authorizing current work
Control Records Under Clause 7.5.3
Training and competence records are documented information, which means they need to be:
- Identifiable and retrievable by authorized users
- Protected from unintended change or loss
- Retained for an appropriate, defined period
- Archived or disposed of under defined controls
A Document Management System that preserves revision history and timestamps every acknowledgment can support this, but the control still has to be a deliberate management decision, not just a software default.
How Auditors Evaluate Clause 7.2 Evidence
Auditors typically start at the work output and trace backward: a released part, an approved inspection, a signed-off document. From there, they ask who performed, inspected, or approved it, then check that person's competence requirements and current evidence.
Expect questions like:
- What competence does this role require?
- How was this person qualified for it?
- What happened the last time a gap was identified here?
- How was training effectiveness verified?
A Practical Sampling Approach
ISO/IAF evidence guidance recommends collecting evidence across representative shifts, sites, and processes rather than sampling only from the training office. Apply that by checking:
- Roles that directly affect product or service quality
- Recently hired or transferred employees
- High-risk or specialized tasks
- Contractors and temporary workers
- Any credential carrying an expiry date
Build a clause-mapped evidence index ahead of time so records can be retrieved quickly, without creating duplicate files or depending on one person's memory. A controlled document system with clause-mapped linkages can speed up retrieval, but it's a convenience, not a substitute for the underlying competence evaluation.
Common Clause 7.2 Gaps and How to Correct Them
Some weaknesses show up repeatedly across audits:
| Common Gap | Why It Fails |
|---|---|
| Generic job descriptions | No specific competence criteria to assess against |
| Training matrix tracks completion only | No link to required competence or demonstrated capability |
| Missing contractor records | On-site contractors fall outside scope by accident |
| Expired licenses still authorizing work | No alert or interim restriction in place |
| No effectiveness evaluation | Training happened, but no one checked if it worked |
Responding When You Find a Gap
- Contain the risk: restrict or supervise any work performed without verified competence
- Document the issue clearly, including where and how it was found
- Assign and complete corrective action
- Reassess competence against the original requirement
- Evaluate effectiveness using more than attendance
- Update the role requirement or training control so it doesn't recur
A Pre-Audit Checklist
Before your next audit, confirm:
- Role requirements are current and specific
- Personnel records match active roles
- Open competence gaps have assigned owners
- Effectiveness checks exist for recent training
- Expiry dates are tracked with alerts
- Records are access-controlled
- Evidence can be retrieved without delay
Certification bodies sample differently, so treat this as a starting point rather than a guaranteed match to what your specific auditor will request.
From Training Completion to Demonstrated Capability
Clause 7.2 works best as a continual process, not an annual records cleanup before the audit. Teams that treat it as a once-a-year scramble tend to see the same nonconformities resurface year after year, with CAPAs closed on paper but never verified for effectiveness.
Annual classroom retraining (often $1,500 or more per seat once travel is factored in) can repeat the same gap without solving the underlying problem if it isn't paired with an effectiveness check.
Reliable competence management tends to show up elsewhere in the QMS: fewer repeat nonconformities, steadier process performance, and less dependence on one or two subject-matter experts who hold all the institutional knowledge.
Practical next steps look like this:
- List every role that affects QMS performance
- Define specific competence criteria for each
- Assess current gaps honestly
- Take the action that actually closes the gap
- Evaluate results with more than a satisfaction survey
- Control the records
- Test retrieval before your next audit, not during it
Frequently Asked Questions
What is Clause 7 in ISO 9001?
Clause 7, Support, covers resources, competence, awareness, communication, and documented information. Clause 7.2 is the competence requirement within that group, focused specifically on ensuring people have the ability to do their assigned work.
What does competence mean in audit?
Competence means the demonstrated ability to apply knowledge and skills to achieve intended results. It's supported by education, training, experience, and work evidence—not attendance records alone.
What does Clause 7.5.3 of ISO 9001:2015 address?
Clause 7.5.3 addresses control of documented information, including how records are made available, protected, distributed, accessed, retrieved, stored, retained, and eventually disposed of or archived.