Introduction
Clause 7.2 of ISO 9001 is often mistaken for a training mandate. It isn't. The clause is about competence: proving that people can actually do the quality-affecting work assigned to them.
That distinction trips up a lot of manufacturers. Many walk into an audit with attendance sheets, signed certificates, and a tidy training matrix, then freeze when an auditor asks how they know an inspector can catch a defect or a buyer can vet a supplier.
A sign-in sheet proves someone sat in a room. It does not prove they can apply what they heard.
This article breaks down what Clause 7.2(a) through (d) actually requires, what evidence auditors expect to see, how to build a process that produces that evidence continuously, and whether ISO 9001 specifies any training hours or costs. Spoiler: it doesn't.
Key Takeaways
- Clause 7.2 requires determining competence, ensuring it, closing gaps, evaluating results, and keeping records
- ISO 9001 sets no required training format, curriculum, or hour count
- A certificate alone is weaker proof than role requirements plus action plus a verified result
- Training must match the specific risks of the role, not a one-size-fits-all course
- Auditors trace evidence chains, not attendance counts
What ISO 9001 Clause 7.2 Requires
Clause 7.2 covers anyone whose work affects the quality management system's performance, including employees, contractors, temporary staff, and people working under the organization's control. The requirement breaks into four connected parts.
| Subclause | What it requires |
|---|---|
| 7.2(a) | Determine the competence needed for the role |
| 7.2(b) | Ensure the person actually has it |
| 7.2(c) | Act when there's a gap, then evaluate the action |
| 7.2(d) | Retain documented evidence |
This four-part structure comes directly from the standard, as reproduced in DNV's competence guidance. Notice what's missing: no mandated course length, no specified curriculum, no delivery format.
Determining and ensuring competence
Clause 7.2(a) asks the organization to figure out what competence a role actually needs, based on:
- Education and prior training
- Required skills and hands-on experience
- Legal and customer requirements
- Process risk (a high-risk inspection role needs more than a low-risk clerical one)
Clause 7.2(b) then asks the organization to confirm the person has it, through some mix of education, training, experience, supervised work, licensing, or demonstrated performance.
Competence is formally defined as the ability to apply knowledge and skills to achieve intended results, a phrase pulled directly from ISO's auditing practices group. Applying is the operative word. Attending a webinar doesn't satisfy it by itself.
Closing gaps and retaining proof
Clause 7.2(c) covers what happens when someone doesn't yet meet the bar: training, mentoring, coaching, reassignment, or hiring someone who already qualifies. The organization then has to evaluate whether that action actually worked.
Clause 7.2(d) closes the loop by requiring retained documented evidence. The standard doesn't dictate which records to keep. It expects the organization to decide what's proportionate to its own risk and activities.
How to Demonstrate Competence With Audit-Ready Evidence
Here's where most QMS programs fall apart. They have training records but no chain connecting a role's requirements to a documented competence decision.
Building the evidence chain
A defensible competence file links five things together:
- Role requirement - job description or role profile stating what the position demands
- Required skills - the specific technical or procedural abilities needed
- Applicable procedures - the work instructions governing the task
- Training or other action - what was done to build the capability
- Acceptance criteria - how success was defined before the action started
That chain looks different depending on the role:
- Machine operator: qualification record plus supervised observation sign-off
- Inspector: authorization record tied to passed test results
- Buyer: training on supplier controls plus evidence of applying a supplier audit checklist
- Internal auditor: training record plus a witnessed audit with documented performance
Why a matrix isn't enough on its own
A training matrix is useful for tracking status at a glance. It becomes a liability when it's the only piece of evidence on file. NQA's implementation guidance points to observations, appraisals, work samples, and formal testing as the kind of assessment evidence that should sit behind every matrix entry.
Useful records to retain include:
- Job descriptions and résumés
- Licenses, certificates, and attendance logs
- Training content and exam results
- Mentoring and supervised-work sign-offs
- Qualification approvals and observation checklists
- Documented effectiveness evaluations
Evidence also has to move with the person. Role changes, expired credentials, new equipment, and transfers between departments all trigger a fresh look.
An auditor should be able to pick one inspector at random and trace them from a defined competence requirement through training and supervised work to an effectiveness check and a signed qualification record. If that trail has gaps, it reads as unproven competence regardless of how many certificates are on file.
This is the gap QMS Learning's General Manufacturing Quality pathway was built around. It pairs role-based online lessons with a Manager Dashboard that shows completion status, capability gaps, and completed scenario logs for each team member.
That data exports into a single Audit-Evidence Package. It organizes the chain; it doesn't replace the organization's job of deciding what competence each role actually needs.
How to Build and Maintain a Clause 7.2 Training Process
A sustainable Clause 7.2 process starts before anyone signs up for a course.
Assess, plan, and act
Start with a role-based competence assessment: list every QMS-relevant role, define what each one requires, compare that against current capability, and prioritize the gaps that carry the highest product, process, or compliance risk.
From there, build a plan that treats these as distinct stages, not interchangeable steps:
- Awareness (knowing the policy exists)
- Knowledge-building (understanding the method)
- Supervised practice (applying it with oversight)
- Formal qualification (independent sign-off)
- Periodic reassessment (confirming it sticks)
A line operator and an internal auditor shouldn't get the same training path. Their risk exposure and required depth of judgment aren't comparable.
For each gap, choose the right action: internal instruction, external training, mentoring, job shadowing, hands-on demonstration, reassignment, or recruitment. Document why that specific action fits the gap.
Define effectiveness before you act
Set the success criteria before the training happens, not after. Examples include a passed written assessment, error-free supervised performance over a defined period, an approved work sample, or sustained process results over several audit cycles.
Review the file again when:
- A new hire joins or someone changes roles
- Equipment or a process changes
- Customer requirements shift
- A nonconformity or recurring error points back to a skill gap
- A qualification expires
Managers should check the matrix and effectiveness results during management reviews, internal audits, and corrective action follow-up, not just once a year.
The sequence, in order:
- Determine competence
- Identify gaps
- Assign action
- Verify effectiveness
- Retain evidence
- Reassess when conditions change
QMS Learning's ISO 9001 Internal Auditor course builds this sequence into the role itself, running 16 hours across 35 lessons and 27 interactive scenarios covering every ISO 9001:2015 clause, risk-based thinking, and nonconformity writing.
Common Clause 7.2 Mistakes and Auditor Questions
Most Clause 7.2 findings trace back to a handful of recurring weaknesses:
- Treating attendance as proof of competence
- Using one generic ISO overview for every role regardless of risk
- Never defining what the role actually requires in the first place
- Letting the training matrix go stale after role or process changes
- Filing certificates with no effectiveness evidence behind them
An auditor sampling your QMS will typically ask:
- What competence does this role require?
- How did you determine that?
- How was this person qualified?
- What happened when a gap was found?
- How did you verify the action actually worked?
If an employee learned the job through years of hands-on experience rather than a formal course, that's fine. You still need a paper trail:
- Documented role requirements
- Evidence of prior experience
- Supervised-work or observation records
- A formal competence approval signed by someone with authority to make that call
Separate Clause 7.2 from Clause 7.3. Competence is about applied ability. Awareness is about whether employees understand the quality policy, relevant objectives, their contribution to it, and the consequences of nonconformance. Both matter, and auditors check for both, but one doesn't substitute for the other.
If you're unsure where your gaps sit, run an honest gap review before the audit. Don't backfill records retroactively or claim competence you can't support with objective evidence. That approach rarely survives a close reading.
Frequently Asked Questions
Does ISO 9001 require training?
No. Clause 7.2 requires the organization to ensure necessary competence and act when gaps exist. Training is one possible action among several, including mentoring, reassignment, or hiring someone already qualified.
How many hours of ISO 9001 training are required?
The standard sets no universal hour count. The organization determines sufficient training or other action based on the role's requirements, risk level, complexity, and demonstrated competence afterward.
How much does ISO 9001 training cost?
Cost varies by learner count, delivery method, course depth, and whether evidence-management features are included. Internal versus external delivery also shifts the price significantly, so there's no fixed industry figure.
What records are needed to demonstrate competence under ISO 9001?
Useful records include documented competence requirements, training or qualification records, certificates, assessments, supervised-work sign-offs, observation notes, and effectiveness evaluations tied to the specific role.
How do you evaluate the effectiveness of ISO 9001 training?
Measure it against the intended competence outcome, not course completion. Use a passed assessment, observed performance, a work sample, qualification sign-off, or sustained results data as proof.