Training Records and Employee Competence in ISO 9001: What the Standard Actually Requires

2026-10-04

Executive Summary

• Training and competence are different things. An attendance sheet shows a class took place; it doesn’t show the person can do the job.
• Clause 7.2 of ISO 9001:2015 asks the organization to determine necessary competence, ensure people are competent (on the basis of appropriate education, training or experience), take action where needed and evaluate the effectiveness of that action, and retain evidence of competence.
• Common problems: training records not tied to job roles, not tied to the current SOP revision, and with no effectiveness evaluation.
• The most real form of competence, a veteran’s judgment in unusual situations, usually sits in no record at all.
• An eQMS helps link training to roles and processes, but it doesn’t assess competence itself and doesn’t capture tacit knowledge.

Records complete — but can this person do the job?

An auditor opens the training file of a machine operator. There are attendance records for “Food Safety” and “Equipment Operating Instructions.” Signatures, dates. The file is complete.

The auditor asks: “How do you carry out this step?” The operator answers in a way quite different from the released instruction. Asked why, they say that’s how the previous operator showed them.

The record says training happened. Reality suggests competence may not be there, or at least not to the required standard. The gap between those two is what this article is about.

Competence versus training: two different things

In daily operations, people use “training” and “competence” interchangeably. ISO 9001 distinguishes them.

Training is an activity: a class, on-the-job instruction, self-study material, mentoring. It is a means of reaching competence.

Competence is an outcome: the person has the knowledge, skill and (where relevant) authority to do the work to requirement.

Someone can have attended every training session and still lack competence, if the content wasn’t suitable or they haven’t practiced enough. Conversely, someone with years of experience may be highly skilled without a single training record for that job. The standard cares about the outcome, not just the means.

What clause 7.2 requires

The statements below are based on ISO 9001:2015, clause 7.2 (Competence), summarized in practical terms. The organization must:

• determine the necessary competence of persons doing work under its control that affects the performance and effectiveness of the quality management system;
• ensure these persons are competent on the basis of appropriate education, training or experience;
• where applicable, take actions to acquire the necessary competence, and evaluate the effectiveness of those actions;
• retain appropriate documented information as evidence of competence.

The standard also notes that actions can include training, mentoring, re-assignment of current employees, or hiring or contracting competent people.

Three points stand out on a careful read.

First, competence can be reached by several routes: education, training or experience. Not every competence needs a course. What matters is a sound basis for confirming the person is competent.

Second, evaluating the effectiveness of action is a separate requirement. Not just “was training given” but “did the training work.”

Third, the scope is “persons doing work under the organization’s control,” not just permanent staff. Temporary workers and contracted personnel working on your floor fall within it when their work affects quality.

Related clauses: 7.3 asks for people’s awareness of the quality policy, objectives, their own contribution and the implications of not conforming. Clause 7.1.6 on organizational knowledge is also relevant, since the standard acknowledges that knowledge can come from experience that hasn’t been written down. Both clauses should be checked against the official text when applying them.

Training records versus evidence of competence

From clause 7.2, you can see the difference between two kinds of evidence.

A training record tells you who attended, when, on what content, who delivered it. It is evidence that training took place.

Evidence of competence tells you what the person can do, confirmed by whom and how. For example:

• a supervisor observes and confirms the person performs a task correctly;
• a practical or written assessment with a result;
• a number of batches produced by that person meeting requirements;
• a valid professional certificate;
• evidence of experience for a specific position.

The effectiveness of training also has to be evaluated in a suitable way. A survey asking “were you satisfied with the course?” measures satisfaction, not competence. On-the-job observation, practical tests and tracking the quality of the person’s output after training are closer reflections.

On level of detail: clause 7.2 asks for appropriate evidence, and the standard says the extent of documented information depends on size, complexity and people’s competence. For a low-risk position, a brief supervisor sign-off may be enough. For a critical step affecting product safety or quality, evidence needs to be firmer. For companies subject to further requirements from GMP, HACCP or customers, check those requirements beyond ISO 9001.

A practical note: personnel records hold personal data, so storage and access should follow the data protection rules that apply where the company operates.

Linking training to process and role

This is where many training systems break: records exist, but they’re not connected to roles, processes and document versions.

Across many manufacturing operations, six problems come up frequently. (A general observation, not measured figures.)

1. Training tied to people, not to roles. Without a definition of the competence needed for each role, there’s no basis for knowing whether a person is yet sufficient.

2. Not tied to SOP revision. A person was trained on revision 3; the procedure is now revision 5. Nobody knows who hasn’t been updated.

3. Only certificates and attendance sheets kept. No evidence the person can perform the work.

4. No effectiveness evaluation. Training done means closed.

5. Training spread too thin. Everyone is trained on everything “to be safe,” consuming time without matching the role’s need.

6. Temporary and contracted staff missed. They work on the floor but aren’t in the training system.

A structural fix is a simple competence matrix: for each role or step, define the competence needed, how it’s confirmed (observation, test, experience), and each person’s current status. It lets you answer quickly: who is competent to do this step, who needs training, whose certification is about to expire?

Three events should trigger a review of training: a change to a document or process (see Document Control in eQMS), a root cause analysis of a nonconformity pointing to competence (see Effective CAPA), and a change of role or equipment.

Illustrative example (a composite scenario, not a real customer case): a food plant has complete training records for every operator. When an equipment cleaning instruction is revised, the quality team releases the new version, but there’s no way to know exactly who has been trained on it. A new hire learns by standing beside a veteran and copies how that person works, which differs from the written instruction. The records stay complete, but real practice has drifted.

Tacit competence: the part no record captures

There’s a part of competence that training records, however good, cannot capture: the experience of long-serving people in handling unusual situations.

An operator with ten years on a machine knows which sound signals trouble, and when a setting that is “right per the instruction” still needs adjustment because of today’s humidity. These insights rarely sit in an SOP and almost never in a training record.

Clause 7.2 recognizes mentoring as one way of reaching competence, and clause 7.1.6 acknowledges that knowledge can come from undocumented experience. But without a deliberate way to capture this, the company depends on that person staying. When they leave, that competence leaves with them. This is where the quality system meets the problem of organizational knowledge, explored further in Tacit vs. Explicit Knowledge: Why the Distinction Matters and When Key Staff Leave, What Do They Take With Them?.

Training management in eQMS

To be clear first: an eQMS doesn’t assess competence for you, and it doesn’t capture tacit knowledge just by having a “training” screen.

What an eQMS changes is how much training management depends on spreadsheets and memory:

A competence matrix by role. Needed competence, who is competent and the gaps are managed in one system and can be queried fast.

Training tied to document changes. When an SOP changes revision, the system shows who needs retraining, assigns tasks and tracks completion. This answers “who was trained on which version” directly.

Expiry reminders. Certificates or authorizations with a validity period are tracked and flagged before they lapse.

Confirmed evidence. Assessment results (who observed, who confirmed, when) are recorded alongside the training record.

Link to nonconformities. When a root cause is competence, the related training requirement is created and tracked in the same flow.

What the system doesn’t do: decide what “competent” means for a step, observe the work in place of a supervisor, or turn a veteran’s experience into usable knowledge. Those remain human work.

A practical checklist

Use these questions to review how you currently manage training and competence.

1. Does each key role or step have a defined required competence?
2. Can you quickly answer: who is competent to do this step?
3. When an SOP changes revision, do you know who needs retraining and can you track completion?
4. Do records distinguish training that took place from competence that has been confirmed?
5. Do you evaluate effectiveness in ways that reflect competence (observation, practice, output results), not just satisfaction surveys?
6. Are time-limited certificates and authorizations tracked and flagged before expiry?
7. Are temporary and contracted staff working on the floor included in competence assessment?
8. Is the level of evidence proportionate to the risk of the step, avoiding too heavy for minor tasks and too light for critical ones?
9. Do root cause findings from nonconformities lead to a review of competence and training where needed?
10. Is there a deliberate way to capture the experience of long-serving people, not just relying on them staying?

If three or more answers are “no” or “not sure,” the issue likely lies in how competence is defined and confirmed, not in missing training forms.

A note on ISO 9001 editions

This article refers to ISO 9001:2015. According to certification bodies, a revised ISO 9001:2026 was scheduled for publication in September 2026, with a transition period expected to run about three years and 2015 certificates remaining valid during it. Clause structure and wording may change; check against the edition your organization is certified to.

Do your training records prove training happened, or that people are competent to do the work?

→ Take the Knowledge Management Maturity Assessment to identify your maturity level and the first improvement to make.

Further reading:

• Internal Audit in ISO 9001: Not an Exam — a Tool for Real Improvement (previous)
• Supplier Qualification in ISO 9001: What Goes Beyond the Approved List (next)
• When Key Staff Leave, What Do They Take With Them? (related)
• Tacit vs. Explicit Knowledge: Why the Distinction Matters (related)
• eQMS for Manufacturing SMEs: A Practical Guide (pillar)

Sources:

• ISO 9001:2015, clauses 7.2 (competence), 7.3 (awareness) and 7.1.6 (organizational knowledge): iso.org/standard/62085.html
• LRQA, ISO 9001 revision update: Publication date confirmed (certification body source; verify with ISO): lrqa.com

ISO 9001:2015 clauses are summarized in practical language and do not replace the text of the standard; compliance decisions should be checked against the official edition. The example is a composite illustrative scenario based on common patterns in manufacturing SMEs, not a specific customer case. The problems described are general observations, not measured figures. Practices such as a competence matrix are common approaches, not mandatory requirements of the standard.