In short
Clauses 7.2 and 7.3 of the harmonized structure are identical in ISO 9001, 14001, 27001, 45001 and the other management system standards.
Competence is the ability to apply knowledge and skills: a certificate of attendance alone does not prove it.
Training is only one possible action: the standard also mentions mentoring, re-assignment, hiring and contracting.
Every action should be followed by a proportionate effectiveness check, such as on-the-job observation, a practical test or a review of results.
Awareness is demonstrated mainly at interview: people must know the policy, their own contribution and the consequences of mistakes.
Rules that nobody knows protect nobody. You can have flawless procedures, a policy signed by top management and a tidy manual, but if the people on the shop floor do not know what to do and why, the management system stays on paper. That is why every ISO management system standard devotes two requirements to people: competence and awareness, in clauses 7.2 and 7.3.
In this guide we look at exactly what those clauses require, how competence, training and awareness differ, and how to demonstrate them at audit with evidence proportionate to your organisation. You will find an example competence matrix for an SME, methods for evaluating training effectiveness, the questions an auditor really asks people and the mistakes that generate the most findings. The starting point is simple: the standard does not ask for certificates of attendance, it asks for people able to do their job in a conforming way. If you need a refresher on how certification works first, start with our guide on what ISO certifications are.
What do ISO standards require on competence and awareness?
ISO management system standards require you to determine, ensure and demonstrate people's competence, and to make them aware of their role in the system. The requirements are identical in ISO 9001, ISO 14001, ISO 27001, ISO 45001 and the other management system standards.
The reason is the harmonized structure, the common text that ISO mandates for all management system standards (in the ISO Directives it is Annex SL, Appendix 2). Same clause numbers, same titles, same core text: each standard then adds its own discipline (quality, environment, information security) and may add specific requirements. UNI, the Italian standards body, has published an Italian translation with guidance for use, and that is the source we start from. The harmonized structure defines competence as the ability to apply knowledge and skills to achieve intended results. Knowing is not enough: you have to be able to apply it.
Clause 7.2: the four commitments on competence
Clause 7.2 asks the organisation for four things. The first is to determine the necessary competence of persons doing work under its control that affects the performance of the system. The second is to ensure that these persons are competent on the basis of appropriate education, training or experience.
The third, where applicable, is to take actions to acquire the missing competence and evaluate the effectiveness of those actions. The fourth is to make appropriate documented information available as evidence of competence. A note to the clause lists example actions: providing training, mentoring, re-assigning people already employed, or hiring or contracting competent persons. Training, then, is one tool among many, not the requirement itself.
Clause 7.3: the three things every person must know
Clause 7.3 concerns everyone doing work under the organisation's control. Each person must be aware of three things: the management system policy, their own contribution to the effectiveness of the system (including the benefits of improved performance) and the implications of not conforming with its requirements.
The UNI guide to the harmonized structure adds that individual standards may extend this list, for example with the system's objectives, exposure to risk or expected behaviours. It also recommends not mixing awareness requirements with competence requirements: they are two different things and need to be managed differently. So when you read the standard you are implementing, always check whether its clause 7.3 contains items beyond the common text.
Competence, training and awareness: what is the difference?
Competence, training and awareness are three distinct concepts. Confusing them is the most common cause of a system that looks compliant on paper but does not stand up to an auditor's questions.
Competence is an outcome: the person can do the job and shows it. Training is one of the means of getting there, together with experience, coaching and recruitment. Awareness is something else again: it is about the why, meaning knowing what your work is for within the system and what happens if you get it wrong. A welder can be highly competent and not know there is a quality policy; a new starter can know the policy by heart and still not be able to handle an inspection alone.
Concept | Question it answers | Example of evidence |
|---|---|---|
Competence (7.2) | Can the person do the required job? | Role requirements, on-the-job assessment, mandatory qualifications |
Training (a 7.2 tool) | How do we close a competence gap? | Training plan, attendance register, effectiveness check |
Awareness (7.3) | Does the person know why their work matters and what is at stake? | Induction, internal communications, consistent answers at interview |
Keeping the three apart helps you choose the right evidence. A certificate of attendance documents a training action, not a competence. A signature under the policy documents distribution, not genuine awareness. Auditors know this, which is why they verify mainly by talking to people.
How do you determine the competence needed?
You start from the roles that affect the system's performance, not from the full organisation chart. For each one, you write down what the person in it must be able to do, with an expected level and, where applicable, mandatory qualifications.
The ISO and IAF guidance for ISO 9001 auditors on competence is clear on one point: the way required competence is documented varies widely. It ranges from a competence database or formal job descriptions to a simple verbal explanation for a simple task. What matters is that the method is systematic and takes account of change: a new machine, a new contract, new software, a new process or a new customer with particular requirements can all create new competence needs to manage.
Start from the roles that affect the system
Not all activities carry the same weight. Focus where a mistake has consequences for the customer, legal compliance, safety or data. In a manufacturing SME these are typically final inspection, welding, complaint handling and purchasing of critical components; in an IT services company, system administration, access management and customer support.
For each key role, write three or four observable competences, not generic ones. "Knowledge of quality" cannot be checked; "can complete and close a nonconformity report" can. Add qualifications required by law or by contract where they exist, such as licences, authorisations or personal certifications, with their expiry dates.
Example: the competence matrix of a 40-person company
Take a metal fabrication company with 40 employees, certified to ISO 9001 and working towards ISO 45001. Instead of a job description for each person, it builds a competence matrix: rows are people, columns are critical competences, and each cell shows the level reached.
Competence | Required level | Mario (supervisor) | Luca (welder) | Sara (quality) |
|---|---|---|---|---|
Welding to a qualified procedure | Independent | Independent | Independent | Not required |
Dimensional inspection at end of process | Independent | Independent | In training | Can teach |
Handling a nonconformity | Independent | Independent | Basic | Can teach |
Overhead crane operation | Authorised | Authorised | Authorised | Not required |
The matrix immediately shows two things that a list of certificates does not. Luca is not yet independent on dimensional inspection, so an action is needed. And only Sara can teach nonconformity handling: if she is away for a long time, the company has a single point of failure. The ISO and IAF auditor guidance specifically mentions cross-training charts among useful evidence, because they help mitigate the risks of staff absence.
What actions close a competence gap?
The right action depends on the gap, and classroom training is only one option. The note to clause 7.2 explicitly mentions mentoring, re-assignment, hiring and contracting alongside training.
Back to the example. For Luca, the most effective solution is not a course but a defined period working alongside Mario, with spot checks on the parts he inspects. For the risk linked to Sara's absence, the company can train a second person in the technical office. If tomorrow it needed a competence nobody has, such as running a new painting line, it might make more sense to hire or to contract the activity to a qualified supplier.
Plan without bureaucracy
A training plan is there to line up actions, not to fill a binder. For each gap you only need who, what, by when and how the result will be checked. Include the expiry dates of mandatory qualifications too, because an expired licence is one of the easiest findings to avoid.
Include in the plan the events that change required competence: new hires, changes of role, new machinery, new versions of a procedure. The ISO and IAF guidance notes that corrective actions often reveal a training need. If the cause of a nonconformity is "operator not trained", the plan must be updated, and the same applies to the results of internal audits.
How do you evaluate training effectiveness?
You evaluate it by looking at whether the person applies what they learned, not whether they attended. The ISO and IAF auditor guidance says so explicitly: attending a course shows at most that knowledge was gained, not that it is being applied effectively.
Evaluation methods should be chosen according to the type of competence. The guidance mentions on-the-job observation, review of task and project results, tests, role play, peer review, interviews and review of records. For a practical competence, such as welding or inspection, observation is almost always the most robust method. For a knowledge competence, such as information classification rules, a short test followed by a spot check a few weeks later may be enough.
Practical examples of effectiveness checks
For a course on nonconformity handling, the check can be a review of the first three reports the person completes after the course. For coaching on dimensional inspection, the supervisor can observe ten inspections and sign off the move to "independent". For an information security session, a good indicator is how people react to a simulated suspicious email.
The end-of-course satisfaction questionnaire is not an effectiveness check: it measures participant satisfaction, not competence. You can keep it, but do not present it as evidence for requirement 7.2. And decide in advance when to check: straight after the course you measure memory, after a few weeks of work you measure application.
What evidence should you keep for the audit?
The standard asks for "appropriate" documented information as evidence of competence. The word "appropriate" leaves room: you decide which records have value, in proportion to your organisation's size, complexity and risks.
The ISO and IAF guidance lists examples of useful evidence: identification of training needs, training plans and records, effectiveness evaluation records, induction material for new starters and role changes, cross-training charts, reminders for qualification renewals, agreements giving access to external competence. To show that a person is competent, qualifications, licences, CVs and performance reviews are also used. You do not need all of them: you need the ones that demonstrate your method.
The minimum file for each key role
For each person in a key role, an essential file contains four elements: the competence required by the role, evidence of how they were judged competent, the actions taken to close any gaps with the related check, and mandatory qualifications with expiry dates. Everything else is optional.
The real problem in SMEs is usually not a lack of evidence, but its scattering across folders, emails and different offices. On audit day someone looks for the certificate of a course from two years ago and cannot find it. To see how to organise documents and records without weighing the system down, read our guide on documented information in ISO standards. The same rules apply to evidence of competence.
How do you demonstrate awareness at audit?
Awareness is demonstrated mainly through people's answers. The auditor picks a sample of people in different departments and asks them, in plain words, what they do, why, and what happens if they get it wrong.
A policy pinned on the noticeboard or signed by everyone is not enough if, asked "what is your check for?", the operator answers "I was told to do it". People do not need to recite the policy by heart: they need to grasp its meaning and link it to their own work. An aware warehouse operative knows that a wrong label can send a nonconforming batch to the customer. An aware administrative employee knows why she must not open an unexpected attachment, even if it comes from a known supplier.
The questions an auditor really asks
The typical questions are few and concrete. Prepare people to answer in their own words, not with memorised phrases.
What is your role and what do you do every day?
What, in essence, does the company's quality, environmental or safety policy say?
How does your work contribute to the company's objectives?
What happens if a procedure is not followed in your department?
Who do you go to if you spot a problem or a nonconformity?
Short, recurring tools work best for building this awareness: a structured induction for every new starter, a team meeting when a procedure changes, sharing results against objectives, a real case discussed together after a nonconformity. Each occasion can leave a simple record, such as a brief note with date and attendees.
Contractors and suppliers: are they covered by the requirements?
Yes, if they work under the organisation's control and affect the system's performance. Clauses 7.2 and 7.3 refer to persons under the control of the organisation, not just employees.
This covers agency workers, interns, regular contractors, consultants working inside your processes and, in many cases, a supplier's staff working on your premises. The ISO and IAF guidance notes that people under the organisation's control may include individuals at providers of externally provided processes, products and services. Think of a maintenance firm working on your plant or an IT provider administering your servers.
For suppliers the main lever is qualification: define the required competence or qualifications in the contract or order and verify them before assigning the work. For induction, a short briefing on arrival covering rules, risks and contacts takes care of awareness. We cover how to qualify and monitor the people who work for you in our guide on ISO supplier evaluation.
What are the most common mistakes on competence and training?
The most frequent mistakes come from treating training as a box-ticking exercise to be filed away. These are the ones we see most often in SMEs, and they generate avoidable findings.
Certificates instead of competence: the file is full of courses, but nobody has written down what each role must be able to do.
No effectiveness check, or only the satisfaction questionnaire.
Expired mandatory qualifications, because nobody keeps an up-to-date schedule.
New starters and role changes without documented coaching.
Critical competences concentrated in one person, with no back-up.
Awareness reduced to signing the policy, with no moments of discussion with people.
Contractors and suppliers forgotten, even when they work on critical processes.
Almost all of these mistakes share the same root: information about people is scattered and nobody looks at it as a whole. An up-to-date competence matrix, a qualification schedule and a training plan linked to audits and nonconformities solve most of the problems. If you are building the system from scratch, our guide on the ISO 9001 quality management system helps you place training within the bigger picture.
ISO 10015: what is it for and when should you use it?
ISO 10015 is a guidance standard on competence management and people development. It is not certifiable and adds no requirements: it helps you build a more mature method.
ISO 10015 provides guidelines for establishing, implementing, maintaining and improving systems for competence management and people development, with the aim of positively affecting the conformity of products and services and the needs of interested parties. It describes a path that starts from determining competence needs, moves through assessing current competence and development needs, and arrives at overall competence management. The UNI guide to the harmonized structure points to it as a reference for anyone wanting to go deeper into clause 7.2.
The ISO and IAF auditor guidance states that ISO 10015 is not an audit criterion for ISO 9001 certification. You can use it as a source of good practice, for example to structure development reviews or link competence to company objectives. But no auditor can raise a finding because you do not apply it. For an SME starting from scratch, the priority remains meeting 7.2 and 7.3 well; ISO 10015 becomes useful when you want to develop people in a planned way.
How Complaion helps you manage competence and training
With Complaion, competence, training and awareness stop living in scattered files. A dedicated Lead Auditor supports your organisation and helps you define the competence of key roles, set up the training plan and choose proportionate effectiveness checks.
The platform gathers evidence and documents in one place, keeps the schedule of training and qualifications, lets you assign courses and prepares the audit with everything already in order. The Lead Auditor assesses your organisation's context and proposes the path best suited to your needs, across one or more standards. More than 1,000 clients have already chosen this model to achieve and maintain their certifications. If you want to see how it applies to your organisation, get in touch for an initial assessment and a tailored quote.
Frequently asked questions on ISO competence, training and awareness
What is the difference between clause 7.2 and clause 7.3?
Clause 7.2 is about competence: determining what people must be able to do, making sure they can do it and closing the gaps. Clause 7.3 is about awareness: every person must know the system policy, their own contribution and the consequences of not conforming with its requirements. The first is about the "how", the second about the "why". At audit, competence is checked through records and observation, awareness mainly at interview.
Is a certificate of attendance enough as evidence of competence?
No, a certificate shows that the person attended a course, not that they can apply what they learned. According to the ISO and IAF auditor guidance, attendance shows at most that knowledge was gained. You also need an effectiveness check, for example on-the-job observation, a practical test or a review of results. The certificate is still useful as part of the file.
Do you need a written job description for every employee?
Not necessarily. The standard requires you to determine the necessary competence, but leaves the format open: job descriptions, a competence matrix or, for simple tasks, lighter instructions. In an SME a well-built competence matrix often covers every role in a single document. What matters is that competences are observable and kept up to date.
How often should training be updated?
The standard does not set a single frequency. Competence should be reviewed whenever something changes: new hires, role changes, new machinery, new procedures, new risks or the results of audits and nonconformities. Qualifications required by law or contract follow the expiry dates set by whoever issues them. A periodic review of the matrix, for example at management review, helps you miss nothing.
Do contractors need the same training as employees?
The requirements apply to everyone doing work under the organisation's control that affects the system's performance, so also agency workers, interns and regular contractors. For suppliers' staff, the main lever is qualification: define the required competence in the contract and verify it. Awareness is covered with a short arrival briefing on rules, risks and contacts.
Is ISO 10015 mandatory for certification?
No. ISO 10015 contains guidelines on competence management and people development and is not a certifiable standard. The ISO and IAF auditor guidance states that it should not be used as an audit criterion in ISO 9001 certification. It can, however, be a good source of practices for managing people in a more mature way.
How does the auditor tell whether people are aware?
By interviewing them. The auditor picks a sample of people in different departments and asks what work they do, what it is for, how it contributes to objectives and what happens if a procedure is not followed. They do not expect memorised answers, but consistent answers that reflect the policy and the real work. If the answers are vague, a finding on clause 7.3 is likely.
