ISO 9001 asks for evidence that training was effective. Most organisations are still supplying evidence that training happened.
Every certified manufacturer has training records. Attendance sheets, completion certificates, LMS export reports showing who finished which module and when.
Almost none of them have documented evidence that the training actually worked.
That distinction sounds pedantic until you read clause 7.2 of ISO 9001 closely. The standard doesn't just ask organisations to train people and record their attendance. It asks them to determine the competence required for each role, take action to close any gap, and retain documented information as evidence of competence.
If you've sat across from an auditor while they ask "how do you know this person is competent, not just trained," you already know how thin that evidence usually is.
Why This Gets Worse, Not Better, in 2026
The upcoming ISO 9001:2026 revision doesn't rewrite clause 7.2. But it raises the stakes around it.
The new edition strengthens leadership requirements to explicitly promote quality culture and ethical behaviour, and it expects organisations to demonstrate that culture through observed behaviour, not policy statements. Competence is the operational foundation that quality culture sits on. You cannot have a genuine quality culture built on people who completed a course without anyone verifying they understood it.
That makes the clause 7.2 gap more visible, not less. An organisation that can only point to attendance records now has a second, related exposure: no credible evidence its quality culture is anything more than a stated intention.
Why Training Findings Keep Recurring
Training and competence gaps are among the most common findings in ISO audits, year after year, across sectors. A few structural reasons explain why this particular gap is so persistent.
- Training is measured by completion, not comprehension. A learning management system tracks who started a module and who finished it. It rarely tests whether the content was retained, let alone applied correctly on the shop floor three months later.
- Training and quality operate on separate calendars. HR runs training against an annual plan. The quality manager runs compliance against an audit cycle. The two rarely compare notes until a finding forces the conversation.
- Verification is expensive to do well. Confirming that someone can actually apply a procedure — not just recite it — usually means direct observation, which doesn't scale across a production workforce without significant time investment.
- "Completed" feels like "done." Once a course shows 100% completion, the natural organisational instinct is to consider the requirement closed. The standard doesn't see it that way, and neither does an auditor who asks a process owner a follow-up question.
Competence Has to Be Verified in Context
If you've ever watched a process owner ace the quiz and then freeze the first time the line actually goes down, you already know the gap this creates. The core problem is that a knowledge test and an operational reality are two different things.
A multiple-choice quiz at the end of a training module tells you whether someone can recognise the correct answer when it's presented alongside three wrong ones. It doesn't tell you whether they'll apply that knowledge correctly when a machine is running, a deadline is close, and no one is checking.
Verifying competence in an operational context requires something closer to a simulation than a quiz: decision drills, scenario-based questions, role-plays that mirror the actual pressures and ambiguities of the job. This is why static e-learning modules struggle to produce credible competence evidence. The format tests recall. The standard requires demonstrated ability. That’s a significant difference in intent and system capability.
Why Competence Falls Short of a Compliance Signal
Here's the part that's easy to get wrong: competence evidence, on its own, is not a compliance signal.
Knowing that an operator scored well on a role-based competence assessment tells you the individual understands what the process requires. It does not tell you whether the process is actually being followed on the floor, whether the governing documentation is current, or whether the equipment supporting it is maintained. Competence is a property of a person. Compliance is a property of an organisation, and an organisation can fail to be compliant for reasons that have nothing to do with what any individual knows.
A well-trained, verifiably competent team can still operate against an out-of-date work instruction, or under equipment that hasn't been recalibrated on schedule. No amount of individual competence closes that gap. That's why a quality manager who treats a high competence score as proof of organisational compliance is making the same mistake the standard is trying to close: substituting a proxy for the real thing.
Why It's a Strong Indicator Anyway
But dismissing competence evidence as insufficient, and therefore not worth collecting rigorously, is the opposite mistake, and arguably the more common one once organisations understand the distinction above. Competence data is one of the most useful compliance-adjacent signals available.
It's a leading indicator, not a lagging one. A compliance gap discovered through an audit or a customer complaint has already happened. A competence gap discovered through assessment hasn't caused a nonconformity yet; it's a measurable condition that predicts one. If you know in advance that a role group doesn't understand a requirement, you know where an implementation failure is statistically likely to surface before it does.
It explains the gaps you do find. When a compliance gap is identified, the first useful question is why. A verified competence gap in the same area gives you the answer immediately: the process isn't being followed because the people running it don't fully understand what "correctly" means. Without that evidence, the same gap looks like a mystery that requires a separate root-cause investigation to resolve.
It narrows down what's actually at risk. An organisation carrying verified high competence across a role group can rule out training as the explanation if something later goes wrong there. An organisation with no competence evidence at all is flying blind on the single most common root cause of quality findings. Either way, the evidence changes what the quality manager should be looking for.
It surfaces resilience risk that a compliance signal wouldn't catch at all. Consider a low competence score paired with no reported process gap. The organisation may be performing correctly today largely by chance, habit, or the presence of one experienced individual. Resilience is thin, and succession risk is real and currently invisible to anyone not looking for it specifically. A clean compliance signal wouldn't show you this. Only the competence data would.
Two Different Questions, Both Worth Asking
The clause 7.2 problem ultimately comes down to correctly answering two separate questions, and providing evidence of both.
- Does this person understand what's required of them? That's a competence question. It's about the individual, and it's a strong early signal of a compliance risk.
- Is the organisation actually doing what's required? That's a compliance question. It's about the operation, and it requires its own, independent form of verification.
Most certified manufacturers have partial evidence for the first question and almost none for the second, and they don't distinguish clearly between the two in their own quality systems. A training completion record gets treated as if it answers both, and it answers neither with real confidence.
The organisations that fare best in this area treat competence evidence as an early warning system rather than an audit deliverable. A documented, verified competence gap caught before it becomes an operational one is one of the most useful pieces of information a quality manager can have. It's cheaper to address a knowledge gap through targeted retraining than to discover the same gap later as a nonconformity tied to a customer complaint.
The standard is asking for evidence that training was effective. Most organisations are still supplying evidence that training happened. Under the sharpened expectations around quality culture in ISO 9001:2026, that gap between the two will be harder to explain away and more expensive to leave unaddressed.
If an auditor asked you tomorrow to show that a specific role holder's training was verified as effective — not just completed — what would you actually be able to produce?
