By Russell Lawson, ISO consultant, lead auditor and founder of The Compliance Companion - a platform that helps businesses simplify ISO 9001, ISO 14001, ISO 45001 and ISO 27001 through AI-powered tools, expert guidance and practical resources. Russell has worked with hundreds of businesses across the UK, both as a consultant and as a certification auditor, helping organisations build ISO systems that actually work - not just tick boxes.
“Can you just give us a training matrix?”
It’s one of the most common things I get asked when businesses are preparing for ISO certification - especially ISO 9001, 14001, 45001 or 27001. And while a training matrix is useful, it’s not what Clause 7.2 is really about.
After years of working with companies across sectors - and auditing their systems too - I’ve seen a lot of confusion around the word competence. Many organisations still assume that if someone’s been on a training course, or has a certificate on file, that’s job done.
But competence is about more than qualifications. It’s about whether someone can do the job properly, consistently, and in a way that meets the requirements of your management system.
In this blog, I’ll explain what ISO standards really mean by competence, why it’s often misunderstood, and how I’ve seen smart businesses use it as a powerful performance tool - not just a compliance exercise.
What Does ISO Really Mean by “Competence”?
Let’s take ISO 9001 as the starting point. Clause 7.2 requires organisations to:
“Determine the necessary competence of person(s) doing work under its control that affects the performance and effectiveness of the quality management system.”
That means you need to:
-
Know what skills and knowledge are needed for a role
-
Ensure the people doing the job have those skills
-
Take action where there are gaps
-
Keep evidence of all the above
Simple on paper - but not always in practice.
I’ve audited companies who’ve proudly shown me their training certificates folder, only for their procedures to fall apart when I start asking how those people actually apply their knowledge on the job.
ISO 14001, ISO 45001 and ISO 27001 all follow the same logic:
-
ISO 14001: Are people competent to manage environmental aspects and legal obligations?
-
ISO 45001: Are staff trained and competent in safety-critical activities?
-
ISO 27001: Do employees understand information security risks, policies and responsibilities?
It’s about real-world capability, not just paperwork.
Common Competence Pitfalls (I’ve Seen Them All)
Over the years, both as a consultant and auditor, I’ve seen a few recurring mistakes when it comes to how companies interpret competence:
- Focusing only on formal training
A certificate isn’t proof of competence - it’s proof someone attended a course. What matters is whether they understand the material and apply it effectively.
- Overlooking on-the-job learning
Some of the most competent people in a business have never been on a course - they’ve learned through experience. But if you can’t evidence that process, you’ll struggle to demonstrate compliance.
- No defined criteria
If you haven’t defined what competence looks like for a given role, how can you assess whether someone meets it?
- No follow-up after training
I’ve seen businesses invest in training but never check whether the training worked. Was it understood? Has behaviour changed? Has performance improved?
A Smarter Way to Manage Competence
Here’s a practical approach I often recommend to clients - and which I’ve seen work in real audits:
- Define the required competence for each key role
Not a full job description - just the skills, knowledge and behaviours needed to perform the role in line with your ISO system.
- Consider multiple sources of competence
Formal training, yes - but also mentoring, shadowing, years of experience, toolbox talks, internal workshops, peer reviews.
- Use a skills matrix - but make it meaningful
Colour-coded or not, it should link roles to the required skills and show current status clearly.
- Gather evidence from real work
Think appraisals, sign-offs, work outputs, audits, inspections - not just training certificates.
- Don’t wait for an audit to review competence
Build it into annual reviews, internal audits, project debriefs, and team meetings.
I’ve audited systems where this was done well, and it completely transformed the conversation. Instead of scrambling to show proof, teams were confident in their roles, their knowledge, and how their work contributed to the system.
Competence Isn’t About Box-Ticking - It’s About Confidence
At its heart, Clause 7.2 is asking this:
Are the people doing the work able to do it properly — and how do you know?
When competence is taken seriously, it builds trust - internally and externally. It improves performance, reduces mistakes, and makes your ISO system something people actually value.
I’ve worked with companies where this one clause became the spark for a completely new approach to people development. It wasn’t about bureaucracy. It was about building a stronger, safer, more capable team.
Make It Easier with The Compliance Companion
Inside The Compliance Companion, you’ll find competence templates, AI prompts and examples that help you define, track and demonstrate competence with less admin - and more confidence.
Whether you're preparing for ISO 9001, 14001, 45001 or 27001, we’ll help you turn competence from a paperwork headache into a genuine advantage.
👉 See how it works:
https://the-compliance-companion.co.uk/harness-the-future-of-iso