Clause 7.2 is audited in two halves, and the first half is where most findings land. You determine the competence each role needs for work that affects the management system, then retain documented information showing that the people doing that work meet it. A training matrix filled with attendance certificates evidences the second half against a requirement nobody recorded, so the nonconformity is written against the determination, and adding certificates to the file does not close it.
Clause 7.2 appears in all three of the standards EIAC and ANAB accredit us for, and the three versions of it are not interchangeable. Reading one and applying it across an integrated system produces findings under the other two.
What each standard asks for
ISO 9001:2015 clause 7.2 covers persons doing work under your control that affects the performance and effectiveness of the quality management system. Competence rests on appropriate education, training or experience, which is a choice of three bases rather than a requirement for courses. Where the necessary competence is not held, the clause asks you to take action to acquire it, and the standard's own note offers training, mentoring, reassignment, and hiring or contracting a competent person as the examples.
ISO 14001:2015 adds a determination the other two do not carry: training needs associated with your environmental aspects and your environmental management system. It also ties competence to your ability to fulfill your compliance obligations. An aspects register with significance determined and no corresponding view of who needs to be trained in what is a 7.2 finding as well as a 6.1.2 one, and the two tend to arrive together.
ISO 45001:2018 says workers rather than persons, asks you to acquire and maintain the necessary competence, and names one competence inside the clause itself: the ability to identify hazards. Its definition of worker reaches people performing work under your control, which in a UAE construction or facilities arrangement routinely includes supplied labor and contractors' staff. That is the reach a matrix built from the payroll misses.
Where the findings land
The most common finding is the matrix that is really a course list. Rows are people, columns are courses, and nothing in the document states what any role requires, so the records have no criterion to be evidence against. The clause asks for the determination first, which is why this one is raised against the process and not against anybody's file.
The second is experience recorded nowhere. A pipefitter with eighteen years in the trade and no card shows as a gap, while somebody holding a two-day certificate shows as competent. The standard permits experience as a basis and requires that the basis be recorded, so closing this out is a documentation exercise about people who are already doing the work correctly.
The third is the gap flagged and never actioned. Where a matrix carries the same red cells through three years of surveillance, the finding is the absence of action rather than the shortfall in competence, and the action available is wider than a course: mentoring, reassignment, or contracting somebody who already holds the competence all satisfy the clause.
The fourth involves competence that somebody else fixes for you. Where a task requires a third-party qualification, such as a lifting appliance operator's card, that requirement is also a legal requirement determined under ISO 45001 clause 6.1.3, and compliance with it is evaluated under 9.1.2. An expired card therefore produces findings in two places, and the 7.2 one concerns your process for maintaining competence rather than the individual holding the card.
The fifth is awareness sampled as though it were competence. Clause 7.3 is a separate requirement with its own list, and in ISO 45001 that list includes the ability of workers to remove themselves from work situations they consider present an imminent and serious danger to their life or health, together with the arrangements that protect them from undue consequences for doing so. A signature on a policy briefing register does not evidence that. It is tested by asking, which is one reason our ISO 45001 audits interview non-managerial workers directly.
Internal auditor competence sits slightly apart. Where an internal audit was carried out by somebody without competence for the standard or the process audited, the finding attaches to the selection of auditors under clause 9.2.2.
What 7.2 does not require
No matrix, no format, no minimum hours, no external provider and no refresher interval. The clause fixes the retention of evidence and leaves its form open, so a signed authorization to operate a machine, a witnessed assessment record, or a supervisor's sign-off against stated criteria all qualify where they connect a named person to a requirement you determined. An interval you set for yourself becomes a requirement we sample: a three-year refresher rule written into your own procedure and missed by eighteen months is a nonconformity against your own documented requirement, whatever the standard says about intervals.
Two boundaries follow from what we are. We will not determine your competence requirements, build your matrix or assess your people, because ISO/IEC 17021-1 does not allow us to consult on a system we then certify, and our accreditation depends on that separation. We do deliver training on the standards themselves, and attendance on any course, ours included, is one input to a determination that remains yours. A course's Exemplar Global approval speaks to the course.
Our own auditors' competence is governed by ISO/IEC 17021-1 rather than by your clause 7.2. It is held per standard and per technical area, and EIAC and ANAB assess it, including by witnessing our auditors at work during a client's audit.
Nothing about individuals travels onto a certificate. Our register records the standard edition, the scope, the sites, the status and the validity dates, and it carries no conclusion about any named person's qualifications.