ISO 9001 / AS9100 Clause 7, Part Two, Competence: A Customer Promise

Part one covered Clause 7.1: the resources it takes to run the system, ending on organizational knowledge and the retirement cliff bearing down on it. This post continues the organizational knowledge thread with its counterpart, ISO 9001 / AS9100 Clause 7.2: Competence.

7.2: Competence

What's expected: Determine the necessary competence of people doing work under your control that affects quality performance. Ensure those people are competent on the basis of appropriate education, training, or experience. Where applicable, take actions to acquire the necessary competence and evaluate the effectiveness of those actions. And retain appropriate documented information as evidence of competence.

AS9100 is explicit that this extends to personnel performing work affecting product conformity, including the awareness of their contribution to product and service conformity and safety; competence and awareness are deliberately linked in the aerospace standard.

What conformance actually looks like: Three distinct requirements live in this clause, and organizations typically satisfy the first and third while skipping the second.

The first is determining required competence: a skills matrix, job descriptions with qualification requirements, something that states what a person needs to be able to do before they do it. The third is retaining evidence:  training records, certifications, qualification signoffs. Both are usually in reasonable shape, because both produce documents and documents are easy to audit.

The missing one is evaluating the effectiveness of the actions taken. The standard doesn't ask whether training happened. It asks whether it worked. A signed training record proves attendance. It proves nothing about competence, and the gap between those two things is where this clause actually gets tested.

The "Operator Error" Loop

This idea deserves a tangential insertion, because this is the single most recognizable pattern in weak quality systems, and experienced auditors can spot it from across the room.

A nonconformance occurs. The corrective action investigation concludes the root cause was operator error. The corrective action is retrain the operator. The CAR is closed. Six months later, the same nonconformance occurs, often with a different operator. Root cause: operator error. Corrective action: retrain. Close.

What an auditor sees when they pull three CARs and find this pattern is not a training problem. They see three findings at once:

• A Clause 10.2 finding, because "operator error" is a description of what happened, not a cause. The investigation stopped at the first human in the chain instead of asking why the process permitted the error, why it wasn't detected, and why the condition recurred.

• A Clause 7.2 finding, because if retraining was genuinely the right action and the problem recurred, then the effectiveness of that action was never evaluated, or it was evaluated and the evaluation was wrong, and nothing happened as a result.

• A Clause 5 problem, usually unwritten, because a pattern like this survives only in an organization where leadership isn't reading its own corrective actions closely enough to notice the loop.

The loop persists because it's comfortable. It assigns cause to someone with no authority to change the system, prescribes an action that's cheap and fast, and produces a document that closes a finding. Everyone's paperwork is in order. Nothing is fixed.

Worth saying plainly: people do make mistakes, and sometimes training genuinely is the answer. The test isn't whether training ever appears as a corrective action, it's whether the investigation that arrived there actually ruled out the process. If the work instruction was ambiguous, if the fixture allowed the part to load two ways, if the inspection step was positioned after the point of no return, then retraining a person to be more careful inside a system that invites the error is not a corrective action. It's a request for better human performance from a process that's working exactly as designed.

A useful analogy: if people keep tripping on the same step, you can keep reminding them to watch their footing, or you can light the stairwell. Only one of those scales to the next person who walks through.

The Irony Worth Sitting With

Here's what makes this pattern particularly frustrating: most of the genuinely valuable training needs an organization has were identified the hard way.

Think about where your real training content came from. Not the generic safety module, the specific stuff. The setup technique that exists because of a scrap event. The print-reading emphasis that exists because somebody misread a datum scheme and a lot went out wrong. The receiving inspection check that exists because a supplier substitution got through once. Those lessons were purchased at full price, in scrap, in rework, in a customer phone call somebody still remembers.

Corrective action is one of the best training-needs analyses a company has access to, because it's grounded in failures that actually occurred in your building, on your equipment, with your customers' parts. The irony is that the organizations most prone to the retraining loop are precisely the ones extracting the least value from it: they use CARs to dispense training rather than to inform it. "Retrain the operator" treats the CAR as a disposal mechanism. Reading across a year of CARs and redesigning your onboarding around what they reveal treats the CAR as what it actually is: expensive, specific, hard-won intelligence about where your processes are weak.

Training as a Customer Promise

The organizations that get this right have made a philosophical shift that shows up everywhere once you know to look for it: they don't treat training as a compliance activity. They treat it as a promise to the customer.

Every quote you send carries an implicit claim: that the people who will touch this part know how to make it right. A training record is the evidence behind that claim. Viewed as a checkbox, training is an expense you minimize: shortest acceptable session, signature sheet, file it. Viewed as a promise, it's an investment you protect, and the questions change. Can this person actually do the job unsupervised? How do we know? What happens when they encounter something the training didn't cover? Who's qualified to backfill when they're out?

That shift is also what makes the competence clause a direct contributor to the organizational knowledge problem from part one. Competence work and knowledge capture are the same work approached from two directions; one asks what a person needs to know, the other asks what the company knows. A shop that takes 7.2 seriously is already most of the way through 7.1.6.

Why it matters to the customer: Customer source inspectors and supplier auditors ask about competence early, and they ask about it specifically: not "do you train people" but "show me this operator's qualification for this process." In aerospace, special process operators and inspection personnel attract particular scrutiny, and a gap there raises an immediate question about everything those people touched. Competence records are, functionally, part of the product's pedigree.

Where the operational payoff is: Competence is capacity. Every job that can only run on one shift because only one person is qualified is a scheduling constraint you created. Deliberate cross-training, driven by an honest skills matrix rather than by whoever's available, is one of the cheapest throughput improvements available to most shops, and it converts a single point of failure into flexibility at the same time.

ISO 9001 / AS9100 Clause 7: Pulling It Together

If there's one thing to take from this post, it's the retraining loop. If you pull your last ten corrective actions and more than a couple conclude in operator error and retraining, you've found both your most reliable source of recurring nonconformances and your single best opportunity for improvement. Those CARs are telling you something expensive and specific about your processes. Most organizations are filing them instead of reading them.

What's Next

We still have some more ground to cover in Clause 7, and it’s all about people and information: awareness, communication, and control of documented information. 

Also if you happen to be near KC and want to see more, there is still a couple more days to register for the KCMN SWOT Summit.  I'm co-presenting Breakout Session 3B on turning tribal knowledge into something your customer can audit, which picks up directly where part one of this Clause 7 discussion left off.