ISO 9001:2015 requires organisations to:

1. Determine the required competency requirements of person(s) doing work under its control that affects the performance and effectiveness of the management system,
2. Establish the competency of these persons. (IE: Appropriate education, training, or experience,)
3. Take appropriate actions where applicable, for persons to acquire the necessary competence, and then evaluate the effectiveness of these actions. EG: Training, mentoring, reassignment of currently employed persons or the hiring or contracting of competent persons.

Appropriate documented information needs to also be retained as evidence of competence.

Comment:

It is necessary to apply these requirements to all personnel under the organisations control if they affect the organisations management system performance. This then will include contract / agency workers and any personnel undertaking outsourced work. In addition, the standard also requires records (documented information) to be retained as evidence of competence. IE: Not just training records.

A note on “…doing work under its control.” This should not be confused with subcontracted work or services. Lets look at a couple of examples to clarify:

• An engineer employed by a company which provides Powered Pallet Trucks to the organisation has a workshop in the corner of the organisations warehouse where routine servicing and maintenance is carried out. The organisations warehouse supervisor works with the engineer to agree which/when trucks are to be released for servicing. Although not employed by the organisation, he / she should be considered under the organisations control.
• Another company provides Fork Lift Trucks to the organisation. These are periodically sent out to the company’s servicing facility located in the next county, where routine servicing and maintenance is carried out by the company’s service engineers. These service engineers are not under the organisations control, but the organisation may still wish to check the competency of the engineers given the nature of the work they are undertaking. This would be addressed under Clause 8.4.3 - Information for external providers however.

Back to the requirements of Clause 7.2 on Competence. The Plan, Do, Check, Act process can again be employed here:

Plan

P1. Determine what competencies are needed.

(This might, for example in a larger organisation, comprise of a Business Resources Plan, compiled from the output of Personal Development Planning meetings, Succession Plans and departmental level Training Needs Analysis activities Note: Smaller organisations may have a more informal approach, but note the requirement for records (documented information) to be retailed.

Regular scheduled reviews should be augmented by the outputs of the planning process for specific activities. EG: New markets being exploited, orders or contract is being tendered, expansions, acquisitions, and projects. New products or processes being introduced or general / sector specific, economic factors. (See also article 6.3 – Planning for change.)

P2. Determine what (if any) additional competencies are required to be acquired.

(Many organisations use departmental Skills Matrixes to represent required skills and competencies vs current resource levels.)

P3. Determine how any additional competency requirements can best be obtained. Factors may include current resource levels, succession plans, budgetary constraints and crucially, project timelines.

(EG: External or internal education of personnel in the classroom or "on the job" training. Recruitment or contracting of personnel who already possess the required skills and competencies, secondment, or re-assignment of existing personnel to different tasks or projects can offer solutions if timing is a factor.)

Do

Mentor, train, reassign, contract or recruit personnel in line with planned arrangement.

Check

Evaluate the effectiveness of actions taken on the required competency of individuals – including agency, contract and outsourced labour.

Post training feedback reports from candidates are sometimes used as a quick check, but better insights can be achieved via methods such as Performance Reviews, Personal Development Plan achievements, results of internal audits, process performance monitors, project plan deliverables and business metrics for example.

Act

Document new competency levels / determine further actions if necessary. IE: If adequate competencies have not yet been achieved, repeat a new PDCA cycle.

Audit Check:

Evidence (documented information) may be requested to demonstrate compliance. IE Actions taken to determine competency needs and to address any gaps, but also crucially, to determine the effectiveness of actions taken. IE: not just training records!

As this clause also covers the competence of person(s) doing work "under the organisations control" to be addressed, records relating to agency or contract workers may be specifically targeted as these are often a weak point.

Note: If applicable to the business, outsourced human resources may also be reviewed under the requirements of a separate clause for externally provided processes, products and services. (See article 8.4.)