ISO 9001 training: who needs what, and what counts as evidence of competence

What ISO 9001 requires: competence, awareness and evidence

ISO 9001 places its people requirements in clause 7, Support. They reach beyond the payroll: competence covers anyone doing work under the organisation's control that affects the performance of the quality management system, and awareness covers everyone doing work under its control, agency workers, temporary staff and contractors included.

Competence works as a cycle: determine what each such role requires; ensure the people in it are competent through education, training or experience; where someone falls short, act and evaluate whether the action worked; and keep documented information as evidence. Training is not the only action. Mentoring, reassignment, or hiring or contracting a competent person are equally valid.

Awareness is a separate, lighter requirement. People must be aware of the quality policy, the quality objectives relevant to them, how their work contributes to the system's effectiveness, including the benefits of better performance, and the implications of not conforming. ISO 9001:2026 adds the organisation's quality culture and ethical behaviour, which top management is now expected to promote. Awareness is not recitation: auditors ask what the policy means for the person's own job, not whether they can quote it.

The standard names no minimum hours and no qualification, not even for internal auditors, and leaves the form of evidence to you. For a method, ISO 10015 sets out guidelines for competence management and people development; it is guidance, not a set of requirements.

Who needs what: five groups, five depths

Top management

Leaders need to know what clause 5, Leadership, asks of them personally, including promoting quality culture and ethical behaviour, and how a management review turns data into decisions. A focused briefing usually suffices; the evidence that counts is the review record and how leaders answer at audit.

Process owners

Each owner needs working knowledge of what lands on their process: the process approach, risks and opportunities, objectives and measures, planning of changes, and nonconformity and corrective action. Their strongest evidence is the process itself, with measures reviewed, risks updated and causes removed.

The quality function

Whoever coordinates the system needs the whole standard in depth, including the 2026 changes, plus document control, audit programme management and root-cause methods.

Internal auditors

Auditors need knowledge of ISO 9001 and of the processes they audit, plus auditing skill: planning, sampling, interviewing and writing findings that stand up. ISO 19011's guidance on evaluating auditor competence is the usual reference. ISO 9001 internal audit: planning, conduct and reporting

Everyone in scope

Everyone whose work affects quality, from new starters to contract staff, needs awareness plus the skills of their own task: the work instruction, the check, the record and what to do when something goes wrong. Induction and a sign-off after observed practice are the core evidence, and refreshers should follow change rather than the calendar.

A training matrix: role, learning and evidence

A training matrix links each role to the competence it needs and the evidence that proves it. Adapt this starting point to your own roles, products and risks.

Review the matrix when a role, process or product changes, when you adopt a new edition, and when nonconformities point to a skills gap. A matrix left untouched for three years usually describes an organisation that has moved on without it.

What auditors accept as evidence of competence

Auditors test competence by sampling. They pick people met while auditing processes, ask for the criteria for each role, compare the person's record with them, then talk to the person or watch the work. The evidence convinces when all four agree.

• Competence criteria for each role, covering education, training, experience and skills. Without them there is nothing to measure a record against.
• Training, qualification and experience records: certificates, licences, CVs and internal authorisations, current and traceable to the person.
• Effectiveness evaluation: a test, an observed task, a supervisor's sign-off or a review of later output, recorded against the action it evaluates.
• On-the-job evidence: the records a person produces, the quality of their output and how clearly they explain their process.

An attendance certificate shows that someone was in the room. It says nothing about what they can now do, rarely refers to the role criteria and evaluates nothing. Auditors treat it as one input; a competence file of attendance certificates alone invites a finding.

Where training evidence fails at audit

• No criteria. Plenty of records, but nobody defined what the role requires, so none of them proves competence.
• Effectiveness never checked. The course happened and the file stops there.
• Contract and temporary staff forgotten. They work under your control, and auditors sample them too.
• Awareness material still on the 2015 edition. Induction that never mentions quality culture or ethical behaviour leaves a gap the transition audit is likely to find.

ISO 9001:2026: what changes and how to transition

Sterling Academy and internal auditor training

Sterling Academy provides e-learning for the whole workforce, and four of its courses fit an ISO 9001 programme:

• ISO 9001:2026 Awareness, for everyone in scope, linking the requirements to daily work.
• Documented Information Management, for those who write, approve and control documents and records.
• Nonconformity Management, for supervisors and process owners who handle nonconformities.
• Risk Management, for managers and process owners who identify, assess and treat risk.

Each course combines short learning checks with a final exam, and completion earns a numbered Sterling Academy Certificate of Completion. Because the learner was tested, that record outweighs attendance; for roles where competence means doing, add the on-the-job evidence from the matrix.

Internal auditor training, as applicable to your standard, is delivered within the consulting engagement rather than as e-learning. Your Sterling consultant trains your audit team on your own processes, and the training leads to a Certificate of Competence. File it with the reports of each auditor's first audits.

Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.

Contact us about Academy access

ISO 9001 training: questions buyers ask