ISO 9001 Clause 7.2 and AS9100: Proving competence, not just certificates, across multi-site manufacturing

Most industrial manufacturers serving aerospace, defence, and oil and gas supply chains have held ISO 9001 certification for years. Far fewer could say, without a week of preparation, whether every employee currently doing quality-relevant work is competent to do it – and prove it on paper, today, without notice. Certification and competence are not the same claim. Clause 7.2 of ISO 9001:2015 is built around the gap between them.

The clause itself is short, but it's specific. It doesn't just ask whether people were trained once – it asks an organisation to prove they're still competent, on record, whenever someone asks. For a single site with a stable team, that's manageable with a spreadsheet and some discipline. For a group running plants across nine countries, supplying aerospace, medical, and nuclear customers, and absorbing new certification histories every time it acquires a business, it becomes the reason audit preparation starts weeks early and still feels like a scramble.

What Clause 7.2 actually asks for

ISO 9001:2015 Clause 7.2 sets out four requirements: determine the competence a role needs, ensure the people in it have that competence through education, training, or experience, take action to close any gap, and retain documented evidence of the whole process. See the full walkthrough of the Clause 7.2 four-part test. AS9100, the aerospace-specific standard built on top of ISO 9001, carries the same competence clause and adds requirements around risk management, configuration control, traceability, and counterfeit-parts prevention.

It's worth separating two things that get conflated. AS9100 and NADCAP are organisational accreditations – held by the company, earned through external audit, covering the quality system as a whole or, in NADCAP's case, specific special processes like welding, heat treat, and non-destructive testing. The competence evidence Clause 7.2 asks for sits one level down, with individual employees holding individual, expiring credentials: NDT Level I, II, or III inspectors, certified welding inspectors, quality engineers and auditors, materials specialists qualified against a specific alloy or process. An auditor checking Clause 7.2 doesn't ask whether the company has a certificate on the wall. They ask whether you can show, for the specific person who signed off this batch, that their competence was determined, verified, and is still current.

Certificates prove attendance, not readiness

A folder of PDF certificates tells an auditor that training happened once. It doesn't tell them whether the certificate is still valid, whether the role's requirements have changed since, or who else on the team could step in if that person left tomorrow. Clause 7.2(c) specifically asks organisations to evaluate the effectiveness of the action taken to close a competence gap – not just confirm that training was scheduled. That's a live, ongoing requirement, not a filing exercise, and a static folder of documents can't answer it on its own.

Competence, in the clause's own wording, is broader than a credential – it can rest on education, training, or experience. That's the reason MuchSkills tracks skills, certifications, and badges as one connected record rather than a certificate archive: a role's requirement can be met by a certification, a demonstrated skill level, or both, and the system shows which one is actually missing rather than just whether a file has been uploaded.

Multi-site manufacturing multiplies the problem

Add more than one site and the gap widens fast. Every plant tends to build its own tracking habit – one site's quality manager keeps a spreadsheet, another relies on departmental memory, a third trusts whatever the HRIS happens to capture in a free-text field. None of it reconciles automatically. It gets harder still after an acquisition: a newly acquired subsidiary, particularly one carrying its own certifications, arrives with a certification history that was never built to talk to the parent company's system. Comparing coverage across sites becomes a manual exercise every audit cycle, rather than a report that already exists.

A single system that every site feeds into cuts most of that reconciliation work out, rather than recreating it once a year right before the auditor arrives. That's the shift Harald Pihl made when it moved certification tracking onto MuchSkills.

How one company unified certification tracking across nine countries

Harald Pihl, a Swedish special-alloys manufacturer founded in 1912, supplies aerospace, medical, oil and gas, defence, nuclear, and chemical customers from sites across Sweden, Germany, Denmark, the UK, Turkey, Spain, China, India, and Vietnam. The group holds ISO 9001 and AS/EN 9120 certification. When it acquired an aviation-certified subsidiary, that business arrived with its own certification history – tracked, like many newly acquired teams, in Excel. Comparing coverage between the new site and the rest of the group meant reconciling two systems that were never designed to speak to each other.

The group moved certification tracking and development planning into MuchSkills, giving every site the same structure and the compliance team one place to look instead of nine. 

"Now our certification tracking and development planning is finally unified and user-friendly," said Victoria Larsén, Global HR Manager at Harald Pihl. Adoption across the group now sits above 85%, with the remainder accounted for by parental leave, board members, and one non-aviation-certified entity where adoption hasn't been pushed yet.

The audit trail auditors actually ask for

Clause 7.2(d)'s documented-evidence requirement is really a question about defensibility: when an auditor asks who approved a renewal, or what changed in a record last April, can you answer without reconstructing it from memory and email? MuchSkills logs every certification change – addition, edit, removal, expiry update – with full attribution, so the answer is a lookup rather than an investigation. Certifications are added under three-way ownership: the employee uploads their own record, a manager validates it, and the requirement itself sits against the role rather than a named person – which makes coverage gaps more likely to surface before the audit rather than during it, provided records are kept current as certifications are added, renewed, or expire. The structure encourages that; it doesn't guarantee it on its own.

Frequently asked questions

How do I prove ISO 9001 Clause 7.2 competence? 

You need documented evidence covering all four parts of the clause: the competence required for each role, verification that the people in it hold that competence through education, training, or experience, any action taken to close a gap, and proof that the action worked. A certificate alone only covers part of that – the requirement-to-holder mapping matters as much as the paperwork itself.

What's the difference between AS9100 and ISO 9001 certification requirements? 

AS9100 is built directly on ISO 9001 and carries the same Clause 7.2 competence requirement, with additional aerospace-specific requirements covering risk management, configuration control, traceability, and counterfeit-parts prevention. Organisations already certified to ISO 9001 are extending an existing quality system rather than starting from nothing.

What counts as audit evidence for training? 

A training certificate on its own shows attendance, not ongoing competence. Auditors want to see that the requirement was defined, that the individual's competence was verified against it, that any gap was addressed, and that the evidence is current rather than a static record from years earlier.

How often are AS9100 surveillance audits conducted? 

Most AS9100-certified organisations undergo annual surveillance audits within a three-year full recertification cycle, similar to ISO 9001. Multi-site manufacturers typically time these around the same window each year – which is exactly when scattered, site-by-site certification records become most visible as a risk.

The certificate proves the system exists. Clause 7.2 asks you to prove it works.

Being ISO 9001 or AS9100 certified proves a quality system is in place. Being able to produce Clause 7.2 competence evidence, for every employee, on demand, proves the system actually works – and for manufacturers running more than one site, that second proof is the harder one to deliver.

See how MuchSkills handles certification tracking for compliance-driven manufacturers, or explore the Compliance solution page for the wider picture.

If your next surveillance audit is closer than your certification records are ready for, watch the Compliance Demo — eighteen minutes that walks through exactly this problem.