ISO 9001 Clause 7.2 and AS9100: Proving competence, not just certificates, across multi-site manufacturing

Most industrial manufacturers serving aerospace, defence, and oil and gas supply chains have held ISO 9001 certification for years. Far fewer could say, without a week of preparation, whether every employee currently doing quality-relevant work is competent to do it – and prove it on paper, today, without notice. Certification and competence are not the same claim. Clause 7.2 of ISO 9001:2015 is built around the gap between them.

The clause itself is short, but it's specific. It doesn't just ask whether people were trained once – it asks an organisation to prove they're still competent, on record, whenever someone asks. For a single site with a stable team, that's manageable with a spreadsheet and some discipline. For a group running plants across nine countries, supplying aerospace, medical, and nuclear customers, and absorbing new certification histories every time it acquires a business, it becomes the reason audit preparation starts weeks early and still feels like a scramble.

What Clause 7.2 actually asks for

ISO 9001:2015 Clause 7.2 sets out four requirements: determine the competence a role needs, ensure the people in it have that competence through education, training, or experience, take action to close any gap, and retain documented evidence of the whole process. See the full walkthrough of the Clause 7.2 four-part test here. AS9100, the aerospace-specific standard built on top of ISO 9001, carries the same competence clause and adds requirements around risk management, configuration control, traceability, and counterfeit-parts prevention.

It's worth separating two things that get conflated. AS9100 certification and NADCAP accreditation are organisational credentials – held by the company, earned through external audit, covering the quality system as a whole or, in NADCAP's case, specific special processes like welding, heat treat, and non-destructive testing. The competence evidence Clause 7.2 asks for sits one level down, with individual employees holding individual, expiring credentials: NDT Level I, II, or III inspectors, certified welding inspectors, quality engineers and auditors, materials specialists qualified against a specific alloy or process. An auditor checking Clause 7.2 doesn't ask whether the company has a certificate on the wall. They ask whether you can show, for the specific person who signed off this batch, that their competence was determined, verified, and is still current.

Certificates prove attendance, not readiness

A folder of PDF certificates tells an auditor that training happened once. It doesn't tell them whether the certificate is still valid, whether the role's requirements have changed since, or who else on the team could step in if that person left tomorrow. Clause 7.2(c) specifically asks organisations to evaluate the effectiveness of the action taken to close a competence gap – not just confirm that training was scheduled. That's a live, ongoing requirement, not a filing exercise, and a static folder of documents can't answer it on its own.

Competence, in the clause's own wording, is broader than a credential – it can rest on education, training, or experience. That's the reason MuchSkills tracks skills, certifications, and badges as one connected record rather than a certificate archive: a role's requirement can be met by a certification, a demonstrated skill level, or both, and the system shows which one is actually missing rather than just whether a file has been uploaded. The same record holds what no vendor issues: your own licences and internal authorisations, such as a forklift licence or a sign-off to work on a specific system, each with an expiry date, proof file, alerts and change history.

Multi-site manufacturing multiplies the problem

Add more than one site and the gap widens fast. Every plant tends to build its own tracking habit – one site's quality manager keeps a spreadsheet, another relies on departmental memory, a third trusts whatever the HRIS happens to capture in a free-text field. None of it reconciles automatically. Comparing coverage across sites becomes a manual exercise every audit cycle, rather than a report that already exists.

A single certification tracking system that every site feeds into cuts most of that reconciliation work out, rather than recreating it once a year right before the auditor arrives.

What one record across every site looks like

Picture a group with sites in several countries, supplying aerospace, medical and energy customers under ISO 9001 and AS9100. It buys a business that holds its own aviation approvals, and that business arrives with a certification history kept in Excel. Until both sit in one system, every comparison between the new site and the rest of the group means reconciling two records that were never designed to speak to each other.

Put both on one platform and every site follows the same structure: the same role requirements, the same expiry alerts at 90, 60 and 30 days and on the day, and one place for the compliance team to look instead of one per site, while each manager sees their team's status in My Circle. Harald Pihl, a Swedish special-alloys group certified to ISO 9001 and AS/EN 9120 and a MuchSkills customer since 2024, uses MuchSkills to keep track of its people's skills and training across its sites in nine countries.

One record also answers the question quality and operations leaders ask most: where are we exposed if someone leaves? Reports show how many people hold each critical certificate or skill, by site and by role, and who is about to fall out of a requirement as certificates near expiry.

The audit trail auditors actually ask for

Clause 7.2(d)'s documented-evidence requirement is really a question about defensibility: when an auditor asks who approved a renewal, or what changed in a record last April, can you answer without reconstructing it from memory and email?

In MuchSkills, every change to a certification is logged, who changed what and when, with the value before and after, and the full history is always kept, so the answer is a lookup rather than an investigation. Records are kept for five years by default, and longer can be arranged. Certifications are added under three-way ownership: the employee uploads their own record, a manager validates it, and the requirement itself sits against the role rather than a named person – which makes coverage gaps more likely to surface before the audit rather than during it, provided records are kept current as certifications are added, renewed, or expire. The structure encourages that; it doesn't guarantee it on its own.

When the audit comes, you choose the people in scope, including those who have left, and download every certificate and proof file for them, named and ready to hand over. That matters for Clause 7.2: the person who signed off a batch two years ago may no longer work for you, but their evidence still has to exist. On the Compliance plan, an external auditor can also have their own access at no extra cost.

The certificate proves the system exists. Clause 7.2 asks you to prove it works.

Being ISO 9001 or AS9100 certified proves a quality system is in place. Being able to produce Clause 7.2 competence evidence, for every employee, on demand, proves the system actually works – and for manufacturers running more than one site, that second proof is the harder one to deliver.

See how MuchSkills handles certification tracking for compliance-driven manufacturers, or explore the Compliance solution page for the wider picture.

If your next surveillance audit is closer than your certification records are ready for, book a demo and we'll walk through it with your own role requirements.