Clause 7.2 Competence Requirements (Secrets)

In my experience as an auditor and trainer, I’ve found that Clause 7.2 ‘Competence’ seems to be every internal auditor’s favourite clause to audit. However, I’ve also determined it is one of the most common clauses that internal auditors misinterpret. The problem lies with the fact that most of these auditors associate the word ‘competence’ with the word training. It’s interesting to note that the standard requires that you must determine ‘competence’, not ‘training’. What I’m trying to emphasise here is that a determination of competence is far more complex than a record of training such as a training certificate. The standard does offer some clues that verify this by describing competence as a combination of education, training or experience.

What Competencies Are Required

It’s not the job of an external 3rd party auditor to decide what competencies are required to perform a specific task or procedure. If you encounter one that does, then they are in breach of their ISO 17021 conformity assessment guidelines. On a similar note, you’ll not find any instruction within the standard itself for any of its clauses. Modern management systems are 100% non-prescriptive in the way that they are authored. This is evidenced by the common usage of the word ‘shall’ at the beginning of each clause such as “the organisation shall”.

The clause will then proceed to describe the requirement but will never offer instruction for how you are to achieve the ‘shall’. I’m mentioning this only because, on countless occasions, I’ve followed the footsteps of a previous auditor visit within an organisation who has offered ‘hard opinions’ on how a person should be trained in relation to competence.

The standard requires that you determine for:

Person(s) doing work under its control that affects the performance and effectiveness of the quality management system.

As I’ve stated many times, it’s reasonable to say that all persons within an organisation are affected by, and contribute in some way to the management system. Therefore, all persons performing a task as part of a process are captured within this requirement. However, what you might forget to consider is that certain tasks performed by contractors may also have to be considered. The task of determining competency can be made easier by dividing people into groups that perform similar duties. For example, I would imagine that all workers in the finance department perform very similar tasks and duties. After typing that sentence, I’m suddenly hearing thousands of angry finance admin workers shouting abuse at me! If that’s true, then I apologise wholeheartedly.

The SKATE Mnemonic

In my role as a trainer, I often use the mnemonic ‘SKATE’ when discussing and teaching the concept of competency to my students. The ‘SKATE’ mnemonic describes skills, knowledge, ability (attainment, aptitude), training and experience. I remember a long time ago when sitting a Nebosh exam that I was very grateful for mnemonics such as this one and similar.

Skills: skills can be developed over time and are the product of education and experience. This could be on-the-job training or training by formal education such as obtained on a formal training course. Certain skills might be a prerequisite of a job application, where you are expected to have a certain skill set before you can apply. Skills are usually developed over time and are acquired through repetition such as learning to drive. Physical skills, such as learning to operate a machine are different to soft skills such as communication. Some people are naturally better at physical skills as opposed to soft skills. It’s worth considering this when you are determining the allocation of tasks.

Knowledge: is an understanding of the information or a skill that you obtain from experience or training. It’s a cognitive awareness of facts including processes and procedures and how to assimilate and apply them. It could also be described as a range of one’s understanding of information. I’d like to think that I have ‘good’ knowledge of management systems that have been acquired by my work history as an auditor, QHSE manager and tutor/lecturer on the subject. Children are often described as knowledge ‘sponges’, especially in their very early stages of development. Certain individuals set themselves the honourable task of acquiring a new piece of (formal) knowledge daily by learning the definition of a new word from a dictionary for example.

Attitude (aptitude, ability, attainment): I’ve included the brackets as that’s how you might find the ‘A’ described in the mnemonic by different sources. Attitude might be considered the most important letter of the mnemonic. Attitude describes an individual’s feelings and beliefs about their job or a part of their job such as performing a task within a procedure. Attitude can be thought of as job satisfaction or feeling towards conditions of work and rates of pay etc.

Hiring persons with the right attitude to their work is always the best way to begin however, an employee’s attitude might change over time. Quite often, surveys and questionnaires are used to assess the attitude of employees towards their job. Attitudes can be influenced and (hopefully) changed through education and training processes.

Training: comes in many forms such as an extended university course, a one-day course, a toolbox talk session or hands-on training whilst on the job etc. The type of training required will be dictated by the nature of the subject and levels of risk. In a lot of organisations, I’ve found failures when assessing training delivery. It’s very important after a training session delivery to have a method by which you can assess your learners’ knowledge acquisition.

At university, this would be by formal exam. Informal training sessions at work, could end with a simple question and answer session, or with a short multiple-choice question set. However you decide to do it, remember to have your learners sign to say that they have received and understood their training. I also include the question “do you require any further training in the subject?” as part of the form. /remember to scan the forms and enter them into the management system documentation process and also update your master training records.

Experience: this equates with performing a practical process over a period of time. How much time does one need to gain the experience necessary? Well, there’s no easy answer to that question as it will depend upon the nature of the task being learned. If in your organisation, you determine that a person has gained the experience necessary then that is entirely up to you. It’s a good idea to have a set of assessment criteria that demonstrates an individual has gained the necessary criteria although the standard doesn’t require it.

This is another instance where the topic of risk is relevant. In high-risk activities such as working in confined spaces or handling toxic substances, your assessment criteria for competence is going to be very strict. Compare this to changing the ink cartridge in the office photocopy machine where your competence criteria might only be a visual observation and sign-off.

Hard & Soft Competencies

Practical ‘hard’ skills such as those required to change a flat tyre to operate a forklift truck are normally acquired through experience over a period of time. Soft educational type skills such as learning the potential hazards of changing a flat tyre or learning about the maximum safe load of the forklift truck are normally acquired through attending an educative ISO training session. The standard requires that you ‘determine the skills necessary and I’ll repeat myself by saying that how you choose to do that is entirely up to you. To record the necessary skills for a particular task or procedure, you could create a form with the column headers reading:

• Skill; record the minimum required skills needed to perform the task.
• Knowledge; record the knowledge required to perform the task.
• Attainment; record the attainment of ‘goals’ or standards required to perform the task.
• Training; record the type of training required to perform the task.
• Experience; record the experience necessary to perform the task.

The requirement also asked you to ‘obtain the necessary competence’ where applicable and evaluate the effectiveness of these actions. As mentioned earlier, you can obtain education and training from a variety of sources. You can provide in-house training or you can obtain training from an external training provider. An external training provider can provide the training on-site, at a specified location such as a hotel or by using technology such as Microsoft teams or Zoom etc. Roles will have to be established to implement and maintain an effective training program.

Train The Trainer

When providing in-house training, a 3rd party auditor will most likely check on the competency of the trainer, especially in relation to high-risk activities. If you are providing in-house training, it’s a good idea to send your trainers on a ‘train-the-trainer’ course as a way of demonstrating their competency to deliver training. This is not always necessary because a person might possess the skills and experience on a particular subject that they have gained through years of experience at performing a task.

Training can be obtained by:

• Attending a formal qualification such as a degree or diploma.
• Completing an online interactive training course.
• Attending a conference physically or by Zoom etc that might be hosted by someone from leadership.
• Partaking in a toolbox talk session.
• By gaining hands-on experience over time by repetition.
• By being mentored and tutored by someone with the necessary experience.
• Evaluating the effectiveness of your actions in relation to training and competency relates back to what I’ve mentioned earlier; making an assessment of the training provision to ensure that it’s been understood by the training recipients.

When making evaluation assessment criteria, you should be asking:

• Has the teaching and knowledge been understood?
• Will the learners be able to apply the knowledge and/or skills autonomously where necessary?

You can obtain the answers to these questions by using formal exam type testing, informal question and answer sessions or by observations. You may decide to perform all three so that you can have a more complete, and detailed indication of the learner’s knowledge acquisition and understanding. Also, be sure that the training you are providing is relevant to the persons receiving it, and that it is up-to-date. You might also consider when further update training will be required. An objective, based on a policy statement could also be established for training.

Update training will depend upon changes to:

• Task, the procedure or process requirements.
• Changes to hardware and software requirements.
• Changes to product and/or service provision.
• Changes to contract requirements.
• Changes to environmental condition.
• Changes in legislation.

The plans for training provision, and the associated budgets are normally an agenda for your management review. However, training requirements are often dynamic and will be affected by any or all of the items that I’ve listed above. With this in mind, the forecast for the training budget should be as flexible as your finances will allow.

External Training Provision

Paying for training provided by external resources can be very expensive; so if you can provide your training in-house wherever possible, you will save both time and money. Line managers and/or shift leaders are usually the best persons to provide toolbox talk type training. More formal in-house training could be provided by persons who have attended a train-the-trainer course and have the necessary skills and experience for a particular task.

ISO 14001:2015

There is only a slight difference to the requirement Clause 7.2 and is listed at:

• Part(a) “environmental performance and its ability to fulfil its compliance obligations”

You can substitute the word ‘environmental’ for the word ‘quality’ and so there is no change for you to consider here. Reference to compliance obligations is referring to both legal compliance and compliance that you have committed to such as the terms of a contract or a voluntary obligation to use non-toxic chemicals. When dealing with legal compliance, specific competencies will be required and this may involve specialist training such as a diploma or degree course. It’s for this reason that many organisations choose to outsource their legal compliance requirements.

You are also required to retain appropriate documented information as evidence of competence. The word appropriate is quite subjective here and what you consider to be appropriate might differ when compared to another organisation. So long as your document management system is capturing records of training, how the assessment of training was performed, and how the competencies required for performing a specific task have been met, then you’re good to go.

ISO 45001:2018

There is only two slight difference to the requirement Clause 7.2 and is listed at:

• Part(b) “including the ability to identify hazards”
  
  

This relates back to clause 6.1.2 hazard identification and the assessment of risk. Making an assessment of safety hazards requires formal training by a person/s that are competent to do so. Health and safety law (European) dictates that an organisation must employ a ‘competent person’ to help you meet your health and safety duties. The definition of competence as provided by the UK Health and Safety Executive is:

• “someone who has the necessary skills, experience and knowledge to manage health and safety”.
  
  

Most organisations will employ a qualified safety officer/manager to manage this function although, some organisations choose to outsource the function to an external specialist provider.

For Auditors:

• Check for a master training record and that it is updated and maintained.
• Check the competence of persons delivering training for medium to high-risk activities.
• Check for an assessment of the training provision process.
• Check for documents that capture and describe the necessary competence require for a specific task.
• It’s also worth looking into the corrective actions document to identify if any non-conformances were caused by a lack of knowledge of training.
• Check the minutes of the annual review meeting for budget planning in relation to training provision.

ISO 14001:2015

Clause 7.2, as above but also check the competence of the person in charge of the legislation requirements process.

ISO 45001:2018

Clause 7.2, as above but also check the competence of the person in charge of the legislation requirements process and for formal training by a competent person for workplace hazard identification.

Some further questions that I will be answering in future articles include:

• What is a competent ISO auditor?
• How do you show competence at work?
• How do you monitor the competence of personnel?
• What is competence in quality management?
• How do you create an effective competency matrix?
• How do I become a competent auditor?
• Why is competence important in the workplace?