Training Matrix Requirements for ISO 9001
What ISO 9001 expects from a training matrix, how competence evidence is audited, and how to structure the matrix for a certification audit.
ISO 9001 does not require a training matrix. The standard's competence clause is widely summarised as covering four things: determining the competence needed for work affecting quality performance, ensuring the people doing that work are competent, acting where they are not, and retaining evidence of competence — but the standard's own text is paywalled, so treat that as a general shape rather than a quoted requirement, and check your own copy or your certification body for the exact wording that applies to your scope. A training matrix is simply the most practical way most organisations satisfy that expectation in one artefact — which is why auditors expect to see one even though the standard never names it.
That distinction is worth holding onto, because it explains most audit findings in this area. Organisations get non-conformances not for lacking a matrix but for producing a matrix that records attendance rather than competence, or that has no link to the evidence sitting behind it.
Which edition applies
ISO 9001 is mid-transition, so the edition your certificate is held against matters more than usual right now. ISO 9001:2026 was published on 16 September 2026 and supersedes ISO 9001:2015 (adopted in the UK as BS EN ISO 9001:2015, later amended as BS EN ISO 9001:2015+A1:2024). Organisations already certified to the 2015 edition have a three-year transition period ending 30 September 2029 to move across — during a scheduled surveillance or recertification audit, or through a separate transition audit. That deadline is now formally set rather than anticipated. It comes from Global ACI's transition requirements — Global Accreditation Cooperation Incorporated is the international accreditation organisation that began full operations on 1 January 2026, bringing together the work of the International Accreditation Forum (IAF) and ILAC, and its transition requirements are mandatory for accredited certification bodies — and it is carried through to the UK in UKAS's ISO 9001:2026 transition bulletin. A 2015-edition certificate remains valid until you transition, but the clock is running. Confirm with your certification body when your transition audit is scheduled and which edition your next audit will be against.
Two practical implications while the transition runs:
- Check which edition your certificate is against before assuming a requirement applies. During a transition window, both editions are live in the certified population.
- The competence requirement is among the more stable parts of the standard. The core expectation — determine competence, ensure it, act on gaps, keep evidence — has carried through successive editions. A matrix built to satisfy it is unlikely to need rebuilding, though clause numbering may move.
What an auditor is actually testing
A certification auditor is not checking that a grid exists. They are testing four linked assertions, and the matrix is the entry point to each.
1. That competence requirements were determined, not assumed. The auditor wants to see that someone decided what competence each role needs, on what basis. A matrix whose columns appeared without a documented rationale invites the question "how did you arrive at these?" Keep a short note of the source for each requirement — a regulatory duty, a customer specification, a risk assessment, a process FMEA.
2. That the people doing the work meet those requirements. This is the grid itself: person against requirement, with a status. The common failure is a matrix showing everyone compliant with no indication of when that was established or by whom.
3. That gaps were acted on. Where the matrix shows a shortfall, the auditor will ask what happened next. An open gap is not a non-conformance; an open gap with no action, no owner, and no date is. This is why the matrix should sit alongside a training plan rather than standing alone.
4. That evidence is retained. The matrix is an index, not the evidence. The auditor will sample — pick two or three cells and ask to see what supports them. If the supporting certificate, assessment record, or qualification cannot be produced within a few minutes, the matrix is not doing its job.
That sampling behaviour is the single most useful thing to design for. Our post on training record mistakes covers the record-level failures that surface exactly at this point.
Structuring the matrix for ISO 9001
Scope it to work affecting quality
The standard's concern is work affecting the performance and effectiveness of the quality management system. That is broader than production operatives — it typically includes internal auditors, calibration staff, purchasing, and anyone with authority to release product — but it is narrower than "everyone in the building". Define the scope explicitly and record the reasoning, because an auditor may probe both the inclusions and the exclusions.
Distinguish qualification, training, and demonstrated competence
Three different things that a single tick conflates:
| Evidence type | What it shows | Weakness on its own |
|---|---|---|
| Qualification | Formal credential held | Says nothing about current, task-specific capability |
| Training completed | Attendance at an intervention | Attendance is not learning |
| Demonstrated competence | Assessed performance of the task | Requires observation and a written standard |
ISO 9001 is widely understood to accept education, training, or experience as a legitimate basis for competence, rather than mandating one route — check your own copy of the standard or your certification body's guidance for the precise wording that applies to your certification scope. What auditors will not accept, regardless of the exact clause wording, is a matrix that implies demonstrated competence when the underlying evidence is an attendance sheet. Keep them as separate fields so the claim matches the evidence. Our competency matrix template guide covers writing the assessment descriptors for the third row.
Include the effectiveness check
The requirement to act where competence is lacking carries an implicit second step: confirming the action worked. A matrix that records "training booked" and never returns to reassess leaves the loop open. Add a reassessment date field and treat the gap as closed only when it is populated.
Keep the review cadence documented
Competence requirements change when processes, equipment, customers, or regulations change. Auditors ask when the matrix was last reviewed against current requirements — not when it was last updated with new completions. Those are different questions and most organisations can only answer the second.
A manufacturing worked example
For a small manufacturing operation, the matrix typically spans four competence families:
- Process operation — per line or cell, at the level of the specific machine
- Quality activity — inspection, measurement, calibration, non-conforming product handling
- System roles — internal auditing, corrective action, document control
- Statutory safety — the legal layer, which sits outside ISO 9001 but shares the same grid
Reading the grid by column is where a manufacturing matrix earns its keep: a process step with one competent operator is a business continuity risk that no individual row will reveal. Our skills matrix examples work this reading through on a line team, and the staff training matrix guide covers assigning requirements by role.
The statutory layer underneath
ISO 9001 is a voluntary management standard. The legal duty to ensure competence exists independently of it, and applies whether or not you are certified. Regulation 13 of the Management of Health and Safety at Work Regulations 1999 requires employers to "take into account their capabilities as regards health and safety" in entrusting tasks, and requires health and safety training to "be repeated periodically where appropriate" and to "be adapted to take account of any new or changed risks".
Keeping both layers in one matrix is usually the right call — one grid, with a column indicating whether each requirement is statutory, customer-driven, or system-driven. Maintaining separate matrices for ISO and for health and safety produces two documents that disagree within a year. Our complete guide to what a training matrix is covers the combined structure.
Common audit findings and what causes them
- "Competence requirements not defined for role X." The matrix covers production but omits internal auditors or calibration staff. Scope decision was never written down.
- "Evidence of competence not retained." The matrix is populated but the certificates are on a shared drive nobody can navigate under audit conditions.
- "No evaluation of effectiveness of actions taken." Training was delivered against an identified gap; nothing recorded whether it closed.
- "Matrix not reviewed following process change." A new machine or a new customer requirement arrived and the columns never changed.
- "Attendance recorded as competence." The most common of all, and the one that most undermines the document's credibility once found.
To generate a starting grid pre-loaded for your sector, use the Training Matrix Template Generator, and the Training Compliance Gap Checker will identify where current records fall short before an auditor does.
TrainProof is being built to separate attendance, qualification, and assessed competence by design. Evidence attached to each entry, reassessment dates on every closed gap, and exports that answer an auditor's sampling question in one action. It is in development and not yet available.
Join the waitlist to be notified when it is ready.
This guide is for general information only and does not constitute legal, regulatory, or certification advice. ISO 9001 requirements are set out in the standard itself, available from BSI, and their application depends on your scope of certification. Edition and transition timing should be confirmed with your certification body. Always verify statutory requirements against current legislation and your sector's regulator.
Stop chasing spreadsheets. Get inspection-ready.
TrainProof is coming soon. Join the waitlist to be notified when it is ready.