Competence is a recurring audit pain point. DNV's analysis of 2021 certification audits found clause 7.2 competence was the most common audit finding at the subclause level.
This guide focuses on the competence or training matrix. It also separates that from a clause-to-process matrix and a responsibility matrix. You'll learn what to include, how to build and validate it, when a spreadsheet is enough, and how to avoid common failures.
Key Takeaways
- Link competency requirements to retrievable evidence so auditors can verify qualifications quickly.
- Start with roles and process requirements, then map people, training, and expiry dates.
- Define status labels once, and use them the same way everywhere.
- Update the matrix whenever people, roles, procedures, or sites change.
Three Matrices, Three Different Questions
"ISO 9001 matrix" means different things to different people. ISO 9001:2015 doesn't prescribe any of them, so choose by the question you need answered.
| Matrix | Question it answers | Related requirement (2015) |
|---|---|---|
| Competence/training | Who can do what, and what proves it? | 7.2 Competence |
| Clause-to-process | Where is each requirement addressed? | Process mapping (optional) |
| Responsibility | Who is accountable for what? | 5.3 Roles and authorities |
Those clause references are from ISO 9001:2015. ISO now lists 9001:2026 as the current edition, so confirm clause numbering against the version you're certifying to.
How to Create an Effective ISO 9001 Matrix Template
Step 1: Define the matrix purpose and scope
Pick the primary job of the matrix. This guide uses competence tracking because it's the one auditors sample most, and it requires retained evidence.
Then set the boundaries:
- Who is covered: employees, contractors, departments, sites
- Which work affects product or service quality
- Who owns and maintains the matrix (one named person, not "quality")
Step 2: Identify role-based competency requirements
Start from job descriptions, process requirements, customer or regulatory obligations, risk, and controlled procedures. From these, determine the education, experience, training, and practical ability each role needs.
Tie each requirement to the process, procedure, work instruction, or assessment method behind it. The matrix should explain why a competency is required, not just list course names.
Training isn't the only response to a gap. ISO's Auditing Practices Group guidance lists these valid actions:
- Mentoring
- Hiring
- Reassignment
- Changing job scope
- Subcontracting competent personnel
Step 3: Design the template fields and status logic
Include these fields:
- Name and identifier, role, department, site
- Required competency
- Related procedure and document revision
- Status and completion date
- Assessor
- Evidence or record reference
- Expiry or review date
- Open action
Decide status rules before entering any data. Completed training and verified competence are different things. Define how you'll record pending, expired, not applicable, and remediation-required items.
Step 4: Populate, validate, and maintain the matrix
Build a baseline by reconciling employees, roles, training records, qualifications, assessments, and current document revisions. When information is missing or conflicting, investigate. Never mark an unknown as complete.
Then test:
- Pull a sample of employee and competency records.
- Confirm every status can be backed by evidence.
- Set update triggers: new hires, role changes, procedure revisions, expirations, closed corrective actions.
When to Use an ISO 9001 Matrix, What You Need, and Alternatives
When the matrix is the right fit
A matrix pays off during implementation, internal audit preparation, onboarding, role changes, multi-site coordination, and ongoing monitoring of quality-affecting work.
It becomes risky when:
- It's the only training record
- Several uncontrolled versions circulate
- It tracks irrelevant competencies
- Manual updates have no owner
What to prepare first
Gather before you build:
- Organization chart and job descriptions
- Process maps and controlled procedures
- Training records, qualification requirements, assessment methods
- Employee list, site information, document-control rules
Then assign responsibility for:
- Defining requirements
- Approving training
- Verifying competence
- Maintaining records
- Reviewing the matrix
- Closing gaps
Organizations that struggle to turn complex operations into modular documented systems can get help from Synergistic Systems' ISO consulting and documentation support.
Alternatives to a basic spreadsheet
ISO is format-neutral. Spreadsheets, databases, and electronic QMS platforms are all acceptable, provided the information meets the clause 7.5 document controls.
| Option | Best for | Watch out for |
|---|---|---|
| Controlled spreadsheet | Small, stable scope with a clear owner | Version sprawl, manual expiry tracking |
| Learning management system | Heavy training volume | Completion status isn't proof of competence |
| QMS or quality intranet | Multiple sites, frequent revisions, linked documents | Setup and maintenance effort |
A more integrated system makes sense when the matrix must connect to controlled documents, reminders, assessments, approvals, or several sites. Synergistic Systems, for example, builds its engagements around a cloud-based quality management intranet that hosts controlled documents, records, audits, and corrective actions in one place. There's no established headcount or site threshold for abandoning spreadsheets, so decide based on retrieval speed and maintenance burden.
Key Fields and Parameters That Make an ISO 9001 Matrix Effective
These are information categories, not ISO-mandated column names.
Scope, identity, and role mapping
Each record should identify person, role, department, site, employment status, and applicable process. That prevents confusion between similarly titled positions and keeps inactive workers out of the data.
Map role requirements before assigning individual training. Each requirement is then mandatory, conditional, or not applicable for that person.
Competency requirements and status definitions
Define each competency in observable terms: the knowledge, skill, authorization, or practical performance required. "Quality training" tells an auditor nothing.
Use controlled statuses:
- Required, scheduled, or in training
- Trained or competence verified
- Expired or not applicable
- Corrective action required
Attendance alone may not prove competence. ISO 9001 Auditing Practices Group (APG) guidance notes that a record can show course completion without showing the person applies the knowledge effectively.
Common assessment methods include:
- Observation
- Peer review
- Record review
- Interviews
Evidence, document version, and traceability
Every "trained" or "verified" status should point to evidence: a training record, assessment, qualification, sign-off, or experience record. Add the date and the evaluator.
Link requirements to the current approved procedure or work instruction revision. When a revision is approved, review the affected personnel and retrain where needed.
Expiry, review, ownership, and action control
Add expiry or review dates for licenses, certifications, recurring training, and other time-sensitive qualifications. Not every competency needs an arbitrary expiration date.
Also track an owner, review date, gap or action field, and completion status. A matrix that only displays deficiencies doesn't fix them.
Multi-site and system integration
IAF MD 1:2023 requires a multi-site organization to run a single, centrally controlled management system. It doesn't prescribe a central training-matrix file. Use consistent competency definitions and status rules across sites, and retain site-specific legal, customer, or equipment requirements.
Connect the matrix to document control, onboarding, change management, internal audits, nonconformity correction, and management review. Link to those source records instead of duplicating them.
Common Mistakes and Troubleshooting an ISO 9001 Matrix
Problem 1: The matrix says "trained," but competence can't be shown
Likely cause: The organization records attendance but defines no assessment, practical demonstration, or sign-off.
Fix:
- Review the role requirement
- Identify the missing evidence
- Rewrite the status definition
- Document any added training or evaluation
Problem 2: Obsolete procedures or expired qualifications
Likely cause: The matrix lives apart from document control and expiry monitoring, so revisions and expiring credentials trigger nothing.
Fix:
- Compare entries with current approved revisions and qualification dates
- Identify affected personnel
- Assign retraining or renewal with named owners
Problem 3: Too complex, inconsistent, or rarely updated
Likely cause: The template tracks every possible course, uses inconsistent labels, and has no review owner.
Fix:
- Cut it down to role-critical competencies
- Standardize field values
- Remove duplicates
- Set a review schedule
- Run a simple test: can someone retrieve the evidence for a chosen person and requirement in under a minute?
Conclusion
An effective matrix connects role requirements, current competence, controlled documents, evidence, expiry dates, and follow-up actions. The best template is the one that stays accurate, traceable, and useful day to day, not the most detailed version on paper.
Most failures come from vague requirements, unsupported status claims, outdated records, or no owner. The choice between spreadsheet and software matters far less than keeping those fundamentals solid.
Start with role and process requirements. Check the evidence behind your existing entries. Then refine the system as operations teach you what's needed.
Frequently Asked Questions
How do I get ISO 9001 compliant?
Establish, implement, maintain, and improve a QMS against the applicable ISO 9001 requirements, including documented evidence of competence. Verify requirements against the current edition and your scope.
What is a nonconformity under ISO 9001?
It's the non-fulfillment of a requirement. An incorrect, unsupported, or outdated matrix entry can contribute to a competence-related nonconformity.
What is the ISO standard for compliance?
ISO 9001 is the international standard for quality management systems. Certification comes from an independent certification body, not ISO, after assessing your implementation.
What are the 6 mandatory procedures for ISO 9001?
There aren't any in the 2015 edition. ASQ notes the revision removed the requirement for a manual and six required procedures. Required documented information still depends on the standard and your processes.
What are the 10 clauses of ISO 9001?
ISO 9001:2015 has ten clauses. Clauses 1-3 cover scope, normative references, and terms. Clauses 4-10 hold the principal requirements: context, leadership, planning, support, operation, performance evaluation, and improvement.
What does QMS stand for?
Quality management system. It's the coordinated set of processes, responsibilities, controls, and documented information an organization uses to meet requirements consistently and improve.
