Resources, Competence, Knowledge and Documented Information

Introduction and context

A quality management system (QMS) cannot perform better than the resources, knowledge, competence and information that sustain it. ISO 9001:2015 therefore places resource management at the centre of the system. Clause 7, “Support,” connects organizational intentions with operational capability. It addresses people, infrastructure, the environment for operation of processes, monitoring and measuring resources, organizational knowledge, competence, awareness, communication and documented information.

These requirements should not be interpreted as an administrative checklist. They express a systems principle: quality depends on the interaction between capable people, suitable technology, reliable information and controlled working conditions. A technically excellent procedure is ineffective if employees have not been trained, equipment is unsuitable, records are unreliable or critical knowledge disappears when experienced staff leave.

For postgraduate managers and quality professionals, the important question is not simply whether resources exist. It is whether resources are adequate for the organization’s context, risks, objectives, processes and changing requirements.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Explain the relationship between resources, process capability and quality performance.
2. Plan people, infrastructure, work environments and monitoring resources for a QMS.
3. Establish systems for organizational knowledge, competence and awareness.
4. Distinguish documented information that must be maintained from information that must be retained.
5. Design controls for approval, access, change, distribution, retention and disposition of information.
6. Evaluate digital-document and data-integrity risks.
7. Apply Clause 7 principles to a realistic organizational case.

1. Resource management as a quality-system capability

A resource is anything required to establish, implement, maintain or improve a process. Resources may be tangible, such as buildings, machines and measurement devices, or intangible, such as competence, software, knowledge and organizational culture.

A useful planning logic is:

Process requirement → required capability → resource provision → evidence of effectiveness → improvement.

For example, a laboratory process requiring measurements within a specified tolerance needs suitable instruments, a controlled environment, competent analysts, valid methods, calibration and reliable records. Providing only the instrument does not establish capability.

Resource decisions should be risk-based. The organization should consider:

• the complexity and criticality of the process;
• product, service and regulatory requirements;
• foreseeable failure modes;
• demand, workload and capacity;
• competence and availability of personnel;
• technological change and cybersecurity;
• maintenance, calibration and continuity needs;
• environmental and occupational-health conditions.

Resource adequacy is dynamic. A resource that was sufficient at one production volume may become inadequate after a major contract, new product, software change or staff turnover. Consequently, resource planning should be reviewed during management review, operational planning, change management and corrective-action activities.

2. People: capacity, roles and accountability

People are a resource and also the primary agents through whom the QMS operates. ISO 9001 requires the organization to determine and provide the persons necessary for the effective implementation of its QMS and for the operation and control of its processes. This includes permanent employees, temporary workers, contractors and, where relevant, outsourced personnel.

Workforce planning should address both quantity and quality. Quantity concerns staffing levels, shift coverage, succession and workload. Quality concerns competence, authority, communication, behavioural expectations and the ability to make decisions affecting conformity.

A practical workforce-resource matrix may include:

Roles should be supported by clear authority. A person responsible for releasing product, stopping production or approving a deviation needs the authority and information necessary to perform that role. Ambiguous accountability can cause both quality failures and unfair attribution of blame.

Organizations should also consider human factors. Excessive workload, fatigue, poor interface design, inadequate staffing and confusing instructions increase error probability. Quality management is not strengthened by treating every human error as an individual disciplinary failure; it is strengthened by examining the system conditions that made the error likely.

3. Infrastructure and the environment for operation

3.1 Infrastructure

Infrastructure includes buildings and associated utilities, equipment, transportation resources, information and communication technology, and supporting services. It should be managed through a life-cycle perspective:

1. determine functional and capacity requirements;
2. select or design the infrastructure;
3. commission and validate it where necessary;
4. operate and maintain it;
5. monitor performance and failure trends;
6. renew, upgrade or retire it in a controlled manner.

Maintenance should be proportional to risk. Preventive maintenance is planned before failure; predictive maintenance uses condition information to anticipate failure; corrective maintenance restores function after failure. A mature system combines these approaches rather than assuming that a single maintenance policy is suitable for every asset.

Important infrastructure controls include identification of critical assets, maintenance schedules, spare-parts planning, utilities continuity, backup arrangements, software support and escalation procedures. For information technology, infrastructure planning should include access management, backup, recovery testing, patching and protection against malware or unauthorized alteration.

3.2 Environment for operation of processes

The process environment includes physical, social and psychological conditions. Depending on the activity, relevant conditions may include temperature, humidity, cleanliness, lighting, noise, vibration, contamination control, ergonomics, personal safety, respectful behaviour and stress levels.

The organization should determine which environmental factors can affect conformity and establish suitable controls. For example, a pharmaceutical operation may require controlled temperature and contamination conditions, while a call centre may be more affected by acoustics, workstation ergonomics and workload management.

The environment requirement is not limited to physical conditions. Bullying, discrimination, fear of reporting problems or a culture that rewards shipment at any cost can undermine quality even when facilities are technically adequate. Leadership therefore has a direct role in creating a culture in which employees can report defects, near misses and process weaknesses without retaliation.

4. Monitoring and measuring resources

Monitoring determines the status of a process, product or service. Measurement assigns a value to a characteristic. A monitoring resource may be an observation method, dashboard or inspection activity; a measuring resource may be a gauge, sensor, test method or software system.

When measurement is used to verify conformity, the organization should ensure that the resource is suitable and maintained. Relevant controls may include:

• identification and unique status;
• calibration or verification at specified intervals;
• traceability to recognized measurement standards where applicable;
• protection from damage, adjustment or deterioration;
• documented results and decisions concerning validity;
• action when equipment is found unsuitable.

Calibration and verification are not identical. Calibration establishes the relationship between instrument indications and reference values, generally with stated uncertainty. Verification provides objective evidence that specified requirements have been met. An organization may use verification without a formal calibration activity when the application and risk justify it, but it must still demonstrate suitability.

Measurement uncertainty is important when a result lies near a specification limit. A decision rule should be defined where acceptance depends on the relationship between a measured value, uncertainty and tolerance. The organization should not automatically treat a displayed value as exact.

If a device is found to be unfit, the organization should assess whether previous inspection or test results may have been affected. This may require product review, retesting, customer notification or corrective action. The response should be based on evidence and risk rather than merely replacing the instrument.

5. Organizational knowledge

Organizational knowledge is knowledge specific to the organization and gained through experience. It includes information needed to operate processes and achieve conformity. Sources may be internal, such as lessons learned, design expertise, process experience and improvement results, or external, such as standards, technical publications, suppliers, customers and professional networks.

Knowledge differs from documented information. Knowledge may exist in people’s experience, routines, models, software configurations or networks; documented information is one possible representation of that knowledge. A controlled document cannot replace understanding, judgement and practical skill.

A knowledge-management system should answer four questions:

1. What knowledge is necessary for critical processes?
2. Where is it located and who possesses it?
3. How is it protected, shared and updated?
4. How is new knowledge captured from experience and change?

Useful mechanisms include communities of practice, mentoring, job rotation, structured handovers, lessons-learned reviews, post-project evaluations, fault databases, process simulations and succession plans. Knowledge risk is especially high where a process depends on one expert, obsolete software, undocumented customer expectations or tacit troubleshooting skill.

Knowledge should be evaluated for relevance and currency. Retaining large quantities of obsolete information can be as harmful as losing information because employees may follow an incorrect instruction. A knowledge owner should therefore be assigned for critical repositories and technical content.

6. Competence, awareness and development

6.1 Competence as demonstrated capability

Competence is the ability to apply knowledge and skills to achieve intended results. It is not synonymous with attendance at training. A person may attend a course without being able to perform the task reliably, while another person may be competent through education, experience, supervised practice or demonstrated performance.

Competence requirements should be defined for work that affects product or service conformity, including work performed by external providers where relevant. A competence profile may specify education, technical knowledge, practical skill, regulatory authorization, behavioural capability and experience.

The competence cycle is:

Determine requirements → assess the gap → provide development → evaluate effectiveness → maintain evidence.

Methods for evaluating effectiveness include direct observation, practical demonstrations, examination, first-pass yield, error trends, supervised release, audit results and customer feedback. The method should reflect the risk of the work. A written quiz may be adequate for awareness of a policy but insufficient for authorizing a person to operate complex equipment.

Training-needs analysis should distinguish among knowledge gaps, skill gaps, motivation problems and system deficiencies. Training is not an appropriate solution for every performance problem. If an instruction is unavailable, equipment is defective or workload is impossible, further training may not solve the underlying cause.

6.2 Awareness

People performing work under the organization’s control should be aware of the quality policy, relevant quality objectives, their contribution to QMS effectiveness and the implications of not conforming to QMS requirements. Awareness should be connected to actual work. Employees should understand not merely that “quality is important,” but how their decisions affect customers, risks, legal requirements, process performance and downstream users.

Effective awareness methods include induction, team briefings, visual process information, quality alerts, toolbox talks, management communication and discussion of real incidents. Awareness is strengthened when leaders demonstrate that quality requirements apply during urgent production, cost pressure and conflicting priorities.

7. Communication and documented information

Communication is a resource-control mechanism. The organization should determine what needs to be communicated, when, to whom, how and by whom. Internal communication may concern objectives, process changes, incidents, audit findings and lessons learned. External communication may concern customers, regulators, suppliers, certification bodies and service providers.

Poor communication often appears as a documentation problem but may actually be a governance problem. A procedure may be available yet not communicated to the people who need it. Conversely, excessive communication can obscure critical information. Communication should therefore be timely, audience-appropriate, traceable where necessary and protected when confidential.

7.1 Maintained and retained documented information

ISO 9001 uses “documented information” as an inclusive term. It includes information that the organization must control and maintain, such as procedures or process descriptions, and information that provides evidence of results, such as inspection records or training records.

A useful distinction is:

The standard does not require every activity to have a formal procedure. The extent of documentation should reflect organizational size, process complexity, competence, risk and the need to demonstrate conformity. Over-documentation can create obsolete bureaucracy; under-documentation can create variation and dependence on memory.

7.2 Document-control attributes

Controls commonly include:

• identification and description, including title, owner, date or reference number;
• format and media, including electronic, paper, audio or visual forms;
• review and approval for suitability and adequacy;
• controlled access and availability at the point of use;
• protection from loss of confidentiality, improper use or loss of integrity;
• distribution and retrieval of obsolete versions;
• control of changes and revision status;
• retention and disposition;
• control of externally originated information needed for planning or operation.

Document control should be proportionate. A low-risk team checklist may require a simple owner and revision date, whereas a regulated design record may require electronic signatures, audit trails, formal approval and long-term retention.

7.3 Digital documents and data integrity

Digitalization improves searchability, collaboration and analytics, but it introduces risks. These include unauthorized alteration, accidental deletion, uncontrolled copying, ambiguous version status, unavailable cloud services, weak authentication and loss of metadata.

Data integrity means that data remain complete, consistent, accurate, attributable, legible, contemporaneous, original or a true copy, and available throughout the required life cycle. Appropriate controls may include role-based access, multi-factor authentication, version control, immutable audit trails, validated workflows, backups, recovery tests, time synchronization, encryption and segregation of duties.

A backup is not automatically a usable recovery system. Recovery should be tested periodically, including restoration of critical records and associated metadata. A document-management system should also prevent users from unknowingly applying a superseded instruction. Where paper copies are permitted, their status and distribution should be controlled.

Artificial intelligence can assist with document classification, search, duplicate detection, translation and draft generation. However, AI-generated content may contain inaccurate, incomplete or fabricated information. Critical procedures, specifications and records require human approval, source verification, access control and traceability of changes. Confidential QMS information should not be entered into an AI service unless contractual, privacy and cybersecurity controls permit it.

8. Integrated implementation framework

A practical implementation sequence is as follows:

Step 1: Map critical processes

Identify processes, outputs, risks, legal requirements, interfaces and quality objectives.

Step 2: Define capability requirements

For each process, determine required people, infrastructure, environmental conditions, monitoring resources, knowledge and documented information.

Step 3: Assess gaps and risks

Compare current capability with requirements. Consider single points of failure, obsolete technology, competence gaps, unreliable records and supplier dependencies.

Step 4: Establish controls

Assign owners, provide resources, define competence criteria, approve information and implement access, maintenance, calibration and retention controls.

Step 5: Verify effectiveness

Use process indicators, audit findings, incident trends, training evaluations, measurement-system analysis, record reviews and feedback.

Step 6: Improve and adapt

Update resources after changes, failures, new risks, customer requirements, regulatory developments or lessons learned.

A useful governance device is a resource-and-information register. It can identify each critical resource, owner, status, review date, risk, evidence and escalation path. The register should support management decisions rather than become an additional uncontrolled spreadsheet.

9. Illustrative case: Meridian Medical Devices

Background

Meridian Medical Devices is a fictional manufacturer of disposable diagnostic cartridges. Its QMS had been certified for several years. The organization experienced an increase in customer complaints involving inconsistent test readings after moving final inspection to a second shift.

Problem

An investigation found that the second shift used an older version of the inspection instruction. The measurement device had passed its calibration interval by three weeks. The newly assigned inspectors had attended induction training but had not completed practical authorization. The experienced first-shift inspector, who understood several undocumented troubleshooting steps, had recently resigned.

Analysis

The issue was not a single employee mistake. It involved interconnected failures:

• staffing and competence planning did not reflect the second-shift expansion;
• document distribution allowed an obsolete printed instruction to remain at the workstation;
• calibration status was not visible in the digital production system;
• organizational knowledge had not been captured before staff departure;
• training effectiveness was inferred from attendance rather than demonstrated performance;
• management review did not connect complaint trends with resource risks.

Approach and solution

Meridian introduced a risk-ranked competence matrix and required supervised practical demonstration before inspection authorization. The workstation received controlled electronic instructions with read-only access and automatic version display. Printed copies were removed unless specifically authorized.

The organization revised its measurement-resource register, added automated calibration alerts and required a documented impact assessment whenever equipment was overdue. It conducted a retrospective review of lots inspected with the overdue device. A structured knowledge-capture workshop documented troubleshooting decisions, failure signatures and escalation rules.

The company also changed its shift-planning process. A competent quality representative was assigned to each shift, and a minimum coverage rule prevented simultaneous absence of all authorized inspectors. Training effectiveness was reviewed through observed inspections and comparison of error rates before and after authorization.

Outcome

In this illustrative case, repeat inspection identified affected lots, and the organization completed customer communication where required. Subsequent internal audits found no obsolete instructions at controlled workstations. Inspection errors declined, and management review began treating competence, calibration and document status as connected process-capability issues rather than separate administrative topics.

Learning points

1. Resource adequacy must be evaluated after organizational or operational change.
2. Training attendance is not evidence of competence.
3. Document control must work at the point of use.
4. Measurement-resource failures require an assessment of earlier results.
5. Tacit knowledge is a quality risk when it is not captured and shared.
6. Effective corrective action addresses system relationships, not only symptoms.

10. Challenges, limitations and governance considerations

Resource planning may conflict with short-term cost reduction. Reducing maintenance, training or staffing can create delayed quality costs, including rework, complaints, regulatory action and loss of trust. Managers should evaluate total risk and life-cycle cost rather than purchase price alone.

Outsourcing does not transfer ultimate responsibility for QMS effectiveness. The organization must define requirements, evaluate external-provider competence, control interfaces and retain evidence of conformity.

Privacy and confidentiality must be considered when competence records, medical information, employee evaluations, customer data or proprietary technical information are stored. Access should follow legitimate need, legal requirements and retention rules. Records should not be retained indefinitely merely because storage is inexpensive.

A further limitation is that documented information can create an illusion of control. A signed form does not prove that a process was effective, and a high number of procedures does not demonstrate maturity. Evidence should be triangulated through observation, outcomes, interviews, process data and customer feedback.

Best-practice principles

• Design resources around process risks and intended results.
• Treat competence as demonstrated capability, not training attendance.
• Make critical information available at the point of use.
• Assign owners for knowledge, documents, assets and records.
• Keep controlled information current and remove obsolete versions.
• Validate systems that generate, transform or retain critical data.
• Test backup and recovery rather than assuming they work.
• Review the impact of failed measurement resources on prior decisions.
• Capture tacit knowledge before role changes or staff departure.
• Use audits and management review to evaluate effectiveness, not merely presence.

Chapter Summary

ISO 9001 Clause 7 establishes the support capability of a quality management system. Organizations must determine and provide suitable people, infrastructure, process environments, monitoring and measuring resources, and organizational knowledge. These resources must be planned in relation to process risks, customer requirements, legal obligations and organizational change.

Competence is the demonstrated ability to achieve intended results. Effective systems define competence requirements, identify gaps, provide development and evaluate effectiveness. Awareness connects individual work with quality policy, objectives, customer expectations and the consequences of nonconformity.

Documented information includes both maintained information that directs work and retained information that provides evidence. Effective control requires approval, identification, access, version management, protection, retention and disposition. Digital systems add requirements for authentication, audit trails, backup, recovery, cybersecurity and data integrity. Technology and AI can support information management but do not remove the need for human accountability and verification.

The central managerial lesson is that people, knowledge, measurement, infrastructure and documentation form an integrated capability. Failures frequently occur at their interfaces. A mature QMS therefore evaluates not only whether resources exist, but whether they are adequate, controlled, current, accessible and effective.

Key Terms

Organizational knowledge: Knowledge specific to an organization that supports its processes and conformity.

Competence: Ability to apply knowledge and skills to achieve intended results.

Awareness: Understanding of relevant policies, objectives, contribution and consequences of nonconformity.

Infrastructure: Facilities, equipment, utilities, transport, information technology and supporting services.

Process environment: Physical, social and psychological conditions in which work is performed.

Monitoring: Determining the status of a system, process or activity.

Measurement: Determining a value for a characteristic.

Calibration: Establishing the relationship between instrument indications and reference values.

Verification: Confirmation that specified requirements have been fulfilled.

Documented information: Information required to be controlled and maintained, together with its medium.

Maintained information: Current information describing how work is intended to be performed.

Retained information: Evidence of results or activities completed.

Version control: Management of revisions so that the current authorized version is identifiable.

Data integrity: Continued completeness, consistency, accuracy, attribution, availability and protection of data.

Tacit knowledge: Experience-based knowledge that may be difficult to express formally.

Training effectiveness: Evidence that development enabled the required competence or performance.

Measurement uncertainty: Quantitative expression of doubt associated with a measurement result.

Retention period: Defined time for which documented information is kept.

Review Questions

Short Answer Questions

1. What is the difference between monitoring and measurement?
2. Why is training attendance insufficient evidence of competence?
3. Distinguish maintained documented information from retained documented information.
4. Identify four controls used to protect digital QMS information.
5. Why should an organization capture tacit knowledge?

Long Answer Questions

1. Explain how people, infrastructure, process environment and organizational knowledge interact to support process capability.
2. Develop a competence-management system for a high-risk manufacturing process.
3. Discuss the principles of monitoring and measuring resources, including the response to unsuitable equipment.
4. Evaluate the advantages and limitations of extensive documentation in a QMS.
5. Explain how a digital document-management system can protect data integrity throughout the information life cycle.

Analytical / Application Questions

1. A company expands from one production shift to three but retains the same training, maintenance and document-distribution arrangements. Analyze the likely quality risks and propose a prioritized resource plan.
2. An inspection record shows a conforming result, but the measuring device was later found to be damaged. Design an investigation and decision process for assessing affected product.
3. A critical procedure is generated with AI and uploaded to the QMS without technical review. Evaluate the governance risks and specify controls required before use.

Multiple Choice Questions with Answers

Question 1

Which statement best describes competence in an ISO 9001 quality management system?

A. Attendance at a required training course

B. The ability to apply knowledge and skills to achieve intended results

C. Length of service in the organization

D. possession of a formal academic qualification

Correct Answer: B. The ability to apply knowledge and skills to achieve intended results

Question 2

Which item is an example of retained documented information?

A. An approved work instruction

B. A current quality policy

C. A completed inspection record

D. A draft process map

Correct Answer: C. A completed inspection record

Question 3

What is the primary purpose of calibration?

A. To train operators in equipment use

B. To establish the relationship between indications and reference values

C. To approve a supplier

D. To determine employee workload

Correct Answer: B. To establish the relationship between indications and reference values

Question 4

Which action best controls obsolete documented information at the point of use?

A. Increasing the number of printed copies

B. Allowing employees to select whichever version they prefer

C. Using controlled access with identifiable revision status

D. Removing document titles

Correct Answer: C. Using controlled access with identifiable revision status

Question 5

Which is an example of organizational knowledge?

A. An employee’s private bank statement

B. A machine troubleshooting lesson learned from previous failures

C. An unrelated newspaper article

D. A personal holiday schedule

Correct Answer: B. A machine troubleshooting lesson learned from previous failures

Question 6

What should an organization generally do when a measuring device is found unsuitable?

A. Ignore earlier results automatically

B. Destroy all associated records

C. Assess the validity of previous measurement results and take appropriate action

D. Continue using the device without review

Correct Answer: C. Assess the validity of previous measurement results and take appropriate action

Question 7

Which activity is the strongest evidence of training effectiveness for an equipment operator?

A. A signed attendance sheet only

B. A practical demonstration under defined conditions

C. The employee’s job title

D. The number of pages in the training manual

Correct Answer: B. A practical demonstration under defined conditions

Question 8

Which control most directly supports digital data integrity?

A. Unlimited editing rights

B. Uncontrolled duplicate files

C. Role-based access and an auditable change history

D. Deletion of metadata

Correct Answer: C. Role-based access and an auditable change history

Question 9

Why is the process environment relevant to quality?

A. Only because it affects building appearance

B. Because physical, social and psychological conditions can affect conformity

C. Because it replaces the need for competence

D. Only because certification bodies require decoration standards

Correct Answer: B. Because physical, social and psychological conditions can affect conformity

Question 10

Which sequence best represents a competence-management cycle?

A. Train everyone, archive records, ignore performance

B. Determine requirements, assess gaps, develop capability, evaluate effectiveness

C. Purchase equipment, write a policy, dismiss trainees

D. Audit documents, remove objectives, repeat training indefinitely

Correct Answer: B. Determine requirements, assess gaps, develop capability, evaluate effectiveness