At a glance
ISO 9001 organizational knowledge: identify, transfer, preserve, and test the know-how your processes need without creating a document dump.
- Focus: ISO 9001 organizational knowledge · organizational knowledge ISO 9001
- Read time: 12 minutes
- Updated: August 20, 2026
The Short Answer: Treat Knowledge as a Process Resource
ISO 9001 organizational knowledge is the practical know-how an organization needs to run its processes and consistently meet requirements. It can live in approved specifications and work instructions, but it can also be held in the experience of people, embedded in a workflow, or learned from customers, suppliers, incidents, and improvement work. The important question is not “Where is the biggest library?” It is “What knowledge does this process need at the moment a decision must be made, and can the right people use it?”
ISO identifies ISO 9001:2015 as the current published edition and lists resources, competence, awareness, communication, and documented information among the topics of a quality management system. Its public information says a revised edition is expected in September 2026. Use the current controlled edition for clause-level decisions, then assess the published revision when it is available. ISO’s current ISO 9001 overviewISO’s current ISO 9001 overviewhttps://www.iso.org/standard/62085.html is the appropriate public starting point.
The ISO 9001 Auditing Practices Group (APG)ISO 9001 Auditing Practices Group (APG)https://committee.iso.org/home/tc176/iso-9001-auditing-practices-group.html provides useful practitioner material on organizational knowledge. The APG also makes an important limitation clear: its papers are educational guidance, not specified requirements or universal audit criteria. The framework below is therefore a way to make an evidence-led decision, not a mandatory template.
Reader snapshot: Begin with the process result at risk. Identify the knowledge needed, how it is made available, the event that could make it unavailable, and the evidence that shows the control still works.
Why a Document Register Is Not a Knowledge System
Documented information can preserve important knowledge, but a current document alone does not prove that the required knowledge is understood, available at the point of use, or adequate for a changed situation. A technician may have the latest instruction but lack the judgment needed to respond to an unusual condition. A senior buyer may know a critical supplier’s change history, but that knowledge can disappear during a role change if no one identifies the exposure.
The APG’s organizational-knowledge paper makes this distinction directly: documented information may contain knowledge, yet its presence does not by itself show that organizational knowledge has been appropriately determined. This is why a useful organizational knowledge ISO 9001 review follows a process, its decisions, and its results rather than simply counting stored files.
| Weak question | Better question | Evidence that could help |
|---|---|---|
| “Do we have a procedure?” | “What must the process owner know to make this decision correctly?” | Current specification, decision criteria, experienced-person interview, completed sample. |
| “Is the document controlled?” | “Can the person at the point of use find and apply the current knowledge?” | System access, point-of-use observation, revision history, sample transaction. |
| “Was training completed?” | “What shows that the person can use the knowledge in this situation?” | Observed work, qualification evidence, supervised sample, error or rework trend. |
| “Is there a backup?” | “What happens if the usual knowledge holder is absent, changes role, or leaves?” | Cross-training plan, handover record, role coverage test, succession discussion. |
Build a Knowledge Map Around Actual Process Exposure
Stay Current
ISO 9001:2026 publishes September 16, 2026. Get weekly briefings.
The ISO 9001:2015 organizational-knowledge requirement (Clause 7.1.6) can be approached with a simple knowledge map. Its job is to make a decision path visible before a resignation, system change, supplier change, customer escalation, or new product exposes a gap. Start with processes that have a meaningful effect on customer requirements, conformity, delivery, compliance, safety, or continuity.
| Process or decision point | Knowledge needed | Likely source or holder | Exposure trigger | Suitable control | Availability test |
|---|---|---|---|---|---|
| Contract review | Customer-specific technical and delivery requirements | Contract files, applications engineer, sales lead | New customer term or staff change | Controlled review criteria and paired review for complex orders | Trace one recent order from requirement to confirmation. |
| Production release | Acceptance limits and response to an abnormal result | Specification, work instruction, experienced operator | New material, equipment change, shift coverage | Point-of-use access plus supervised demonstration for designated roles | Ask a trained backup to explain and perform the response. |
| Supplier change | Approved source history and critical input controls | Supplier record, purchasing, quality, incoming data | Supplier ownership, material, or process change | Change-review trigger and cross-functional decision record | Review one changed supplier record and the resulting verification. |
| Corrective action | Prior failure patterns and controls that have already been tested | Action records, process owner, trend data | Repeat issue or new site/team | Searchable issue history and effectiveness review | Test whether a team can find and use a relevant prior lesson. |
The map should be proportionate. A low-consequence administrative activity may need only a current instruction and basic role cover. A specialized process with a narrow expert base may require more deliberate transfer, verification, and protection. The point is not to score every person. It is to identify the knowledge that could prevent a process from achieving its intended result.
Separate Knowledge From Competence, Then Connect Them
Knowledge and competence overlap, but they answer different questions. Knowledge is what the organization needs to know. Competence concerns a person’s ability to apply relevant knowledge and skills. A team can have a well-organized knowledge base and still need to confirm that the assigned people can use it correctly. Conversely, one highly competent person can create organizational risk when important know-how is only held in that person’s experience.
Use the following sequence when a critical role or process changes:
- Define the decision or result. State the process outcome that must be protected, such as correct contract acceptance, conforming release, or timely customer response.
- Name the knowledge components. Include explicit information, practical judgment, interfaces, common failure modes, and escalation contacts where relevant.
- Choose a transfer route. This might be a controlled instruction, a paired review, mentoring, supervised practice, a recorded decision rationale, or a combination.
- Verify usable access. Check that the intended backup or new role holder can locate, interpret, and apply the knowledge in a representative situation.
- Review after change. Use errors, questions, audit findings, delivery results, or customer feedback to decide whether the control actually protected the process.
This sequence supports the ISO 9001 competence and training guideISO 9001 competence and training guide/article/iso-9001-2026-competence-training-clause-7-2 without assuming that a course-completion record is sufficient evidence for every role. It also gives useful inputs to a management reviewmanagement review/article/iso-9001-2026-management-review-clause-9-3-what-changes when knowledge exposure affects performance or continuity.
Use Change and Failure as Knowledge Signals
Stable routines can hide knowledge gaps. A better time to review knowledge is when the process changes or when evidence suggests it is not achieving its intended result. The APG paper offers internal and external examples, including learning from failures and successes, customer and supplier feedback, mentoring and succession planning, benchmarking, and improvement results. Treat these as possible sources to evaluate, not a required list.
| Signal | Question to ask | Possible response |
|---|---|---|
| A long-tenured specialist plans to leave | Which decisions or exceptions rely on their experience? | Prioritize a handover, paired cases, and a practical coverage test. |
| A repeat nonconformity occurs | Did the team already have relevant knowledge but fail to access or apply it? | Link the corrective action to the knowledge source and point-of-use control. |
| A new customer or technology changes the process | What new knowledge is needed before work begins? | Update the process review, source the knowledge, and confirm role competence. |
| A supplier changes an input | Who knows the prior acceptance logic and how will the change be evaluated? | Trigger a cross-functional review with controlled evidence. |
| An internal audit identifies inconsistent decisions | Is the knowledge unclear, unavailable, or applied differently by role? | Trace the decision path before adding another document. |
For a recurring issue, use the ISO 9001 corrective-action guideISO 9001 corrective-action guide/article/iso-9001-corrective-action-guide to separate an immediate correction from the action needed to change the recurrence mechanism. A useful knowledge control should make future decisions more reliable, not merely add another location to search.
A Worked Example: Quotation Knowledge That Lives With One Engineer
Consider a manufacturer whose senior applications engineer reviews unusual customer requirements before quotations are issued. The organization has specifications and prior quotations, but the engineer also knows which combinations of material, tolerance, test method, and delivery promise created problems in the past.
The risk is not solved by saving a general job description. A proportionate knowledge map might identify the exceptional-review decision, list the current information and historical cases used, assign a technical backup, require paired review on selected live quotations, and define a trigger for revisiting the control after the next unusual order or a customer escalation.
The availability test is practical: can the backup explain why a particular requirement needs escalation, find the relevant evidence, and reach a defensible decision with the appropriate support? That test gives stronger evidence than a folder created after the expert has already left.
Audit Questions That Test Use, Not Storage
Internal auditors do not need to treat organizational knowledge as a standalone document audit. They can follow a process and ask how the organization knows the knowledge needed to operate it is available. The questions below are adaptable prompts, not an audit script.
| Audit focus | Practical question | Evidence path |
|---|---|---|
| Process knowledge | “What information or experience is necessary for this decision to be made correctly?” | Follow a recent transaction, specification, and responsible role. |
| Availability | “How can the person performing this work access the current knowledge when needed?” | Observe point-of-use access and ask the role holder to locate it. |
| Tacit knowledge | “Which results depend on experience that is not fully captured in a document?” | Interview the process owner and examine planned role coverage or mentoring. |
| Change response | “What changed recently, and how did the team determine what new knowledge was needed?” | Review the change record, training or communication evidence, and early results. |
| Effectiveness | “What result tells you the knowledge control is supporting the intended process outcome?” | Trend, audit sample, error pattern, rework data, or customer feedback. |
Our ISO 9001 internal audit questions guideISO 9001 internal audit questions guide/article/iso-9001-internal-audit-questions-guide provides a broader process-and-evidence approach. Pair it with the email-gated ISO 9001 Gap Analysis TemplateISO 9001 Gap Analysis Template/resources/gap-analysis-template when the team needs a structured way to map current QMS controls before a material change.
Preparing for ISO 9001:2026 With Current Evidence
ISO says that a revised ISO 9001 edition is expected in September 2026. Until that edition is published, ISO 9001:2015 remains the current reference. Organizations can strengthen knowledge availability now because it supports current process control, competence, and improvement. They should not assert compliance with unpublished 2026 requirements or treat commentary as final clause text.
When the revised edition is published, use a controlled impact assessment to compare the published text with the organization’s existing knowledge and competence controls. Our current ISO 9001 version guidecurrent ISO 9001 version guide/article/iso-9001-current-version-2026 and transition guidetransition guide/article/how-to-transition-iso-9001-2015-to-2026 explain how to separate reliable preparation from unsupported future-edition claims.
Frequently Asked Questions
What is organizational knowledge in ISO 9001?
It is the knowledge an organization needs to operate its QMS processes and achieve conformity of products and services. It can include controlled information, experience, process know-how, technical knowledge, and lessons from internal or external sources.
Does ISO 9001 require a knowledge-management system?
Do not assume that ISO 9001 prescribes one software platform, database, or document structure. Choose controls that fit the organization’s processes, risks, people, and context, then retain evidence that the needed knowledge is available and usable.
Is documented information the same as organizational knowledge?
No. Documented information can preserve and communicate knowledge, but it is not automatic proof that needed know-how is determined, available, understood, or applied effectively in a process.
How can we protect knowledge when an experienced employee leaves?
Identify the decisions and process results that depend on the person’s experience. Then use proportionate handover, pairing, mentoring, controlled records, and a practical availability test before the role changes where possible.
How should an auditor assess organizational knowledge?
An auditor can follow a real process and examine how the organization determined the knowledge needed, made it available, responded to change, and checked whether the resulting control supports the intended process outcome. The depth should fit the process and exposure.
Official Sources and Related Resources
- ISO 9001:2015 catalogue record and current-edition overviewISO 9001:2015 catalogue record and current-edition overviewhttps://www.iso.org/standard/62085.html.
- ISO 9001 Auditing Practices GroupISO 9001 Auditing Practices Grouphttps://committee.iso.org/home/tc176/iso-9001-auditing-practices-group.html.
- APG paper: Organizational KnowledgeAPG paper: Organizational Knowledgehttps://committee.iso.org/files/live/sites/tc176/files/PDF%20APG%20New%20Disclaimer%2012-2023/ISO-TC%20176-TF_APG-OrganizationalKnowledge2015.pdf.
- ISO 9001 competence and training guideISO 9001 competence and training guide/article/iso-9001-2026-competence-training-clause-7-2.
- ISO 9001 internal audit questions guideISO 9001 internal audit questions guide/article/iso-9001-internal-audit-questions-guide.
- ISO 9001 corrective-action guideISO 9001 corrective-action guide/article/iso-9001-corrective-action-guide.
- Free ISO 9001 Gap Analysis TemplateFree ISO 9001 Gap Analysis Template/resources/gap-analysis-template.