Organisational knowledge ISO 9001 (7.1.6): recording and safeguarding knowledge
Organisational knowledge is the knowledge you need to make your processes work and to deliver your products or services. ISO 9001 clause 7.1.6 asks you to determine, manage and make that knowledge available. It is not about a handbook full of theory, but about practical things that sit in the heads of a few people: how to fix a fault on the machine, which customer has a different way of working, why a certain supplier is always called first. You must not lose that knowledge when someone leaves. You can find the text of the standard at NEN . For the full set of requirements, see the ISO 9001 requirements and competence (7.2), the neighbouring clause to this one.
What exactly does the standard require?
Clause 7.1.6 covers the knowledge you need for your processes, and keeping that knowledge. In ISO 9001:2015, the standard asks for three things:
- Determine which knowledge is needed. Think of technical knowledge, system knowledge and knowledge of customer requirements.
- Maintain the knowledge and make it available. Make sure that knowledge is kept, updated and findable, to the extent needed.
- Decide how you will get extra knowledge. Do your needs or market developments change? Then decide how to acquire or access the knowledge you lack.
In ISO 9001:2026, this clause has been broadened. According to sources from consultancy firms, it now covers knowledge needed for the results of the whole quality management system, and the retention, application and sharing of that knowledge is made more explicit. Read the final text at NEN for the exact wording.
Note the word “determine”. You do not have to document everything. You do have to be able to show which knowledge matters to your organisation, and how you safeguard it.
Difference from competence (7.2)
These two are often confused. Competence (7.2) is about whether an employee can do something. Organisational knowledge (7.1.6) is about what the organisation knows, separate from individuals. A competence matrix therefore describes who can do what. A knowledge register describes what you know as a company and where that knowledge sits. For the competence matrix, read competence matrix (7.2) with example.
Example of a knowledge register
The table below is an example for a company that maintains installations. It is fictional, but the structure works for most small and medium-sized enterprises (SMEs).
| Knowledge topic | Why it is needed | Where it sits now | Safeguard | Owner | Check |
|---|---|---|---|---|---|
| Faults on older control units | Fix quickly without calling the customer | Head fitter Jansen | Work instruction with photos and steps | Technical manager | Every six months, and when a new fitter starts |
| Requirements of the largest customer | Correct reporting and deadlines | Account manager and email | Customer profile in the customer relationship management (CRM) system | Account manager | At every customer review |
| Supplier agreements for parts | Lead times and alternatives | Purchaser | Supplier register with contact persons | Purchaser | Every quarter |
| Legal requirements for refrigerants | Handling refrigerants correctly | External adviser | Procedure and certificate register | Quality manager | Yearly |
A register does not have to be a complicated system. A shared spreadsheet works for most organisations. What matters is that every topic has an owner and a check.
How do you record organisational knowledge in five steps?
- For each process, ask what knowledge it needs. What must you know to do this work well? What can a new employee not do without?
- Find where the knowledge sits now. Often it is in one or two people, in emails or in a folder nobody uses.
- Choose a format for each topic. A work instruction, a checklist, an evaluation report or a short video. Choose whatever gets used fastest.
- Appoint an owner. That person keeps it up to date and checks that it is still correct.
- Link it to the induction procedure. New employees get the register as part of their introduction.
What does the auditor want to see?
The auditor usually asks: how do you know your company does not depend on one person? They will look at the register or the work instructions, and talk to someone from the process. For example, they might ask: “What do you do if the most experienced fitter is ill?” The answer must be specific. An answer such as “then someone calls the supplier” is too vague.
They also look at knowledge that comes from outside: from customers, suppliers, industry groups and legislation. That knowledge belongs in the register too, with the source noted.
Evidence of organisational knowledge is often found in practice. A work instruction that was used during a fault, an induction form that has been completed, or a handover that has been recorded. That is stronger than a document that exists only on paper.
Common mistakes
- Trying to document everything. A register with a hundred topics is not kept up to date. Start with the five knowledge topics that carry the most risk.
- Knowledge without an owner. A document without a name is not updated.
- Only asking the experienced people. They often no longer know it on paper. Also have the newest employee explain how they work, because that is where you will see the gaps.
- No link with induction. Knowledge that is not passed on is lost when someone leaves. See also mandatory documents per chapter.
- Confusing it with the quality manual. The standard requires neither a knowledge register nor a manual. A register is, however, a useful proof that you manage your knowledge. See quality manual ISO 9001.
How do you embed it in the system?
Link the register to your document control (7.5), so that it has a version and an owner. Include it in the management review as a standing item: which knowledge is missing, and what have we done to improve it? During an internal audit, check whether the knowledge is actually accessible. See internal audit ISO 9001.
Questions to map out knowledge
You do not need to run a workshop to map knowledge. These questions work in a half-hour conversation per team:
- Which task would you only give to one person, and why?
- Which document do you use most often, and which document is out of date?
- Which customer has a requirement that is not in the contract?
- Which supplier do you always call first, and why?
- Which fault keeps coming back, and who knows how to fix it?
- What must a new colleague know in their first week, and where do they find that now?
The answer to the last question is often the best starting point for your register. Write down the answers without judging them. Only then choose what to record.
Example: from conversation to register
Suppose you have held the conversation with the installation team. One of the outcomes: “If there is a fault on the older control units, Jan always calls the supplier first for the right circuit board.” That sentence is organisational knowledge. Right now it only sits in Jan’s head.
This is how you work it out:
- Topic: fault on older control units, correct circuit board.
- Where it sits now: with Jan, and in email contact with the supplier.
- Safeguard: a work instruction with the type number, the supplier and the contact number, plus the steps for ordering.
- Owner: technical manager, who updates the instruction when the supplier changes.
- Check: at the six-monthly check, the manager confirms that Jan still uses the instruction and that the details are correct.
This example shows why the column “where it sits now” matters. Without that column, you do not know what you need to protect.
Next step
Make a list of the five processes that depend most on one person. For each process, fill in four columns of the table: topic, where it sits now, safeguard and owner. That is your first knowledge register. Then start with the checklist per chapter, so you can be sure that clause 7.1.6 is covered in your system. See the ISO 9001 checklist per chapter.