“Yeah, I Know the Standard”: Dunning-Kruger and ISO Clause 7.2 Competence

Every auditor has met this person. You ask how they manage competence for a critical role, and you get a confident wave of the hand: “Oh, we’re fine, everyone here knows what they’re doing.” No competence matrix, no training records, no evidence. Just certainty. And it is almost always the same story: the more certain the answer, the thinner the evidence behind it.

There is a name for that pattern, and it turns out ISO clause 7.2 was written with it in mind.

A short and fair account of Dunning-Kruger

In 1999, psychologists David Dunning and Justin Kruger published a study with a memorable finding: people who are least skilled at a task tend to overestimate their ability at it, because the very knowledge needed to be good at something is also the knowledge needed to judge whether you are good at it. If you do not know what a competent job looks like, you cannot see that yours falls short.

Two things are worth adding, because the effect is often quoted badly. First, it is not “stupid people are confident.” It is that all of us are poor judges of our own ability in areas where we happen to be weak, and we are usually weak in more areas than we would like to admit. Second, the effect has a mirror image: skilled people often underrate themselves, because they assume that what is easy for them is easy for everyone. The expert doubts; the novice does not. Neither self-assessment is reliable.

Hold that thought, because “self-assessment is not reliable” is precisely the problem clause 7.2 exists to solve.

What clause 7.2 actually requires

Clause 7.2 (Competence) appears in the same words across the Annex SL standards, including ISO 9001, ISO 45001, ISO 14001, ISO 27001 and ISO 42001. It has four parts. The organisation shall:

• a) determine the necessary competence of persons doing work that affects the performance and effectiveness of the management system;
• b) ensure these persons are competent on the basis of appropriate education, training or experience;
• c) where applicable, take actions to acquire the necessary competence, and evaluate the effectiveness of those actions;
• d) retain appropriate documented information as evidence of competence.

Read those four parts back to back and notice what the clause never once says. It does not say “ensure people feel competent.” It does not say “ask them if they are competent.” It says determine what competence is needed, ensure it exists on the basis of education, training or experience, close any gap, and keep the evidence. Every step is built to route around self-assessment.

Why 7.2 is the standard’s answer to Dunning-Kruger

Line the clause up against the effect and it reads like a control designed specifically to defeat it:

The clause quietly assumes that people are unreliable narrators of their own skill, and it builds the requirement around evidence instead. That is not cynicism. It is good system design, and it is the same instinct that makes us verify rather than trust a supplier’s say-so.

The auditor’s-eye view: two failure modes

In practice, Dunning-Kruger shows up in an audit in two opposite ways, and 7.2 handles both.

The overconfident auditee. This is the classic case: the manager certain the team is competent, with nothing to evidence it. The competence matrix is missing, or it was filled in once and never revisited. Here 7.2d does the work. When you have to produce the training record, the qualification, the demonstrated experience, confidence alone will not fill the column. The gap becomes visible, which is the first step to closing it.

The quietly competent expert who undersells. The mirror image is just as costly, and it gets missed. The most skilled person on the team shrugs and says “it’s nothing special,” so their competence is never captured, never documented, and walks out the door the day they resign. A good competence matrix protects against this too, by recording what people can actually do rather than what they claim. Clause 7.2 is not only there to expose the unskilled; it is there to make sure real competence is recognised and retained.

There is a third, uncomfortable version worth naming: the person judging competence is subject to the same effect. A manager signing off that a team is “trained and competent” is making a self-assessment of their own judgement. This is exactly why 7.2 leans on objective criteria and documented evidence rather than a manager’s gut feel.

Turning the clause into something that works

You do not need a psychology degree to apply this. You need a competence matrix and the discipline to keep it honest.

1. Define required competence per role (7.2a). For each role that affects the system, write down what a competent person must know and be able to do. Do this before, and independently of, assessing any individual, so the bar is set by the work, not by the people currently in the seats.
2. Evidence actual competence (7.2b, 7.2d). Map each person against the required competence using education, training and demonstrated experience. Records, not opinions.
3. Close the gaps and check they closed (7.2c). Where someone falls short, provide the training or supervision, then evaluate whether it worked. Attendance is not competence; a certificate of completion is not proof the person can now do the job.
4. Pair it with awareness (7.3). Competence is being able to do the job; awareness (clause 7.3) is understanding why it matters and the consequences of getting it wrong. The two together are what actually protect the system.
5. Review it. Competence needs, like interested parties, change. New standards, new tools, new risks. Revisit the matrix at management review.

Do that, and the confident wave of the hand is replaced by something an auditor can actually rely on: a documented, current picture of who can do what, and where the gaps are. Which, not by coincidence, is also the picture a well-run business wants for its own sake.

Verification of Competency: from learner’s plates to a full licence

For safety-critical and quality-critical work, the strongest way to satisfy 7.2 is a Verification of Competency (VoC) program. It is the clause turned into a repeatable procedure, and it works much like earning a driver’s licence:

1. Establish the procedure. Document how the task is to be done correctly and safely, to the required standard. This is the benchmark the worker will be measured against.
2. Supervised practice (the learner’s plates). The worker performs the task under the supervision of a competent person, following the procedure. They are building real competence on the job, not being asked whether they feel ready.
3. Documented assessment (the licence test). When the worker is ready, a qualified supervisor or assessor completes a documented assessment of competency, confirming the worker can undertake the work safely and to the required standard, unsupervised.
4. The record (the full licence). The signed, dated VoC is retained as evidence of competence, and typically carries a review or expiry date so it does not become a licence held for life on a test taken years ago.

Notice what the VoC removes: at no point does the worker certify themselves. Competence is verified by an independent, competent assessor against a written standard, and the whole thing is documented. That is the exact opposite of the confident wave of the hand, and it is why VoC is such a clean answer to the Dunning-Kruger problem. The supervised-practice phase gives the overconfident novice a reality check before they are signed off, and the documented assessment gives the quietly competent worker the formal recognition they would otherwise never claim for themselves.

The four steps map almost one-to-one onto clause 7.2:

• Procedure established, meaning the required competence is defined (7.2a), with documented information to work from
• Supervised practice, meaning action is taken to acquire competence (7.2c)
• Documented assessment, meaning competence is ensured on objective grounds (7.2b) and the effectiveness of the action is evaluated (7.2c)
• Signed, dated VoC record, meaning documented evidence of competence (7.2d)

VoC programs are most established in high-risk industries such as mining, construction, rail and utilities, where “can this person operate this plant safely” is not a question you want answered by self-belief. But the model applies to any task where getting it wrong carries real safety or quality cost. It is 7.2b, c and d running as a single, auditable loop.

Dunning-Kruger and clause 7.2: FAQs

Does ISO 9001 mention the Dunning-Kruger effect?

No. The effect is a psychology concept, not an ISO term. But clause 7.2’s insistence on evidenced competence rather than self-assessment is a practical safeguard against exactly the overconfidence Dunning-Kruger describes.

What is the difference between competence and awareness in ISO?

Competence (clause 7.2) is the ability to do the work, grounded in education, training or experience. Awareness (clause 7.3) is understanding the policy, your contribution, and the consequences of not conforming. You need both.

How do you prove competence in an audit?

With documented evidence: a competence matrix, training records, qualifications, and records of demonstrated experience. Confidence and verbal assurance are not evidence.

What is a Verification of Competency (VoC)?

A VoC is a documented assessment in which a competent supervisor or assessor verifies that a worker can perform a specific task safely and to the required standard, usually after a period of supervised practice against an established procedure. It is a practical way to meet clause 7.2, because competence is verified and recorded rather than self-declared.

Who decides what competence is “necessary”?

The organisation does, under 7.2a, based on the role’s effect on the management system. Setting that bar against the work rather than the individual is what keeps the assessment objective.

How Streamline can help

Streamline designs, implements, audits and mentors practical ISO management systems, built around how your business actually works. If your competence records are a confident wave of the hand rather than a matrix that would survive an audit, that is one of the first things our independent internal audit and mentoring will surface and fix. You work directly with an experienced ISO auditor who has seen every version of “we’re fine, everyone knows what they’re doing.”

Speak with an experienced ISO auditor

For help with clause 7.2, competence matrices, or any part of your management system, contact us. Email hello@streamline.business or call Brisbane 07 3667 8280, Sydney 02 8315 7780 or Melbourne 03 9034 3990.