A Three-Year Clock Started in September
The world's most widely used quality standard got its first full rewrite since 2015 on September 16, 2026. More than a million ISO 9001 certificates are in force, and the companies holding them have been handed a hard date. By September 30, 2029, each one needs to have passed an audit against the 2026 text. Many of those companies still prove who is qualified to do what with a spreadsheet. Six changes in regulation, workforce and scale are turning that habit into a liability, and the new standard is only the first of them.
None of the six is new on its own. They now arrive together, though, at companies whose skills matrix was built for a smaller and slower business. A file that suited that business looks risky for the one many manufacturers have since become.
1. The Quality Standard Was Rewritten
The clock is already running. Companies get three years to move to the new edition, a window set by the accreditation bodies that police certification. There's an earlier cutoff inside it, March 31, 2028, after which nobody can be newly certified to the old text. For most sites the switch will simply happen at whichever surveillance or recertification visit comes up next, on a date the auditor's calendar chooses.
What makes the timetable awkward is the sheer number of certificates. They hang in machine shops and food plants on every continent, and the accreditors themselves say that moving them all will take coordination across the certification community. An auditor can't assess anyone against the 2026 edition yet, either. First the certification body that employs the auditor has to be cleared to use it, and that process isn't due to finish until well into 2027. So a good part of the three years is gone before most companies can even book a transition audit.
That first change reaches the skills matrix directly. Competence records weren't optional under the 2015 edition either. It wanted documented evidence that anyone whose work affects quality is competent, and it wanted records of that kind protected from unintended alteration. A transition audit will probably put both questions to every certified site again.
There's a harder requirement in the same clause, which is to evaluate whether training worked. That is much more difficult to write down than the fact that a course took place. A cell holding a date proves attendance. Whether the operator could do the job afterward is a question the date can't answer.
The accreditors' own summary of the revision mentions a stronger focus on leadership, quality culture and accountability. The last of those three is the awkward one for a file with no owner. At plenty of plants you could ask who last edited the forklift column in the shared workbook, or when they did it, and get a shrug.
What a Workbook Cannot Prove
A spreadsheet can state that an operator is qualified. It can't show who decided that, what evidence they saw, or whether the cell said something different last Tuesday. Auditors tend to ask exactly those questions, because a competence record with no history is only a claim.
The gap has turned into a market, with a whole product category now sold as competency management software for compliance. What these systems keep, and a workbook doesn't, is a single record for each person. Every skill in it points to a certificate and an expiry date, with the name of whoever signed the skill off attached. Whether a given plant needs one depends on the five changes still to come.
Buying software won't rescue a record nobody owns, and a disciplined team can get most of the way without it. Under audit, an entry gets asked four things. The assessor's name and the date are the easy two. The evidence the assessor relied on is harder to keep, and the date on which the result lapses tends to get left out altogether. A matrix that holds only a colored cell holds none of them.
Nobody has to wait for the auditor to learn how the file would hold up. A quality manager can take five people off tomorrow's roster and follow each of them through the paperwork. What does the job require of this person, where is the proof they can do it, and did anyone check that the training actually worked? If five names take an afternoon, the file isn't ready for an auditor who samples twenty.
2. Regulators Wrote the Standard Into Law
The second change is that regulators have started writing these standards into law. The clearest example is American. The Food and Drug Administration's Quality Management System Regulation has applied since February 2, 2026, and what it did was pull ISO 13485, the international quality standard for medical devices, into the federal rules. Any finished device manufacturer selling in the US market now answers to it.
Personnel records came along with it. Anyone whose work affects product quality falls under ISO 13485's personnel clause, which means the manufacturer has to hold records of that person's training and skills, and of their education and experience as well. On the same day the FDA retired its old inspection technique and began using a process built around the new regulation. A voluntary good practice became something an investigator can cite.
The consequences are different as well, since a certification auditor who dislikes the training records can raise a nonconformity, whereas a federal investigator reports to an agency with enforcement powers. A missing signature costs more when the reader is the FDA.
Records kept on a computer get extra scrutiny from the FDA. The agency's long-standing rule on electronic records is specific about what it wants, namely time-stamped audit trails that are secure and generated by the computer itself. In plain terms, the system logs each entry along with any change or deletion made later. An edit isn't allowed to wipe out what was there before. Where training records are kept electronically to satisfy FDA requirements, a shared workbook that anyone can overwrite is hard to square with that language.
Device makers have a concrete job here. Start with a list of the competence records the regulation relies on, and write beside each one where it actually lives. That list is the step worth the most effort, since it tends to be where the surprises turn up, such as a training log on somebody's desktop. Whatever sits in an uncontrolled file should be the first thing moved.
A Pattern PESTLE Analysts Will Recognize
Analysts who work with PESTLE will recognize the pattern. A requirement starts life as industry guidance, hardens into a certification clause, then lands among the legal factors a business has no choice about. Competence records have now made that whole trip in one industry, and it seems unlikely that medical devices will be the last.
That drift from guidance to law is worth tracking in any external analysis. A company selling into aerospace, food or automotive supply chains can put one question to each customer and regulator it answers to, which is whether proof of competence is requested, required or inspected. In the two cases above, the answer has moved one way, toward inspection.
What Research Says About Spreadsheet Reliability
All of this would be survivable if spreadsheets were dependable, and the research suggests they often aren't. A review of more than three decades of spreadsheet studies, published in the journal Frontiers of Computer Science in 2024, found repeated reports of faults in spreadsheets used for real operations, serious enough to compromise the decisions built on them.
Its authors argue that quality has to be managed across a spreadsheet's whole life, starting with how it's designed. Few skills matrices appear to get that treatment. Somebody built the file years ago and added columns as machines arrived, and often no one has tested a formula since.
The same literature points at a cause, which is that the people building spreadsheets are seldom trained to test them. A training coordinator who is good at training ends up doing a software developer's job on the side, without the tools a developer would insist on.
One well-known failure makes the point. In October 2020, nearly 16,000 positive Covid-19 test results in England were left out of the reported figures after the data passed through spreadsheet files in an old format with a row limit. An analysis published by ICAEW, the accountants' professional body, argued afterward that the real failure was the lack of a simple test that as many records arrived as had been sent.
That lesson transfers to a training office. Excel did what it was told in that case, and blaming the software would have fixed nothing. A monthly count that compares names on the payroll with rows in the matrix, and certificates on file with certificates in the cells, would probably catch much of what goes wrong.
3. The Keeper of the File Is Retiring
The third change is in the workforce itself. Many matrices have a keeper, usually a training coordinator or a long-serving supervisor who knows why column R is yellow. Populations are aging across the industrial economies, and social factors such as age distribution now belong near the top of any honest workforce plan.
The numbers are plain enough in the United States. The Census Bureau has projected that from 2030, when every baby boomer will be older than 65, older Americans will make up about a fifth of the population, up from 15 percent when the projection was published in 2018. Japan is already older than that, and the bureau counts Germany, Italy, France and Spain as older than the United States too.
A keeper who retires leaves the file on the shared drive and takes the knowledge of how to read it home. The successor inherits color codes nobody documented and abbreviations nobody can decode. Retirement also thins the matrix itself, because the veterans who leave are often the ones rated to train everybody else.
New hires create the opposite problem. A starter's row ought to sit empty until somebody has actually assessed them. In a busy month the temptation is to copy the row above.
The fix costs about an hour, which makes it the cheapest item in this article. Sit the keeper down before they go and get three things on paper, starting with what the colors mean. The rating scale comes next, and after that a plain note on what each formula is supposed to calculate. Then name a deputy who has actually edited the file.
4. One Site Became Several
Growth is the fourth change. Picture a matrix built for one plant and its eighty people. When a second site opens somebody copies the file, and for the third site somebody adapts the copy. From then on the versions drift apart. Give it a year and HR may be working from one, operations from another and the training team from a third, without anyone being sure which is current.
Then there's email. Each time the matrix goes from one site to another as an attachment, a list of employee names and certificate details goes with it. Who still has those attachments, and which of them will be edited next, is something no one is tracking.
The arithmetic turns ugly fast. Take a site of four hundred workers and track fifty skills for each. That's 20,000 cells, every one with its own way of going out of date. Contractors and agency staff bring a further headache, because their rows have to be filled from certificates that another employer holds.
An acquisition adds one more file to reconcile, and the file is the easy part. The company that was bought also rates people on its own scale and has its own view of what counts as competent. Merging two matrices by hand is a week of work that produces a third version.
A firm with several sites doesn't have to abandon spreadsheets this quarter to reduce the risk. The simplest protection is one master file that a named person owns, with everybody else working from a copy they can read but can't change. Before two matrices are merged, the sites also need to agree on one rating scale. Skipping the scale is an easy mistake, since a level 3 at one plant may not mean what it means at another.
5. Skills Expire Faster Than the File Updates
The fifth change is speed. A sign-off from two years ago may describe a machine the plant has since replaced, or software that has been updated twice. AI tools arriving on the line can date a sign-off just as quickly. On top of that come the licenses and safety certificates that expire on a fixed date whatever happens on the floor.
Employers expect the churn to continue. The World Economic Forum put the question to more than 1,000 of them for its 2025 Future of Jobs survey. On average they thought 39 percent of a worker's current skills would be transformed or out of date by 2030. Skill gaps were the barrier to changing the business that came up most, named by 63 percent.
A spreadsheet has no sense of time. It won't warn anyone that a welding certificate lapses on Friday unless somebody wrote a formula for that, kept it working and remembers to open the file. An expired certificate behind a green cell takes an auditor about a minute to find.
Two habits help whatever the tool. One is an expiry report set to look 90 days out, so that a lapse shows up while there's still time to book the course. The other is a rule that new equipment or new software means the people using it get reassessed. The second habit is easier to skip, because nothing on a calendar announces it.
6. The Record Started Making Decisions
The sixth change is the least visible. A matrix starts out as an archive that gets opened for audits. Then one evening a supervisor who is short a press operator opens it to see who else is signed off, and from that point the file is being used to run the plant. Planners do the same when they price a new job and need to know whether enough qualified people exist to take it on.
A mistake in a file used like that ends up on the shop floor. A wrong cell in an archive embarrasses someone at audit time. Once supervisors staff from the file, the same wrong cell can put a person on a machine they were never signed off to run.
Strategy guides separate internal analysis from external analysis, with an organization's own weaknesses on one side and the regulatory world on the other. A competence spreadsheet sits across that line. It's an internal weakness that tends to be discovered by an outside party, usually at a bad moment.
Defenders of the spreadsheet have one good argument, which is cost. The file is free and everybody knows how to use it. That was a sound reason for a single-site company facing one certification audit a year, and it looks like a poor one for a multi-site manufacturer facing a federal investigator.
Plenty of managers have made that calculation themselves. They keep the file because replacing it looks like a project and living with it looks free. The bill for living with it tends to arrive in somebody else's budget year.
Start With Five Names
Two of the six changes come with dates attached, the new standard and the FDA rule, and that's the main reason to rank them first. The remaining four are arguably harder to manage precisely because nothing forces the issue. A keeper's resignation doesn't appear in anyone's plan, and neither does the month when the second site's copy stops matching the first.
Does all this mean every company should drop spreadsheets tomorrow? The evidence doesn't go that far. It supports a narrower claim, that a competence record needs someone who owns it, a history of who changed what, and some way of knowing when an entry expires. A file lacking all of that is riskier than its zero price tag suggests.
A week is enough for a first pass. Most of it goes on the five-name trace described earlier. While that's under way, somebody can count how many versions of the matrix are in circulation, and the September 2029 deadline should reach whoever signs the quality budget before the week is out. Of those, the trace matters most, because it turns a vague worry into a number of hours.
After that, try something smaller. Open the file tonight, find one person who is on shift, and look at the cell beside their name. Is there a document somewhere in the building, signed by someone, that proves the cell is true?
