Documenting a 'Competent Person': What OSHA and Audit Reviewers Expect to See
When the Auditor Asks "Who's Your Competent Person Here?"
The trench is open, the crew is working, and the auditor walking the site with the safety manager stops at the edge and asks a simple question: who's the competent person for this excavation, and where's the record that says so? The safety manager points to a guy in a hard hat and says "that's Dave, he's been doing this for fifteen years." The auditor nods, then asks for the paperwork. There isn't any — not because Dave isn't competent, but because nobody ever wrote down when he was designated, for which tasks, or by whom.
That gap is the difference between a verbal assurance and a documented one, and it's the gap that turns a routine walkthrough into a citation. OSHA doesn't just want a capable person on site — several of its standards require a specifically designated competent person, and designation without a record is, from an auditor's perspective, functionally the same as no designation at all.
This article covers what a defensible competent person documentation record actually contains, how that overlaps with (and differs from) ISO competency recordkeeping, and where a thin paper trail turns into real financial exposure. By the end, you'll know exactly what to put in the file before the next walkthrough happens — not after.
What "Competent Person" Actually Means Under OSHA
OSHA's regulatory language defines a competent person generically as someone capable of identifying existing and predictable hazards in the surroundings or working conditions, and who has authorization to take prompt corrective measures to eliminate them. That definition shows up across multiple OSHA standards governing tasks like excavation, scaffolding, and fall protection — but the specific clause numbers vary by standard, and getting them wrong in a written policy is worse than leaving them out. If your safety program cites a specific OSHA clause number for a competent-person requirement, confirm that citation directly against the current text on OSHA.gov or with counsel before it goes into a policy document — don't copy a number from a blog post, including this one. [VERIFY against OSHA.gov before publishing in any compliance-facing document.]
What matters operationally is this: "competent" is a legal designation, not a vibe. It has two components an auditor will probe separately —
- Capability — does this person actually have the training, experience, or qualification to identify the hazards relevant to this specific task?
- Authority — has this person been formally given the power to stop work or order corrective action, or are they just experienced and present?
A worker can be capable without being designated, and designated without being documented. All three states look identical in a hallway conversation. Only the documented one survives an audit.
What a Defensible Competent Person Record Actually Contains
Auditors — whether OSHA, an ISO certification body, or an insurance risk assessor — are pattern-matching against a small set of elements, regardless of which standard triggered the requirement. A record that will hold up generally needs:
- The individual's name and the specific task or hazard category they're designated for (excavation, scaffolding, fall protection, confined space — competent-person designations are task-specific, not blanket).
- The basis for the designation — training completed, certification held, or documented experience that supports the capability claim.
- The date of designation, and who made it (a named supervisor or safety manager, not "management").
- The scope and any limits of the designation — a competent person for scaffold erection on a specific site isn't automatically competent for a different structure type.
- A re-evaluation trigger — a date, interval, or condition (incident, near-miss, change in equipment or site conditions) that prompts a review of the designation.
That last point has a close analog in an OSHA standard that is fully documented in the public record: powered industrial truck (forklift) operator training. Under 29 CFR 1910.178(l), operators must be re-evaluated at least once every three years, with refresher training triggered earlier by an accident, a near-miss, an observed unsafe operation, or a change in equipment or the workplace — and the record has to name the operator, the training date, the evaluation date, and the evaluator (EHS Careers, 29 CFR 1910.178). That's a different standard than competent-person designation, but the shape of the recordkeeping is the same pattern auditors look for everywhere: who, what, when, and who signed off. If your competent-person file is missing any one of those four elements, treat it as incomplete.
Where ISO Competency Records Overlap — and Where They Don't
If your organization carries ISO 9001 or ISO 45001 certification, you're already required to maintain a parallel but distinct kind of competency documentation, and it's worth understanding how the two systems relate instead of treating them as separate filing cabinets.
ISO 9001 Clause 7.2 (unchanged in ISO 9001:2026, which replaced the 2015 edition in September 2026) requires organizations to determine the competence needed for roles that affect quality, ensure that competence through education, training, or experience, close any gaps and evaluate whether the closing action actually worked, and retain documented evidence of competence (Fabrico, ISO 9001 Clause 7.2 guidance, 2026). Competence evidence is one of roughly 18 mandatory records the standard requires overall (Glocert International, 2025). Our guide to ISO 9001 competency requirements breaks down exactly what that evidence needs to look like.
ISO 45001:2018 Clause 7.2 requires organizations to determine the competence workers need to affect occupational health and safety performance — including their ability to identify hazards — ensure that competence via education, training, or experience, evaluate the effectiveness of any corrective training, and retain documented evidence of competence. (QHSE Support, ISO 45001:2018 Clause 7.2, 2024)
Notice the overlap: "ability to identify hazards" is functionally the same capability test OSHA's competent-person definition uses. A worker who is competent under ISO 45001 for hazard identification in a given role is making much of the same case an OSHA competent-person designation needs to make — but ISO wants it tied to a documented management-system record with an evaluation-of-effectiveness step, while OSHA's competent-person requirement is task-triggered and doesn't require a system audit trail in the same way. Organizations running both frameworks shouldn't maintain two unrelated files — the ISO competence record can usually absorb the competent-person designation as a sub-record, provided the task-specific scope and re-evaluation trigger are preserved. Our ISO 45001 competency records guide covers how to structure that without duplicating effort.
What a Missing Record Actually Costs
This is where a thin paper trail stops being a filing problem and starts being a budget problem. OSHA's maximum penalty for a serious or other-than-serious violation is $16,550 per violation as of 2025 (up from $16,131 in 2024), and the maximum for a willful or repeat violation is $165,514 per violation, also 2025 (U.S. DOL/OSHA, 2025 civil penalty adjustment). Both figures adjust annually for inflation — the 2025 increase was about 2.6% across all violation categories (J.J. Keller citing DOL, 2025), so confirm the current-year number before using it in any internal communication. The average penalty after a full OSHA inspection runs over $13,000 (OSHA Compliance guidance, 2025) — and that figure doesn't include legal fees, workers' comp exposure, or the cost of actually correcting the underlying hazard.
A missing competent-person designation doesn't automatically produce a willful-violation citation, but an auditor who can't find the record has no way to credit you with having done the work, even if Dave really is competent. The paperwork is the only thing that converts "we probably did this right" into "we can show we did this right."
Building the Record Without Reinventing the Spreadsheet
Most organizations that get caught flat-footed on this aren't negligent — they're tracking designations in the same spreadsheet they use for forklift certs, first-aid cards, and crane licenses, and the competent-person column gets added late, inconsistently, or not at all. Our certification tracking guide and our piece on tracking trades licenses and credentials both walk through why a single flat list eventually breaks down once you're tracking more than a handful of credential types across more than a handful of people.
A purpose-built register fixes the structural problem: one record per person, per designation, per task scope, with the basis, the date, the designating supervisor, and a re-evaluation trigger all captured as fields instead of free text buried in a comment box. SkillsInventory's Internal Certification & Expiry Register is built around exactly that shape of record, and it sends automated expiry reminders at 90, 30, and 7 days out so a re-evaluation trigger doesn't quietly slip past its due date.
One boundary worth stating plainly: SkillsInventory records and tracks self-reported competent-person designations, training completions, and certification expiry dates — it does not verify a credential against the issuing body, and it doesn't make the legal determination of who qualifies as "competent" under a given OSHA standard. That determination still belongs to a trained supervisor or safety professional. The tool's job is to make sure the record of that determination exists, is complete, and doesn't go stale — not to replace the judgment call itself. For the same reason, if your current approach is a shared OSHA certification spreadsheet, our guide on OSHA certification tracking is a good next stop before you decide whether a dedicated register is worth the switch.
If you're not sure whether your current competent-person files would survive a walkthrough tomorrow, that's worth finding out before an auditor does it for you. Try SkillsInventory on your own certification list, or start with the Internal Certification & Expiry Register if a full platform isn't the right fit yet.
