Training Records Audit Checklist: What Evidence Should Be Ready?

Could you answer these questions today?

1. Which roles need a named requirement, and why?
2. Who is complete, due, overdue or legitimately exempt?
3. What did each completion involve?
4. Where competence required more than a course, who signed it off?
5. Who owns the gaps and when will they be resolved?

If the answer requires several spreadsheets, certificate folders and private inboxes, the problem is not simply reporting speed. The evidence chain is fragmented.

An audit-ready training record should connect the reason for training with the action taken and the result. Use this checklist to build that chain before an auditor, regulator, customer or board member asks for it.

The seven-part training evidence chain

1. Requirement

Show why the learning exists. The basis might be a law, regulator expectation, risk assessment, contractual requirement, professional standard or approved company policy.

Record:

1. requirement name and stable ID;
2. source, jurisdiction and scope;
3. affected roles, sites or activities;
4. requirement owner;
5. date last reviewed.

Avoid describing every assignment as “legally required”. Precise classification makes the evidence more credible.

2. Assignment

Show that the right population was identified at the right time.

Record:

1. learner and role at assignment;
2. assignment rule or decision;
3. trigger, such as joining, role change or expiry;
4. assigned date, due date and manager;
5. any later change to the requirement.

Test whether the system can explain why one person was assigned and another was not. A completion list without population logic cannot reveal missing assignments.

3. Delivery

Show what people received.

Record what is relevant to the method:

1. course or session title and version;
2. provider or facilitator;
3. delivery mode;
4. session date and duration where needed;
5. language and accessibility arrangements where material;
6. attendance or participation evidence.

For local briefings and toolbox talks, define how identity and attendance are captured. A photographed sign-in sheet may be evidence, but only if it is legible, attributable and stored against the right requirement.

4. Outcome

Show the result, not just the invitation.

Possible records include:

1. completion date and status;
2. assessment result;
3. certificate or credential identifier;
4. acknowledgement of a policy or procedure;
5. failed attempts and reassignment where relevant;
6. feedback used to improve the activity.

Be proportionate. Detailed answer histories can create more personal data than the purpose requires. Decide what evidence is necessary.

5. Competence and application

Some risks require evidence beyond knowledge completion. The HSE says supervisors play an important role in monitoring the effectiveness of training and a worker's competence.

Where relevant, record:

1. observation or practical assessment;
2. assessor and date;
3. criteria used;
4. restrictions or supervised-work conditions;
5. follow-up action;
6. authorisation decision.

Do not claim that a course certificate proves safe performance unless the assessment supports that conclusion.

6. Currency and exceptions

Show whether the evidence is still valid and how gaps are controlled.

Record:

1. expiry or review date;
2. event-led triggers such as changed work or an incident;
3. reminder and escalation history where useful;
4. exemption or extension rationale;
5. approver, temporary control and next review date.

An overdue status is not the whole story. The reviewer needs to know who owns it and whether the person is restricted from relevant work in the meantime.

7. Governance

Show that the process itself is controlled.

Keep:

1. the training matrix or role-rule catalogue;
2. approval and change history;
3. data-quality checks;
4. retention and deletion rules;
5. access controls;
6. issue logs and corrective actions;
7. a record of periodic management review.

The ICO's training and awareness accountability framework illustrates the wider point: organisations should be able to demonstrate that training arrangements are planned, appropriate, monitored and reviewed.

The 20-minute evidence-pack test

Choose one live requirement and one location. Give the owner 20 minutes to produce:

1. the requirement basis and approved population;
2. a current status report with due and overdue items;
3. three sample learner records, including one exception;
4. the content or session version used;
5. any competence evidence required;
6. proof of manager follow-up;
7. the retention rule.

Time is not the only measure. Score the result for completeness, consistency, provenance and clarity.

Repeat the test for an online course, an in-person session and an external qualification. Mixed delivery is where inconsistent evidence often appears.

Data-quality checks before an audit

Run these checks on the full population:

1. duplicate learners or role records;
2. active people with no manager or site;
3. leavers still receiving assignments;
4. completions dated before assignment or employment;
5. certificates with missing issuer, date or person;
6. expired evidence shown as current;
7. exemptions without rationale or review date;
8. role rules with no owner;
9. course versions that cannot be identified;
10. totals that differ between dashboard and export.

Investigate anomalies. Do not silently change records to make the dashboard look cleaner. Log corrections, preserve provenance and explain material adjustments.

Build an audit pack without creating a data dump

More data is not necessarily stronger evidence. Tailor the pack to the request and protect personal data.

Use three layers:

1. Summary: scope, requirement, population, status, key exceptions and owner.
2. Control evidence: matrix, assignment rules, content/version, monitoring and corrective actions.
3. Sample records: proportionate learner-level evidence selected against an agreed method.

Restrict access and use secure transfer. Check whether names or sensitive details are necessary. Keep a log of what was disclosed, to whom, why and when.

What a useful dashboard should show

A dashboard should help people act, not merely display a completion percentage. Ask for:

1. current status by requirement, role, site and manager;
2. due and overdue counts with clear denominators;
3. expiring qualifications and forward workload;
4. missing assignments and data-quality exceptions;
5. trends and repeat problem areas;
6. drill-down from summary to evidence;
7. an export that reconciles to the screen.

Cademi's current compliance and reporting pages describe live views, automated reminders and audit-ready exports. In a demonstration, use your own evidence-pack test. Ask the team to trace one rule from assignment to the underlying record, including an exception. Book a tailored Cademi demo rather than accepting a generic feature tour.

Audit readiness is a routine, not an event

Use this operating rhythm:

1. managers review urgent exceptions weekly;
2. requirement owners review due, overdue and competence gaps monthly;
3. HR or L&D samples evidence quality quarterly;
4. data-protection and system owners review access, retention and supplier controls at least annually;
5. the organisation rehearses a realistic evidence request before high-risk periods.

If the pack is built only when notice arrives, there is little time to correct weak assignment logic or missing provenance.

Frequently asked questions

Is a completion certificate enough for an audit?

It may be one useful record. A reviewer can still need to understand why the training applied, what was delivered, whether competence required separate evidence and how current gaps are managed.

Should we keep failed attempts?

Keep what is necessary for the purpose, such as demonstrating follow-up or evaluating the learning. Apply an approved retention rule and limit access. Do not retain detailed data automatically without need.

Can managers edit training records?

Use role-based permissions. Corrections should be attributable and auditable. Managers may record attendance or sign-offs without having unrestricted access to all learning and personal data.

What if evidence is missing?

Do not backfill an unsupported completion. Record the gap, assess the risk, apply any temporary control and arrange suitable reassessment or training.