Training records for audits: what auditors want to see

Training records are requested from many sides: certification auditors for management systems, supervisory authorities in data protection, financial supervision or occupational safety, customers in supplier audits and internal audit. The questions are similar: who had to be trained? Who was trained? With what, when and with what result? And what about those whose training has expired?

Auditors work with samples. They pick a person, a requirement and a period and ask to see that the chain is closed: the requirement is known, the person is assigned to it, the training took place, the content fits, the result is documented, the validity is current.

This defines the components of an audit-proof record. It names the person, the course with version, the date, the result of an assessment, the issuer and the validity. It is unchanged since issue and can be checked for authenticity — ideally via a verification code or signature, so the auditor need not simply trust the organisation.

Individual records prove little if it is unclear who needs which training. The training plan links requirements with roles: everyone needs data protection and information security, accounting additionally anti-money laundering, management cybersecurity at board level, everyone using AI tools AI literacy. The plan gives the target state; the records give the actual state.

In the audit you can then show the completion rate per course, who needs to act and what is being done about gaps. A completion rate below one hundred percent is no drama if the path to closing gaps is documented — for instance through reminders and deadlines.

Many trainings have limited validity. In occupational safety, section 12 of Germany's Occupational Safety and Health Act requires repetition where necessary, and the statutory accident insurers specify this in their rules. In data protection and information security, annual or two-yearly refreshers have become common. Anyone not tracking validity faces the audit with expired records.

A cycle has proven itself: assignment with a deadline, completion with a record and expiry date, a new assignment with a reminder in good time before expiry. An audit report showing every cycle with record code and reminders sent answers most of the auditor's questions before they are asked.

Training records are personal data. They may be processed to provide evidence to auditors, but purpose limitation and data minimisation apply. For samples, a report with staff number or name, course, date, result and validity is usually enough; auditors rarely need detailed answers from knowledge tests.

Clear deletion periods and access rights belong to this. And results of mandatory training should not simply flow into performance appraisals — in German workplaces with a works council this is a matter for co-determination anyway.

Auditors keep finding the same weaknesses in training records. The most common: there are records but no plan showing who needs which training. Close behind come expired validity with no visible action, course content without a version and records that cannot be clearly assigned to a person.

Such findings can be avoided when training plan, content and records come together in one system and the completion status is analysed regularly — not only just before the audit.