Audit-proof training records: what an auditor wants to see

Training records are requested from various sides: occupational safety and data protection authorities, statutory accident insurers, certification auditors for quality or information security management, clients in supplier audits and, in the event of damage, insurers and courts. All of them essentially ask the same question: can the company prove that the right people were trained in time?

Management system standards explicitly require evidence. ISO 9001, for instance, requires in its section on competence that appropriate documented information be retained as evidence of competence.

A record is meaningful when an outsider understands what it proves without having to ask.

Paper signature lists are widespread and usable in principle, but hard to analyse and easy to lose. Spreadsheets are easier to analyse but can be changed unnoticed at any time — an auditor cannot tell whether an entry was added later.

Digital records from a learning system are better if the system logs changes. Strongest are digitally signed records: any change would invalidate the signature, and an auditor can check authenticity independently without having to trust the company. Open standards such as Verifiable Credentials describe how such records are structured to be machine-readable and verifiable.

An auditor rarely wants to see individual records but the overall picture: What share of employees holds a valid certificate per course and unit? Who is overdue, since when, and what was done? When were reminders sent? How were new hires handled?

Training records are personal data. They may only be used for the purpose for which they were collected and viewed only by authorised people. Detailed results from exercises do not belong in the personnel file if they are not needed as evidence. There is no single statutory retention period; it should be set with reasons and anchored in the deletion concept.

In Universe, completing a course produces a signed training certificate. The verification code leads to a public verification page showing holder, course, completion date, validity, issuer and code; the page shows whether the training is still valid and whether the digital signature has been checked and is valid. For machine verification, the certificate can be downloaded as a verifiable credential based on an open standard.

For auditors, People Development offers CSV reports: the mandatory training audit report with every cycle, certificate code and reminders sent, all assignments and the change log. Every reminder attempt — sent, skipped, failed — is logged and appears in the audit report.