What should a training record contain to be audit ready?

Which fields does an auditable record need?

Five, at minimum. Each exists because an auditor can ask about it directly.

1. Identity of the learner. A durable identifier, not just a display name. Names change and repeat.
2. Identity of the content. The course title plus a version or revision marker. "Fire safety" is not one thing across five years.
3. The original completion date. The day the person finished, not the day the record was imported or exported.
4. How completion was established, and the result. A score, a pass mark, an observed assessment, or an attendance confirmation. The method matters as much as the result.
5. Who attests to it. The system that recorded it, or the person who signed off where the assessment was manual.

Two more are worth keeping even when nobody has asked yet: the expiry or next-due date where the training recurs, and the language the training was delivered in. The second one matters in bilingual workplaces, and it is almost never reconstructable later.

Which questions will an auditor ask of a training record?

An auditor tests a record by asking questions of it, usually for a person picked at random. The table below maps each question to the field that answers it. If one row has no answer for that person, the record has a gap.

Sampling is how auditors work. The ISO 9001 Auditing Practices Group tells auditors to verify that documented information shows how sampled persons were deemed competent. One random person, one required course, every row answered: that is the practical test.

What makes the record itself trustworthy?

Correct fields are not enough if anyone can change them quietly. A record holds up as evidence when four controls sit around it.

1. Change history. Any edit to a date, a result or an identity is logged with who made it and when.
2. Restricted edits. Only named roles can correct a record, and a correction adds to the history rather than replacing it.
3. No silent deletion. Deactivating a learner keeps their history. Records leave only at the end of the retention period, on purpose.
4. Retrieval without a specialist. An extract by person, by course or by date range can be produced on request, in a readable format.

The ISO guidance lists the kinds of records that can show competence: training needs, training plans, training records, and records of how effective the training was. The last one is the kind most often missing.

What is the difference between attendance and competence?

Attendance evidence shows a person was exposed to the material: they attended the session, opened every module, or reached the end. Competence evidence shows they met a standard: they passed an assessment, demonstrated a task, or were observed by a qualified assessor.

The ISO auditing guidance makes the same point: taking part in a course does not, on its own, show that a person is competent. A record that captures only attendance cannot be upgraded after the fact. If the requirement is competence and your system recorded a completion flag, you do not have the evidence and you cannot get it retroactively. Decide which one each course needs before you deliver it, and record the assessment method either way.

How long should training records be kept?

The retention period comes from the obligation that required the training, not from the training platform. A record tied to an occupational health and safety duty, an accessibility standard, or a privacy obligation each inherits its own period from that source.

That means there is no single correct answer to publish here, and any vendor quoting you one number for all training is guessing. The practical approach is to inventory your training by the obligation behind it, take the retention period from that obligation's own text or regulator, and set the longest applicable period as your floor. Keep the reasoning written down next to the number, because the person who has to defend it in three years will not be you.

Who should be able to produce the record?

Someone who is not the person who built the course, and ideally not the training team at all. If producing an audit extract depends on one administrator knowing where to click, the record is fragile in exactly the situation it exists for.

Test this the way you would test a backup. Ask a manager outside the training function to produce, unaided, the completion history for one named person and one named course including dates. If that takes more than a few minutes or needs a specialist, the evidence exists but the process around it does not.

How does EmbayLMS handle this?

EmbayLMS records completions with their original dates and preserves them through imports, so a migration does not reset the history. Certificates carry expiry dates that trigger recertification, and completion history stays attached to a learner after they are deactivated. Reports can be exported by course, by learner, or by date range. Learning data is stored at rest in Canada.

What EmbayLMS does not do is decide your retention period or tell you whether a course needs competence evidence. Those come from the obligation behind the training.

This page explains general concepts about record keeping. It is not legal advice, and it does not state what any particular law requires of your organization. Consult a lawyer about your own obligations before you rely on it.