What makes a training record audit ready?

Which fields does an auditable record need?

Five, at minimum. Each exists because an auditor can ask about it directly.

1. Identity of the learner. A durable identifier, not just a display name. Names change and repeat.
2. Identity of the content. The course title plus a version or revision marker. "Fire safety" is not one thing across five years.
3. The original completion date. The day the person finished, not the day the record was imported or exported.
4. How completion was established. A score, a pass mark, an observed assessment, or an attendance confirmation. The method matters more than the result.
5. Who attests to it. The system that recorded it, or the person who signed off where the assessment was manual.

Two more are worth keeping even when nobody has asked yet: the expiry or next-due date where the training recurs, and the language the training was delivered in. The second one matters in bilingual workplaces, and it is almost never reconstructable later.

How long should training records be kept?

The retention period comes from the obligation that required the training, not from the training platform. A record tied to an occupational health and safety duty, a professional order's continuing education cycle, or a privacy obligation each inherits its own period from that source.

That means there is no single correct answer to publish here, and any vendor quoting you one number for all training is guessing. The practical approach is to inventory your training by the obligation behind it, take the retention period from that obligation's own text or regulator, and set the longest applicable period as your floor. Keep the reasoning written down next to the number, because the person who has to defend it in three years will not be you.

What is the difference between attendance and competence?

Attendance evidence shows a person was exposed to the material: they attended the session, opened every module, or reached the end. Competence evidence shows they met a standard: they passed an assessment, demonstrated a task, or were observed by a qualified assessor.

The distinction matters because obligations differ on which one they require, and a record that captures only attendance cannot be upgraded after the fact. If the requirement is competence and your system recorded a completion flag, you do not have the evidence and you cannot get it retroactively. Decide which one each course needs before you deliver it, and record the assessment method either way.

Who should be able to produce the record?

Someone who is not the person who built the course, and ideally not the training team at all. If producing an audit extract depends on one administrator knowing where to click, the record is fragile in exactly the situation it exists for.

Test this the way you would test a backup. Ask a manager outside the training function to produce, unaided, the completion history for one named person and one named course including dates. If that takes more than a few minutes or needs a specialist, the evidence exists but the process around it does not.

How does EmbayLMS handle this?

EmbayLMS records completions with their original dates and preserves them through imports, so a migration does not reset the history. Certificates carry expiry dates that trigger recertification, and completion history stays attached to a learner after they are deactivated. Reports can be exported by course, by learner, or by date range. Learning data is stored at rest in Canada.

What EmbayLMS does not do is decide your retention period or tell you whether a course needs competence evidence. Those come from the obligation behind the training.

This page explains general concepts about record keeping. It is not legal advice, and it does not state what any particular law requires of your organization.