Staff Training Records for an Audit: What Assessors Look For
Assessors want your staff training records to show who was trained, on what, when, and whether it worked. A completion log covers the first three, but the fourth needs knowledge-check scores from before and after training. Keep one set of records for every assessor, and send managers a monthly list of who's overdue.
When an assessor opens your staff training records, they want to answer four questions: who was trained, on what, when, and whether it worked.
A completion log will cover the first three. The fourth needs a knowledge check before and after training, and both the ICO's audit framework and ISO 27001 clause 7.2 point to it.
In August 2026, the ICO issued the Metropolitan Police with an enforcement notice and a reprimand. If you own compliance training, one detail in that case should give you pause. The officer behind one breach hadn't done data protection training in more than four years, and their line manager had gone almost as long.
The training existed; however, the trouble was that nobody could see who had missed it. This guide covers what assessors check and how to have it ready before they ask.
Written by
Based in our Johannesburg office, Jeanne is Learning People's expert in B2B technical training, professional certifications and workforce capability operations across the UK, Africa, Australia and New Zealand. Having worked in certification training for over a decade, she is our resident expert on workforce empowerment and transformation, helping organisations identify the right learning pathways across our B2B offering.
What assessors check in your staff training records
Each assessor words it a little differently, but the questions they ask overlap:
| Who asks | What they want | Proof to have ready |
|---|---|---|
| ICO (UK GDPR) | Training before staff handle personal data | Dated records, knowledge-check scores |
| ISO 27001 auditor | Competence for each role (clause 7.2) | Scores before and after training |
| FCA (staff serving retail customers) | Competent staff | Records kept after people leave the role |
| CQC (healthcare) | Training for each person's duties | Who's trained, who's due |
| Your clients | Trained staff | Completion by team |
If you answer to more than one of these, it's worth keeping one set of records that covers them all. That's far less work than keeping five.
The Four Questions Every Record Must Answer
- Who: Every person in scope, including contractors and long-serving staff. New starters should be trained before they touch personal data.
- What: The course that fits the job. A call handler and a database admin carry different risks, so they need different modules.
- When: The date each person finished, and the date they're due again. The Met case shows what can happen when nobody's watching that second date.
- Did it work: A short knowledge check before the course and again after. ISO 27001 clause 7.2 asks you to check that training worked, and the ICO's audit framework expects a knowledge check with a minimum pass mark.
Where Completion Logs Fall Short
A completion log tells an auditor that someone reached the end of a course, and that's useful. However, it can't show if they understood any of it.
It also hides anyone who's overdue until someone thinks to run the report, as by then, the audit is usually close.
The fix is simple: test what people know before the course and again after, and keep both scores on the record. Then send managers a list of who's behind every month. Managers carry a weight with their teams that a compliance inbox never will.
How We Help Compliance Teams Evidence Staff Training
We build our staff compliance training around the evidence from the start. You get a library of compliance courses, from GDPR and cybersecurity awareness to harassment prevention, anti-money laundering and conduct. We assign courses by role and check what staff know before and after.
We track completion for each person and report it by team or site, so your managers can see who's overdue while there's still time to act. Your auditor sees the before-and-after results.
The Royal Borough of Kensington and Chelsea chose Learning People after a cyber attack and so far, 88% of its staff have signed up and started learning.
Get the Evidence Ready Before the Auditor Asks
Got an ISO 27001 surveillance visit or a client questionnaire coming up? Book a free consultation, and we'll talk through what your staff must be trained on and when your next audit is due. Then we can scope whether a skills check and a compliance training plan would help.
FAQs About Staff Training Records for an Audit
—
Discover your team's training needs in a free 30 minute consultation
Find out more about comprehensive workplace training
Read more about workforce upskilling
Compliance, Risk & AuditStaff Training Records for an Audit: What Assessors Look For
Assessors want your staff training records to show who was trained, on what, when, and whether it worked. A completion log covers the first three, but the fourth needs knowledge-check scores from before and after training. Keep one set of records for every assessor, and send managers a monthly list of who's overdue.
Read More
Compliance, Risk & AuditFCA Consumer Duty Training: What Your Staff Need and How to Prove It Works
Consumer Duty training that holds up in 2026: role-specific, scenario-based, and checked against customer outcome data. Here's what your teams need, and how to prove it's working.
Read More
Certification PathwaysFCA Operational Resilience: A Workforce Skills Checklist for Your Recovery Plans
Your systems and suppliers are probably well documented. But could you say who would step in if the one engineer who knows your payments service was off sick?
Read More
Certification PathwaysITIL 5 for Service-Delivery Teams: Maturing ITSM to De-Risk Your SLAs
What does the new ITIL Version 5 certification mean for a busy service desk? This guide covers the most important changes from Version 4, how they connect to everyday service delivery, and where they could help teams improve SLA performance.
Read More