An auditor picks one name from your staff list and says, “Show me this person’s training.” Most teams know the training happened. Far fewer can prove it quickly.
Training records are that proof. This guide covers what auditors look for, what to record, and how to keep those records safe. This is general information, not legal advice. What applies to you depends on your certification scope, risk assessment, contracts, and local law.
How Auditors Check Training Records
Auditors often pick one person or role and follow the trail from start to finish. Build your records around the same four steps:
- Requirement: what the job needs the person to know or do.
- Training: which course, on what date.
- Evidence: a completion record, test score, or sign-off.
- Follow-up: what happened if someone failed or the requirement changed.
If any step is missing, it can count as a gap, even when the training really happened.
What ISO Standards Expect
Competence (ISO 9001 and ISO 27001). Both ISO 9001:2015, clause 7.2 and ISO/IEC 27001:2022, clause 7.2 ask you to:
- determine the competence each role needs,
- ensure people gain it through education, training, or experience,
- evaluate the effectiveness of the actions taken where applicable, and
- retain documented information as evidence.
Attendance alone may not be enough. Depending on the role, a test result or supervisor sign-off can show that someone can actually do the task.
Awareness (ISO 27001, clause 7.3). Everyone, not just specific roles, should understand the information security policy, how they contribute to it, and what happens if they ignore it. Keep awareness records separate from role-based competence records so you can show either one on request.
Annex A control 6.3. This control covers security awareness and training. Whether it applies depends on your risk assessment and risk treatment decisions; your Statement of Applicability should record the decision and justification. If you excluded it, be ready to explain why.
Clause numbers and wording vary by edition, so check the version your certificate covers.
What GDPR Requires
GDPR doesn’t mandate a specific course, test, or refresher interval. It does set related duties:
- Article 29 and Article 32(4): staff with access to personal data must only process it on your instructions, unless EU or member-state law requires otherwise. Controllers and processors must take steps to make that happen.
- Article 5(2): you must be able to show what you did. Training records are one practical way to do that.
How often should you train? The law gives no interval. UK regulator guidance, which isn’t a legal requirement, treats induction plus refresher training as a good control. See the ICO guidance on training and awareness. Pick a cycle that matches the risk of each role’s data, write it down, and follow it. If you publish a refresher cycle, auditors, clients, and regulators may expect you to stick to it.
Can GDPR audits still reach you? Yes, even without a fixed audit schedule. If you act as a processor, your controller client may audit you under Article 28(3)(h); regulators can also investigate you. So you may be asked for your training records at any time.
What to Record for Every Training Event
Your records should answer who, what, when, and how well:
- Person, role, and department
- Course title and version number
- Assigned, completed, and renewal dates
- Test score, pass or fail, and attempts
- Who delivered or approved the training
- Any waiver or late completion, with a reason
The version number is the field teams skip most. An auditor may ask which policy version someone learned, and “the latest one” isn’t an answer.
Also link each record to a role requirement, and keep a change history. A record edited without an audit trail may be difficult to rely on as evidence, because its integrity and history can’t easily be shown.
Keeping Records Secure
Training records name people and results, so they’re personal data. GDPR doesn’t give a fixed checklist. It asks for security appropriate to the risk. For training records, that usually means:
- Access controls: few people should be able to edit.
- Activity logs: track who views, changes, or exports records.
- Encryption: protect storage and backups.
- Minimization: keep only what you need.
- Retention limits: GDPR sets no single period, so decide one, write it down, and delete records when it ends.
Common Gaps That Lead to Findings
- Spreadsheets anyone can edit
- Completion tracked, but no test results
- Records not updated after a role change
- Missing renewal dates
- Contractors and part-time staff left out
Regulators also expect monitoring. The ICO suggests setting completion targets and reporting on them regularly.
Training gaps can also have real consequences. In October 2022, the ICO issued a £4.4 million penalty notice to Interserve Group Ltd following a 2020 phishing-related cyber attack that exposed the personal data of up to 113,000 employees. The ICO found failures including an unaddressed suspicious-activity alert, outdated systems and protocols, insufficient risk assessments, and inadequate staff training. Training was one of several findings, so this case doesn’t show that records alone decide an outcome. It does show that regulators look at whether staff were trained and whether the organization acted on warning signs. Read the ICO’s Interserve enforcement announcement.
Where an LMS Can Help
Manual tracking works until the first sample request. A learning management system with an audit trail can log who completed what and when, show later changes to a record, and flag overdue or expiring training.
NetSkill LMS includes features such as audit trails, activity logs, role-based access, encrypted data security, and competency tracking that can support ISO and GDPR readiness. Using any software does not make an organization ISO certified or GDPR compliant. Certification depends on your management system and an assessment by a certification body. GDPR compliance depends on how you handle personal data overall.
A tool also doesn’t replace ownership. Someone still has to define role requirements, set refresher cycles, decide retention periods, and review the reports.
A Simple Starting Plan
Start small this week:
- Pick one role and trace it from requirement to follow-up.
- Find where its training records live and who can edit them.
- Write down a refresher cycle and a retention period.
These three steps can show you many of your gaps before an auditor does.
See Audit Trail and Compliance Features →
Request an LMS Demo →
