Training records: what to keep for auditors and regulators

Sooner or later someone asks a financier to show that its staff are trained. It may be an internal auditor, or a bank that funds the business, checking how it manages risk. It may be a regulator, for a firm that has one. Or it may be after a loss, when the question is whether anyone should have spotted the fraud.

Most firms do train their people. Fewer can show it quickly and convincingly. This article is about the records that close that gap. It is general good practice, not legal advice: where your firm is regulated, or a funder sets its own requirements, those come first. It is an updated version of an article we first wrote about compliance training in receivables finance.

What a good training record shows

A record is useful when it answers the questions an auditor will ask, without anyone having to piece the answer together. For each person, that means:

• Who: the person, their role, and when they joined or changed role.
• What: the course or library, and which version of it. If content was updated after someone took it, the record should still show what they actually saw.
• When: the date they started and the date they completed.
• How well: assessment scores, or at least a pass or fail. Completion alone shows someone clicked through, and an auditor knows that.
• Since then: refreshers taken, and when. That shows knowledge being kept up, not a single event years ago.

At the level of the team, it also helps to keep:

• Who should have done what. A list of required training by role, so gaps are visible. The record shows who has been trained, and the requirement shows who should have been.
• Exceptions, and why. Someone on long-term leave, or a new joiner still within their induction period. A gap with a reason reads very differently from one with none.
• Changes over time. When a new library was made required, or a course was updated after a fraud case.

Keep it where you can find it

The records most likely to fail an audit are not missing. They are scattered: certificates in personal folders, a spreadsheet one manager kept, face-to-face attendance sheets in a filing cabinet.

• Keep one source. If your courses run in your own learning management system, that is where the record lives. If learners use a link instead, the platform keeps progress and scores, and you can export them.
• Bring outside training in. Add face-to-face courses, conferences and external qualifications to the same record, with the same fields.
• Decide how long to keep it. Set a retention period in your own data retention policy, and apply it consistently. Training records contain personal data, so the same data protection rules apply as to any other staff records.

Make it ready before anyone asks

An auditor’s request usually arrives with a deadline. A firm that can produce a clear report the same day makes a very different first impression from one that needs a fortnight.

• Report quarterly. A short report to the risk committee or the board: completion by role against requirement, scores, overdue training, and what is being done about it. This is also the best way to make sure the gaps get fixed.
• Show the link to risk. If a fraud case or an audit finding led to new training, record that. It shows training responding to what the business has learned, which is exactly what an auditor hopes to see.
• Check it occasionally. Pick three people at random and check their record against what they say they have done. Fixing an error yourself costs far less than having it found.

Training your clients’ staff

If you offer Credit Control for Clients to the people who run your clients’ ledgers, keep a record of that too. It is useful evidence of how you manage the risk in a client’s book. It can also help when a client’s credit control falls short and you need to show what support was offered. Keep it separate from your own staff records, and agree with each client what you will record and share.

What records can’t do

A perfect record of courses completed proves that training happened. It doesn’t prove that people would recognise a pre-dated invoice or a diverted payment on the day. Assessment scores and a steady record of refreshers come closer. Real evidence comes from the work itself: queries raised, problems found early, client audits that find less each year.

The best training records sit alongside that evidence. They show not only that the team was trained, but that the training is kept up, aimed at the right roles, and connected to the risks the business actually faces.