What evidence do auditors accept for training effectiveness?

Auditors look for evidence that connects a named person to a demonstrated capability, not just to a course. In practice that means: a record of who was trained on what and when, the criteria they were assessed against, who performed the assessment, the result including any re-attempts, and evidence that the capability was checked again after a defined interval or a triggering event. A completion certificate on its own answers only the first of these.

What does ISO 45001 require for competence?

ISO 45001 clause 7.2 requires the organisation to determine the necessary competence of workers affecting OH&S performance, ensure workers are competent on the basis of appropriate education, training or experience, take actions to acquire and maintain the necessary competence, and retain documented information as evidence of competence. The key phrase is 'evidence of competence' — the standard asks for evidence about the person, not a record of the course.

How long do training records need to be kept?

It depends on the standard and jurisdiction. Some OSHA standards specify retention explicitly, others are silent and are governed by the general expectation that current certification is demonstrable. Several health-related standards require records to be kept for the duration of employment plus thirty years. The practical rule is to retain records for as long as the person holds the role plus the longest applicable retention period, and to verify the specific standards that apply to your operation.

What are the most common training-related audit findings?

In our experience the recurring ones are: records that exist but cannot be retrieved quickly, no documented evaluation criteria behind a pass, missing refresher training after a triggering event such as a near miss or an equipment change, training delivered on a generic equipment type rather than the specific model in use, and no evidence of anything beyond completion. The last is the one most programs share.

Is a completion certificate enough to prove training?

It proves the training was delivered and attended, which is necessary but not sufficient. It does not establish that the person can perform the task, does not record what they were assessed against, and does not identify who judged them competent. Where a standard requires an evaluation of performance — as the powered industrial truck standard does — a completion certificate alone will not satisfy it.

How to Prove Training Effectiveness to an Auditor

There is a specific moment in an audit that separates well-run training programs from well-documented ones. The auditor stops asking whether training happened, and starts asking how you know it worked.

"We ran the training" answers the first question. It does not answer the second, and the second is the one that produces findings.

This is a practical guide to the evidence that survives that moment.

The shift the standards already made

Most modern frameworks stopped asking about courses some time ago and started asking about people.

ISO 45001 clause 7.2 is the clearest example. It requires the organisation to determine the competence needed by workers who affect OH&S performance, ensure those workers are competent, take action to acquire and maintain that competence, and — the operative phrase — retain documented information as evidence of competence.

Read that last line carefully. It does not say "evidence of training." It says evidence of competence. That is a claim about the person, and a course roster is not one.

The same logic runs through OSHA's task-specific standards, which typically require formal instruction, practical training, and an evaluation of performance in the workplace, certified by a named individual. We covered where that line falls in does VR safety training satisfy OSHA requirements.

The five questions

Audits vary, auditors vary, and industries vary. These five come up almost every time.

1. Who was trained, on what, and when?

The expected answer is a record indexed by person and task, not by course. Auditors sample: they pick a name off the floor and ask what that individual is qualified to do.

A finding appears when the answer is organised the other way round — a list of who attended a session, from which the individual's qualification has to be reconstructed.

2. What were they assessed against?

"They passed" invites the follow-up: passed what, exactly? Documented criteria — the specific behaviours or steps that constitute competent performance — are what turn a judgement into evidence.

If the criteria only ever existed in the assessor's head, the pass is not auditable. It may well have been correct. It is just not demonstrable, and in an audit those are the same thing.

3. Who performed the evaluation?

A name and a date. For powered industrial trucks this is written into the standard; elsewhere it is the practical expectation.

This requirement exists because it forces a qualified human to take responsibility for the claim. It is also, not coincidentally, the part no software product can do for you.

4. What happened after a triggering event?

Refresher requirements are the most commonly missed item we see. Many standards require retraining after specific triggers — an accident, a near miss, an observed unsafe practice, a change in assigned equipment, a change in workplace conditions — independent of the routine interval.

Auditors find these by working backwards from your incident log. If there is a near miss in March and no corresponding retraining record, that is a finding, and it is a hard one to argue with.

5. Can you produce all of this within the hour?

Records that exist but cannot be retrieved during an inspection function, practically, as records that do not exist. Retrieval time is a real control, and it is the one most often discovered to be broken at the worst moment.

The gap in almost every program

Work through those five questions and most organisations can answer one, three, and five reasonably well. Two and four are where the gaps cluster — and underneath both is the same root cause.

The system of record captures completion, and nothing else.

Completion cannot tell you what someone was assessed against, because there were no criteria beyond reaching the end. It cannot show performance under a triggering event, because it never recorded performance at all. A worker who scraped through on a fourth attempt and one who was flawless on the first produce identical records. (We unpacked that in completion vs competency.)

So the honest summary is: most training programs are documented, and comparatively few are evidenced.

A checklist worth running

Before your next audit, sample three of your own people the way an auditor would — pick names, not courses — and try to produce:

[ ] Every task they are currently qualified to perform, with dates
[ ] The criteria each qualification was assessed against
[ ] The name of the person who evaluated them, per qualification
[ ] Their result, including re-attempts, not just the final pass
[ ] The specific equipment model or variant covered, where the standard is equipment-specific
[ ] Any refresher triggered by an event, cross-checked against the incident log
[ ] Evidence the capability was re-checked at the required interval
[ ] Retention: how long these will be kept, and where

Everything you cannot produce in under an hour is a finding waiting to be written by someone else.

The equipment-specific line deserves emphasis. Where a standard requires training on each type of equipment an operator uses — as the powered industrial truck standard does — a generic module covering "forklifts" may not cover the classes actually on your floor. This is a common and avoidable finding.

What better evidence looks like

The upgrade is not more paperwork. It is changing what gets captured at the moment of assessment.

Instead of a completion flag, record the performance: the sequence of actions taken, where the person hesitated, what they corrected, whether they succeeded on the first attempt, and how they behaved when conditions were not ideal. That record answers questions two and four directly, and it does so without an assessor having to reconstruct anything from memory weeks later.

It also changes the conversation with the auditor. "Here is what this person did" is a materially stronger position than "here is a certificate saying they attended."

Where we come into this

We build industrial XR training, and this is the wall we kept hitting with clients: excellent completion data, almost no evidence of capability.

That is the problem LSM is built for. Where traditional platforms record that someone watched a course, LSM is a browser-native way to measure competency — capturing behavioural evidence during a realistic task, so what you retain is a record of what the person did rather than a tick confirming they were present.

It is patent-pending and pre-launch, arriving in 2026 with a limited early-access cohort. It does not remove the requirement for a qualified person to evaluate workers in your facility. What it changes is the quality of the evidence that evaluation rests on, and what you can put in front of an auditor afterwards.

If the checklist above produced more blanks than you were comfortable with, that is worth a conversation — see LSM or get in touch.

This article describes general expectations under US OSHA standards and ISO 45001 and is not legal advice. Requirements differ by jurisdiction, standard, and industry, and state plans may be stricter than federal OSHA. Verify the standards that apply to your operation with your compliance officer or safety counsel.