Training Compliance Audit Preparation: A Practical Checklist

An inspector is coming. Maybe you got a letter from HSE scheduling a visit. Maybe CQC announced an inspection window. Maybe your local Environmental Health team is doing routine food safety checks next month.

You have two to four weeks. Your training records need to be audit-ready. This compliance audit checklist walks you through exactly what to verify, fix, and organize before they arrive — and how to maintain your records year-round so unannounced visits do not catch you off guard.

This is not a generic overview of what audits are. It is the specific preparation work a manager of 10-50 staff can complete in a fortnight. Print it. Work through it. Tick things off.

What each regulator actually checks

Different regulators look for different things. Knowing what your specific inspector wants to see determines where you focus your preparation time.

HSE inspectors

HSE follows its Enforcement Policy Statement and focuses on the link between risk assessments and training. The logic is straightforward: you identified a hazard, you assessed the risk, you should have trained people to manage it. The inspector traces that chain.

Specifically, HSE wants to see:

Risk assessments with training requirements identified for each hazard
Training records showing the identified training was delivered, with dates and evidence of competence
Refresher schedules proving training is current, not a one-off from years ago
Trainer competence — who delivered the training and what qualifies them

If the chain breaks at any point — you identified a risk but cannot show the corresponding training, or training was delivered but there is no assessment of competence — that is a material breach. Under Fee for Intervention, you start paying HSE's costs at £188 per hour from that moment. A breakdown of real prosecution costs shows how quickly this escalates.

CQC inspectors

CQC assesses care providers against Quality Statements under their single assessment framework. For training, the relevant regulation is Regulation 18 (Staffing) of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014.

CQC inspectors typically:

Request your training matrix or records system
Select 3-5 staff members at random and check their individual records
Cross-reference what records claim against what they observe on the floor
Ask staff directly when they last completed specific training and what they learned

The matrix gets you through steps 1 and 2. Steps 3 and 4 are where training quality matters. CQC does not just check that training happened — they check that it worked. See the full CQC mandatory training list for every topic inspectors expect to find.

Environmental Health officers

Environmental Health visits are governed by the Food Safety Act 1990 and the Food Safety and Hygiene (England) Regulations 2013. Officers check that food handlers hold appropriate food hygiene qualifications — Level 2 minimum for handlers, Level 3 for supervisors and managers.

They want to see:

Certificates for every person who handles food, with dates
Allergen training records, particularly since Natasha's Law (the Food Information (Amendment) (England) Regulations 2019, in force from October 2021)
HACCP documentation showing your food safety management system and the training behind it
Renewal evidence — food hygiene certificates older than three years will be flagged even though there is no fixed legal expiry

The compliance audit checklist: 12 items to verify

Work through each item. A "no" is a gap that needs fixing before inspection day.

Records completeness

Every current employee has a training record on file. Not most employees — every single one. Check headcount against your matrix. One missing person invalidates the system.
No expired certificates are showing as compliant. This is the single most common training record mistake and the one inspectors treat most seriously. An expired cert marked as current suggests your whole system is unreliable.
Induction records exist for every employee. Each record should show what was covered, when, and who delivered it. Regulation 13 of the Management of Health and Safety at Work Regulations 1999 requires health and safety training on recruitment — not during the first week, on recruitment.
Trainer qualifications are documented. For every training session, you should have a record of who delivered it and what makes them competent to do so. External provider accreditation details count. For internal training, a register of approved trainers with their areas of competence is sufficient.

Evidence quality

Competency assessments are completed for each training event. Attendance records prove presence, not competence. You need evidence that staff were assessed after training — a short test, a practical demonstration, a workplace observation. If your records only show sign-in sheets, that is a gap.
Training content is matched to actual workplace hazards. Generic e-learning modules do not satisfy the legal requirement to train staff on specific risks. Check that your training records reference the hazards identified in your risk assessments, not just generic topic titles.
Sector-specific mandatory training is covered. Cross-reference your records against the requirements for your sector. Our mandatory training compliance checklist breaks this down sector by sector with legal references and renewal intervals.

Coverage gaps

Agency workers, contractors, and part-time staff are included. This is where most SMEs fail. Your permanent staff matrix may be solid, but if an inspector asks for training records for the agency worker on shift that day and you have nothing, you have a problem.
Refresher training is evidenced. Initial training is necessary but not sufficient. Inspectors want to see that training is maintained — particularly for high-risk areas like manual handling (3-year recommended refresh), fire safety (annual), and first aid (3-year certificate cycle).
Role changes are reflected in training records. When someone moves from a desk role to a site role, their training requirements change. Check that promotions, lateral moves, and responsibility changes triggered corresponding training updates.

Accessibility

You can produce any employee's complete training record within 30 minutes. This is the practical test. If an inspector asks for records for a specific person, you cannot spend half a day searching through filing cabinets, email attachments, and spreadsheets on someone's laptop. If your records are scattered, consolidate them now. An employee training record template gives you a structure to work from.
Records include dates, not just status. "Compliant" is not evidence. "Completed Level 2 Food Hygiene on 14 March 2025, certificate expires 14 March 2028, delivered by ABC Training Ltd (Highfield accredited)" is evidence. Every entry needs completion date, expiry date, provider, and assessment outcome.

Run your current records through the training compliance gap checker if you want a structured assessment of where you stand on each of these items.

Common audit failures: what trips up SMEs

After researching HSE enforcement data and speaking with compliance consultants while building TrainProof, the same failure patterns appear repeatedly in businesses with 10-50 staff.

Scattered records across multiple systems. Training data lives in an HR folder, a line manager's spreadsheet, an external provider's portal, and a filing cabinet in the office. Nobody has the complete picture. When the inspector asks for it, assembling it takes hours.

Agency worker records missing entirely. The agency says they handle training. You assume they do. The inspector asks for evidence. You have none on site. Under health and safety law, the responsibility for ensuring workers are competent falls on whoever controls the work — that is you, not the agency.

No evidence of refresher training. Staff completed induction training and initial certifications. But there is no record of anything since. A first aid certificate from 2022 with no renewal. A manual handling course from three years ago with no refresher. Inspectors read this as a training programme that was set up once and then abandoned.

Competency conflated with attendance. The training record shows 30 staff members attended a fire safety session. It does not show whether any of them could actually use a fire extinguisher or explain the evacuation procedure. Attendance is logistics. Competence is compliance. Why this distinction matters is worth reading if you have not already.

Records cannot be produced quickly. The documents exist, somewhere, but finding them takes too long. HSE's own guidance states that training records should be readily accessible. An inspector who has to wait will not be impressed — and the time they spend waiting is billable under Fee for Intervention.

How to structure your evidence pack

Inspectors do not specify a format. But certain structures make their job easier, which makes your inspection go faster.

Organise by employee, not by training type

The inspector's mental model is: pick an employee, check their records. So your primary organisation should be per-person. Each employee should have a single file (physical or digital) containing:

Personal details and role
Start date and induction record
A list of all required training for their role
Completion dates, expiry dates, and certificates for each item
Competency assessment records
Any notes on gaps and planned remediation

A secondary index by training type is useful for your own management — seeing at a glance how many staff hold current first aid certificates, for example — but the per-person view is what the inspector will use.

Keep originals accessible

Certificates should be copies, not originals held by the employee. If someone is off sick on inspection day and their certificate is in their locker, you cannot produce it. Scan and store everything centrally.

Maintain an audit trail

If you update a record — correcting an error, adding a missed certificate, changing an expiry date — keep a log of what changed, when, and by whom. Inspectors understand that records need correction. What they question is records that appear to have been hastily assembled or backdated.

Prepare a summary sheet

Create a one-page overview showing: total headcount, number with complete training records, number with gaps, and what actions are in progress to close those gaps. This is not a regulatory requirement, but it signals to the inspector that you know where you stand and are managing it proactively.

Year-round maintenance: avoiding pre-audit panic

The checklist above works for scheduled inspections. But CQC visits can be unannounced. HSE can arrive without notice after an incident report. Environmental Health officers can walk in during operating hours.

If your records are only audit-ready the week before a scheduled visit, you have a permanent compliance gap.

Quarterly review cycle

Set a fixed quarterly date — the first Monday of January, April, July, October works well — and run through the 12-item checklist above. Four hours, once a quarter. That is 16 hours per year to maintain inspection readiness versus the 40+ hours of panic-consolidation most managers do when they get the letter.

Each quarterly review should cover:

Headcount reconciliation. Does the matrix match current staff? Anyone joined, left, or changed role?
Expiry scan. What expires in the next 90 days? Is renewal booked?
Gap identification. Any items showing incomplete or missing? Why?
Agency and contractor check. Do you hold current training evidence for everyone working on site this quarter?

Monthly expiry check

Between quarterly reviews, run a monthly check focused solely on upcoming expiries. Certificates expiring in the next 60 days need renewal booked immediately. Anything expiring in the next 30 days is urgent. For how to set this up properly, see our guide on training expiry alerts.

Trigger-based updates

Do not wait for the quarterly review to update records after these events:

New starter joins (add to matrix and complete induction within first day)
Employee changes role (review and update training requirements)
New regulation or guidance published (check whether training matrix needs updating)
Incident or near-miss (verify training records for everyone involved)
Training session completed (update records within 48 hours, not "when someone gets around to it")

The 30-minute test

Here is the simplest way to know if you are audit-ready. Pick any employee at random. Set a timer. Try to produce their complete training record — every required course, completion date, expiry date, certificate, competency assessment, and trainer details.

If you can do it in under 30 minutes, your system works.

If you cannot, you have preparation to do. Start with the 12-item checklist above.

This checklist is for general information purposes only and does not constitute legal or regulatory advice. Audit requirements and inspector expectations vary by regulator, sector, and the specific circumstances of your organisation. Always verify against current guidance from the relevant enforcement body (HSE, CQC, or local authority).

TrainProof gives you inspection-ready training records without the quarterly scramble. Every employee, every requirement, every certificate — tracked with automated alerts, audit trails, and one-click inspector reports.

Join the waitlist to be notified when it is ready.