Audits don’t usually expose a training problem.
They expose an evidence problem.
Someone asks, “Can you show me proof?” and suddenly the organisation is doing a frantic tour of half a dozen places: a spreadsheet tracker from last year, a shared drive full of PDFs, a manager’s inbox, a few sign-off forms, and an LMS report that doesn’t quite line up with the current policy version.
That scramble is avoidable.
This article gives you a repeatable way to build a Compliance Evidence Pack (CEP)—the set of records and supporting documents auditors actually ask for—covering training records, competence evidence, policy version control, sign-offs, refresh cycles, and exceptions.
It’s written for real operational teams: HR, WHS/H&S, Compliance, People & Culture, Operations—especially in environments with contractors, role changes, casual staff, multiple sites, or fast-moving SOPs.
Quick answer: what a Compliance Evidence Pack is (and what to include)
A Compliance Evidence Pack (CEP) is a single, audit-ready bundle of proof that shows:
- What was required (training/policies/procedures)
- Who completed what and when
- Which version they saw (and when it became effective)
- How you verified understanding/competence, plus what you did about gaps
If you only build one thing, build this six-part pack:
- Training completion records (who/what/when/result)
- Competence evidence (not just attendance)
- Policy + procedure version history (what changed, when, why)
- Sign-offs and acknowledgements (worker + manager, where applicable)
- Assignments + refresh cycles (proof of ongoing control)
- Exceptions + corrective actions (overdues, remediation, re-training)
Important: Most organisations don’t have a neat “pack” sitting ready. The CEP is a repeatable bundle you generate from your current systems. In an LMS it’s usually exports; without one it’s often simple registers + attachments. The format matters less than consistency and traceability.
Who this guide is for (and what it’s based on)
This guide is built for teams who need evidence that stands up under scrutiny—without creating a full-time admin job.
It’s based on common audit request patterns (records, currency, version control, sign-off trails) and practical expectations aligned to regulator guidance around providing training/instruction and being able to demonstrate it. For context:
- Safe Work Australia (training and supporting workers guidance).
- WorkSafe New Zealand (training/instruction/supervision guidance and broader safety resources).
Those sources don’t prescribe one perfect “pack format”—but they do reinforce the underlying duty and the expectation that organisations can show what was done, for whom, and when. Note that Safe Work Australia’s guidance reflects the model WHS laws adopted by most states and territories — Victoria operates under its own Occupational Health and Safety Act 2004, so requirements there can differ.
What auditors actually mean by “evidence” (and why most organisations fail here)
Auditors don’t want a narrative. They want a trail.
When auditors say “evidence,” they’re looking for proof that your organisation has ongoing control, not just periodic activity. That usually means you can show—cleanly and consistently—that:
- training requirements were identified and assigned
- workers received suitable information/instruction
- understanding or competence was checked where necessary
- controlled documents were current and communicated
- refresh cycles were tracked
- exceptions were managed and closed out
Compliance training completed ≠ compliance proven
A completion tick can be useful. But it isn’t the same as proof.
If an incident occurs tomorrow, or an audit request lands today, the questions tend to be:
- Was the training required for this person’s role at that time?
- Was it aligned to the current procedure version?
- Is there evidence of understanding or competence (assessment, observation, sign-off)?
- What happens when someone is overdue?
Evidence is about showing your process works when it matters.
The 3 gaps auditors find fast: missing records, unclear versions, weak sign-offs
Most audit pain comes from one of these:
- Missing records: training happened but wasn’t captured consistently (especially offline sessions).
- Unclear versions: you can’t prove learners saw the right policy/procedure version.
- Weak sign-offs: “read it” and “authorised to do it” are treated as the same thing.
What auditors ask for (and the evidence they expect)
Here’s the “translation layer” that saves you hours.
Q: “How do you know who was required to do what training?”
A: A training matrix or role-based assignment rule + a view showing required vs completed for the scope.
Q: “How do you know training content was current?”
A: A policy/procedure version register plus proof training/acknowledgement aligns to the effective version (or a change log + re-acknowledgement/refresher process).
Q: “How do you know people understood it?”
A: Assessment results, pass marks, attempts, or observation/competency checklists—especially for higher-risk tasks.
Q: “What happens when someone is overdue?”
A: An exceptions/corrective actions log showing follow-up actions (reminders, escalation, remediation) plus closure proof.
The Compliance Evidence Pack (CEP) — the 6 components you need every time
The CEP is the pack you assemble for a specific scope (site/team/time window). Build the structure once, then repeat it.
The Compliance Evidence Pack — at a glance
| CEP component | What it proves | Minimum fields auditors look for | Common failure |
|---|---|---|---|
| Training completion records | Training occurred | learner, role-at-time, module ID/title, completion date, result | records split across systems |
| Competence evidence | Capability, not attendance | assessment/observation results, assessor, date | “they attended” with no verification |
| Policy/procedure version history | Currency + control | version, effective date, approval, change summary | can’t prove who saw which version |
| Sign-offs & acknowledgements | Accountability | worker acknowledgement + manager authorisation where needed | sign-offs missing or late |
| Assignments + refresh cycles | Ongoing control | refresher rules, due dates, overdue tracking | refreshers not enforced |
| Exceptions + corrective actions | Gaps are managed | reason, action, restriction controls, closure proof | overdues with no remediation trail |
Now, the practical detail.
1) Training completion records (who, what, when, result)
This is the baseline. It should stand alone without explanation.
Capture (at minimum):
- learner identity (name + unique identifier)
- role/site at time of completion
- course/module identifier (not just a title)
- assigned date + due date (where applicable)
- completion date/time
- status (complete/incomplete/overdue)
- result (score/pass where relevant)
- evidence attachments (if needed)
2) Competence evidence (not just attendance)
For many risks, auditors won’t accept attendance alone.
Competence evidence can include:
- quiz/assessment results (pass mark + attempts)
- supervised observation checklists
- buddy/coach sign-off after live demonstration
- practical verification steps (critical task performed correctly)
- licence/ticket evidence (where relevant)
If you manage high-risk tasks, this is where your pack becomes defensible.
3) Policy + procedure version history (what changed, when, why)
This is where audit confidence often collapses—because version control tends to be “mostly fine” until it’s tested.
Your version history should show:
- document title and owner
- version number (or date-based versioning)
- approval details
- effective date
- change summary (what changed)
- change trigger (why it changed)
- what it supersedes
4) Sign-offs and acknowledgements (manager + worker)
Two different controls often get merged:
- Worker acknowledgement: “I have read and understood this.”
- Manager authorisation: “I confirm this person is ready/approved to perform this task (or will operate under supervision).”
You don’t need manager sign-off for every policy. But when risk is meaningful, it’s often the missing link.
5) Assignments + refresh cycles (proof of ongoing control)
Auditors love one question: “How do you make sure training stays current?”
Your pack should show:
- assignment logic (by role/site/team)
- refresher cadence (time-based or event-based)
- due/overdue visibility
- how you manage escalation and completion
If you want a deeper internal reference on keeping training current (especially where content changes), read this.
6) Exceptions + corrective actions (overdues, remediation, re-training)
This is the section that turns “we found a gap” into “we manage risk.”
Include:
- what was overdue/missing
- why (leave, access delay, role change, contractor offboarding)
- interim controls (restricted duties, supervision, escorted work)
- actions taken (reminder, escalation, remediation plan)
- closure proof (completed + verified)
The “minimum viable” evidence checklist vs enterprise-grade evidence
Not every business needs enterprise-level complexity. But every business needs evidence that’s consistent.
The minimum viable pack (even if you’re on spreadsheets)
If you’re starting from scratch, you can still build a credible pack with four core registers:
- Training Register (completion + due/overdue in one view)
- Policy Version Register (what’s current + when it changed)
- Sign-off Register (who acknowledged what, when)
- Exceptions Log (what was missing/overdue and what you did)
Then attach:
- current policy/procedure copies, and
- any competence evidence you have (checklists, photos, licences)
That’s enough to answer most audit questions without improvising.
SMB checklist (what you can’t skip)
- one view of training completions and overdues by scope
- role-at-time captured somewhere
- policy register with version + effective date
- acknowledgements for key policies
- refresher rules (even if simple)
- offline training capture method (toolbox talk log)
- exceptions log with closure notes
Enterprise checklist (when you need segmentation and audit trails)
If you’re multi-site, high turnover, contractor-heavy, or regulated:
- role-based training matrices per site/business unit
- segmented reporting (role/site/date/version)
- audit trail logs (who changed what and when)
- controlled distribution (only current policies accessible)
- automated refreshers + escalation
- HRIS integration/identity sync
- competence workflows linked to high-risk tasks
Records — what to capture for training (the fields that matter)
Most audit trouble comes from missing fields, not missing effort.
Learner identity + role at time of training
People move roles. Contractors rotate. Casuals switch sites.
Capture:
- name + unique identifier
- site/location (if relevant)
- role/title as at completion
- employment type (employee/contractor/casual)
- manager at time of completion
Course/module identifier + learning outcomes
Titles drift. Courses get rebuilt. “Induction” becomes “Induction v3.”
Capture:
- course ID or stable identifier
- short learning outcomes/objectives
- mapped requirement (policy/procedure/risk area)
Assessment results, attempts, and pass marks
If understanding matters, proof matters.
Capture:
- score
- pass mark
- number of attempts
- completion rules (must pass quiz, must upload evidence, must be signed off)
Time stamps, completion status, and evidence attachments
Capture:
- assigned date + due date
- completion date/time
- status
- evidence attachments (photos/checklists/forms)
- reason codes for non-completion
Versions — how to prove the learner saw the right version
This is one of the fastest ways to lose audit confidence.
The “policy mismatch” problem (and how it happens)
Common sequence:
- SOP updated (v2 → v3)
- old PDF remains in a shared folder
- a manager forwards last year’s slide deck
- training content still references v2
- someone completes training… but you can’t prove they were trained on v3
Result: you have “training records,” but the organisation can’t show alignment to the current controlled document.
What version control looks like in practice
Strong version control typically includes:
- one source of truth for controlled docs
- clear version numbers + effective dates
- superseded versions archived (not in circulation)
- training/acknowledgements tied to versions
- a logged update process for impacted roles
For internal context on compliance policies and how to connect process to proof, read this.
Change logs: what auditors expect to see
Auditors don’t need a novel. They need clarity:
- what changed (short dot points)
- when it changed
- who approved it
- how it was communicated (acknowledgement/refresher/toolbox talk)
Sign-offs — the difference between “read” and “accepted responsibility”
Sign-offs are where many teams accidentally overclaim.
Worker acknowledgement vs manager authorisation
- Acknowledgement = awareness and receipt
- Authorisation = permission and accountability
If something is high-risk, acknowledgement alone might be meaningless without competence checks and manager authorisation.
When you need sign-off (and when you need competence checks instead)
Use worker acknowledgement when:
- it’s policy awareness (code of conduct, privacy, general procedures)
- you need proof the policy was issued and read
Use manager authorisation when:
- permission is required to operate unsupervised
- mistakes create meaningful safety/quality risk
- there’s equipment, licensing, or restricted access involved
Use competence checks when:
- the task is practical and risk-based
- you need demonstrated capability, not just knowledge
Don’t have a “pack” yet? Here’s how to build one from what you already have
Most organisations don’t have neat pack folders ready to go. Your first CEP often looks like:
- one or two registers (spreadsheets)
- a set of policy PDFs
- some sign-off evidence from forms or email trails
- a handful of competence checklists
That’s normal.
A practical rule:
- If you can’t export it, capture it (PDF print or screenshot)
- If it doesn’t exist, create a one-page register (templates below)
- If it exists in multiple places, choose one as the source of truth for the audit window and document that decision
Your goal isn’t perfection. Your goal is that an auditor can follow the trail without guesswork.
How to assemble your pack in 60 minutes (repeatable process)
The 60-minute build checklist (even without an LMS)
- Confirm scope (site/team/time window + policies in scope)
- Pull training proof from wherever it lives (LMS report, spreadsheet, attendance sheets)
- Create a single Training Records view for the audit window
- Gather policy copies + update the Policy Version Register
- Pull acknowledgements/manager sign-offs (or list them in a register)
- Add refresher rules + mark who is due/overdue
- Create an Exceptions Log for anything missing or overdue (with actions taken)
- Spot-check 5 people end-to-end (role → requirement → completion → version → sign-off)
- Save everything in one folder with an index page
Step 1: Define scope (site/team/time period)
Write down:
- sites/locations included
- roles/teams included
- audit window (e.g., last 12 months)
- policies/procedures in scope
- high-risk tasks/licences in scope
Step 2: Pull the evidence set (training + policies + sign-offs)
Aim for “auditor navigates without asking you questions.”
Step 3: Run a quick integrity check (duplicates, gaps, outdated versions)
Check:
- duplicate learner profiles (two emails, two IDs)
- missing role history
- course naming drift (“Induction” vs “Induction v3”)
- policy effective dates missing/unclear
- overdue outliers with no remediation trail
Step 4: Structure it for audit (folders, naming, index page)
A simple structure that works almost everywhere:
- Scope summary
- Training records
- Competence evidence
- Policy versions
- Sign-offs
- Refreshers/overdues
- Exceptions/corrective actions
Where evidence falls apart (common failure points) + fixes
Spreadsheets, shared drives, and “multiple sources of truth”
Problem: records don’t match, versions drift, sign-offs hide in inboxes.
Fix: one source of truth per pack component + a consistent export/register method.
Casuals/contractors and role changes
Problem: people fall between processes, training rules don’t apply cleanly.
Fix: capture role-at-time + review role changes + assign training by role, not person.
Offline training and missing uploads
Problem: toolbox talks happen, but later there’s no proof who attended or what was covered.
Fix: standard toolbox talk template + consistent storage + acknowledgement step.
Managers signing late (or not at all)
Problem: sign-offs become optional until audit week.
Fix: due dates, escalation, visibility, and clear ownership.
What to look for in systems/software (so evidence is always ready)
You can build a CEP manually. Many teams do. The trade-off is usually time, version confusion, and chasing.
If you’re evaluating systems, prioritise capabilities that keep evidence connected:
Audit trail + immutable logs
You want to see:
- who assigned training
- who changed due dates
- who updated content
- who approved versions
Reporting exports (by role, site, policy version, date range)
If you can’t filter and export cleanly, you rebuild the pack from scratch every time.
Automated refreshers + overdue tracking
Refreshers are ongoing control. Overdues are reality. Both need visibility.
Centralised policy distribution + acknowledgements
The “current version” should be obvious—and acknowledgements should link to that version.
Integration with HRIS to keep roles/current state accurate
Accurate roles = accurate training requirements and reporting.
If you want a broader internal foundation for compliance training expectations, read this.
Templates you can copy/paste (built for audit export)
These are designed to work whether you’re using an LMS or a spreadsheet.
1) Evidence Pack Index (one-page table of contents)
| Pack section | What’s included | What it should look like |
|---|---|---|
| 1. Scope | sites/teams/time period + what’s in/out | 1-page summary |
| 2. Training records | completions + due/overdue | export report or single register table |
| 3. Competence evidence | assessments/observations/licences | checklists, licences, attachments |
| 4. Policy versions | version register + current policies | register + controlled copies |
| 5. Sign-offs | acknowledgements + authorisations | register (worker + manager where needed) |
| 6. Refreshers | cadence rules + current status | rules + due/overdue snapshot |
| 7. Exceptions | gaps + remediation + closure | log with actions + closure proof |
2) Training Evidence Checklist (copy/paste)
- Learner ID (name + unique identifier)
- Role/title at time of training
- Site/location (if relevant)
- Course/module ID + title
- Learning outcomes (short)
- Assigned date + due date
- Completion date/time
- Status (complete/incomplete/overdue)
- Score + pass mark (if assessed)
- Attempts (if relevant)
- Evidence attachments (if required)
- Supervisor/assessor name (if applicable)
3) Policy Version Register (simple format)
| Document | Owner | Version | Effective date | Change summary | Approved by | Supersedes |
|---|---|---|---|---|---|---|
| SOP: Incident Reporting | H&S Lead | v3.0 | 2026-01-15 | Added escalation step + updated form | Ops Director | v2.2 |
4) Sign-off Register (worker + manager)
| Person | Role (at time) | Document/task | Version | Worker acknowledged (date) | Manager authorised (date) | Notes |
|---|---|---|---|---|---|---|
| J. Smith | Team Leader | Forklift SOP | v4.1 | 2026-02-01 | 2026-02-02 | Observed on shift |
5) Refresher Rules Register (simple format)
| Training / requirement | Applies to (roles/sites) | Frequency | Trigger events | Owner | Evidence method |
|---|---|---|---|---|---|
| Induction | All starters | Once | Role change | HR | completion record |
| WHS risk module | Warehouse roles | 12 months | incident/change | H&S | quiz + sign-off |
6) Exceptions Log (simple format)
| Person | Requirement | Due date | Why overdue/missing | Interim control | Action taken | Closure proof |
|---|---|---|---|---|---|---|
| Taylor Example | Forklift SOP | 2026-02-01 | Access delay | No forklift operation | Escalated + remediation booked | Completed + observed |
Want audits to be boring again?
You can build a Compliance Evidence Pack manually—and if audits are rare, that might be fine.
But if your organisation is juggling multiple sites, high turnover, contractors, and frequent policy updates, the fastest way to make audits painless is to keep records, versions, sign-offs, refreshers, and exceptions connected—so you can produce the evidence set on demand.
If you want to see what “exportable in minutes” looks like, book a demo of Tribal Habits and we’ll walk through evidence views and reporting workflows using your real-world scenarios (sites, roles, contractors, refreshers).
Need more info?
FAQs
What’s the difference between training records and competence evidence?
Training records show completion. Competence evidence shows the person can perform safely and correctly—often via assessment or observation.
What records do you need for a compliance audit?
At minimum: training completion view (scoped), policy/procedure version register, sign-offs/acknowledgements where relevant, refresher/overdue snapshot, and an exceptions log with actions and closure proof.
How do we handle training completed before the latest policy update?
Log the policy change, identify impacted roles, and trigger acknowledgement/refresher where required—then record completion against the new version.
Do we need signatures for everything?
No. Use the right control for the risk: acknowledgement for awareness, manager authorisation for permission/accountability, competence checks for high-risk practical tasks.
How do we evidence toolbox talks or in-person sessions?
Use a consistent record: topic, date, facilitator, attendees, and acknowledgement. Store it with the rest of your pack evidence.
What should we export for an audit if time is tight?
The fastest set is: training completion view, policy version register + current policies, sign-off register, refresher/overdue snapshot, exceptions log.
How do we prove someone saw the correct version?
Tie training/acknowledgement records to a controlled document version (version number + effective date) and maintain a change log.
Why do evidence packs fail even when training is happening?
Because evidence is fragmented, versions drift, and exceptions aren’t documented. Audits reward consistency and traceability.
What does “good” look like to auditors?
A pack that is easy to navigate, internally consistent, version-aware, and honest about exceptions—with closure proof.
This information is general in nature and doesn’t constitute legal or compliance advice. Requirements vary by state, sector and organisation, so we’d always recommend checking with your regulator or professional adviser before relying on it.
Further reading
- Online Compliance Training Australia: The Complete Guide
- Compliance Training in Australia: Your Online Learning Solution
- LMS for Compliance Training: Keeping Teams Certified
- Going Beyond Spreadsheets in Training Compliance
- What Regulators Expect From Your Training Records
- The LMS Features That Make Audits Easy (and Stress-Free)
- What LMS Reporting Should Actually Look Like
- 7 Ways LMS Automation Saves You Hours Every Week
