Proof of compliance training: what the auditor wants to see

To prove compliance training to a regulator or an auditor, you need to be able to show three things: who was trained and when, on what content, and what that training produced. Attendance lists answer the first question, the program the second. The third requires assessments, and that is where many files are weak.

This article lists the records to keep and what the authorities recommend checking. It also shows what debriefed practice sessions add as proof of competence. It complements our guide to mandatory compliance training.

What do the authorities ask for as proof?

Texts often require training without saying how to prove it. The recommendations of the French Anti-Corruption Agency (AFA), published in the Journal officiel of January 12, 2021, are more precise. They describe a training program for managers and the employees most exposed. This audience is identified from the risk map.

These recommendations encourage tools to check that training has been properly understood, for example a test during the session or after a delay. They also suggest tracking the coverage rate of the target audience and the number of hours devoted to compliance. They state that the compliance officer must know the schedule and content of the training, and be able to monitor its rollout.

For the code of conduct, the AFA asks for a record of its handover or availability to be kept. In the financial sector, DORA (Article 13(6)) makes ICT security awareness programs mandatory within training plans. They cover all employees and senior management. The auditor will expect to see that they exist and that they were followed.

The records to keep in an evidence file

A solid file comes down to five families of documents. Each answers a question the auditor is likely to ask.

1. The scope. Who is concerned and why: list of exposed groups, drawn from the risk map or the analysis of the job.
2. The content. Program, objectives, materials, version and update date. If the content changes, keep the history.
3. The delivery. Dates, durations, attendance or log-ins, coverage rate of the target audience.
4. The assessment. Tests, results, thresholds, follow-up with those who failed.
5. The follow-up. Actions decided after the training, reports, content updates based on findings.

This structure follows the logic of the AFA's recommendations: check that the training took place, that it was understood, and that whoever runs the system learns from it. For training providers who are also preparing a quality certification (in France, Qualiopi), the documentary logic is similar.

Why attendance and a quiz are not enough

An attendance list proves that a person was there, or that they opened a module. A final quiz proves they recognized a few right answers. Neither proves they would know how to act.

An attentive auditor will therefore ask the following question: “How do you know your customer reps really ask the due diligence question?” Answering “they all passed the module” is honest, but the answer remains fragile. The same limits are detailed in our article on completion and competence.

The most convincing proof combines several levels: delivery, understanding and, where possible, observation of behavior in context. It is this third level that debriefed practice can feed.

What debriefed practice sessions add

In a practice scenario, the learner does what is expected of them, or does not. The record is no longer a checked box, it is an observation: what they said, what they left out, their level on each objective. Several sessions also show their progress.

With Face Up, each session produces a debrief: objectives met or not, strengths, points to improve, an action plan and quotes of what the learner said. The trainer can reread these elements, compare them from one session to the next and use them to document competence. The cases are those the trainer has written themselves, from their real situations.

This record adds to the classic evidence without replacing it. It answers the question inspectors ask more and more: what can the trained person actually do?

How to present the evidence to an auditor

A well-presented file can be read in a few minutes. Here is an effective outline.

1. A summary page: the target audience, the schedule, the coverage rate.
2. The program and its latest update, with date and author.
3. An extract of the results: average, distribution, number of people followed up.
4. Two or three anonymized examples of practice scenarios with their debrief.
5. The actions decided after the training, with their follow-up.

Anonymized examples are often what convinces. They show that the training exercises the expected actions, not just that it was opened. Remember to remove any unnecessary personal data before filing them in an audit folder.

Example of a per-session tracking sheet

For each session to produce its record without extra work, a short sheet is enough. It can include the following fields.

• the theme and the situation practiced, with the scenario version;
• the date, duration and identity of the learner;
• the objectives of the conversation and those met;
• two quotes of what the learner said, one successful and one to revisit;
• the action decided and the date of the next session.

These sheets, gathered by team, form a history that the compliance officer can consult in a few minutes. They also make it possible to spot collective points to rework: if half a team forgets to record an interview, the issue is organizational, not individual.

Testing the strength of your file before the audit

A simple exercise is to play the auditor. Take a theme, for example customer due diligence or harassment prevention, and ask yourself four questions.

1. Can I list the people concerned and prove they were trained?
2. Can I show the exact content they followed, on that date?
3. Can I show what they were able to do at the end, beyond attendance?
4. Can I show what I changed after reading the results?

If any answer is “no” or “more or less”, that is where the file is fragile. Better to find out internally, with time to correct, than in front of an inspector.

Common mistakes in an evidence file

• A file put together the day before the audit. Missing documents are discovered too late. Build the file up through the year.
• Undated content. It is impossible to know which version employees followed.
• Rates without a denominator. “95% trained” means nothing without the target audience.
• No action after a poor result. The auditor wants to know what you did with your findings.
• Too much personal data. Keep what is necessary, no more.

Planning the evidence at the design stage

The best way to build a solid file is to think about it when designing the training. For each theme, ask three questions: who is concerned, what behavior should we be able to observe, and what record will result? Training designed this way produces its evidence without extra effort.

In a practice-scenario approach, this means defining the objectives of the conversation from the start: ask the question, refuse, record, refer. These objectives become the assessment grid, and therefore the evidence. Our page on role plays presents the principle.

Frequently asked questions

How long should training evidence be kept?

The duration depends on the applicable text and on the limitation rules specific to each area. Ask your legal department and your data protection officer. Keep personal data for as long as necessary, no longer.

Is an attendance certificate enough?

It proves delivery, not understanding or competence. Complement it with assessments and, for the most exposed groups, with observations in context.

Who is responsible for the evidence file?

Most often the compliance officer, with the training department. The AFA's recommendations indicate that the compliance officer must be able to monitor the rollout of training. Everyone must know where the documents are.

How can you limit fatigue while keeping the evidence?

By splitting the training into short sessions that each produce a record. See our article on the fatigue caused by annual training.

To see how debriefed practice sessions feed an evidence file, book a demo.