Audit-Ready Compliance Training Records: What to Track

An auditor doesn't want to hear that your team completed harassment training last quarter. They want to see it: who finished it, when, which policy version they signed off on, and what happened to the three people who didn't. If your LMS can't produce that quickly, you have a gap in your compliance program, whatever the training itself achieved.

This guide covers what a compliance training record needs to hold, how to handle renewals, overdue learners and manager reporting, what a usable export looks like, and how to check your own setup against all of it. The topic matters well beyond financial services, but the best-documented regulatory examples come from the FCA, so that is where the evidence below comes from.

Why "they completed the training" doesn't hold up

Say it out loud to an auditor and watch what happens next. They will ask for the record, not your word for it.

The FCA's own rulebook points the same way. Under SYSC 9.1, a firm must arrange for orderly records to be kept so the regulator can monitor its compliance. For firms covered by the common platform rules, those records must be kept for at least five years. FinTech Global, in a January 2026 piece with Theta Lake, makes the same point about the FCA's direction of travel: firms need to evidence outcomes, not just policies, with data integrity and auditability treated as core compliance obligations. The FCA issued fines totaling about £124.2 million in 2025, excluding court fines, according to its published list.

Records are a recurring theme in enforcement. Kyckr analyzed 22 FCA Final Notices on anti-money laundering failures between 2020 and 2025, covering more than £430 million in fines, and found data deficiencies were a contributing factor in 68% of them. Most of that data concerned customers and due diligence rather than training. The lesson still carries over: when a firm's data can't be produced or can't be trusted, the regulator notices.

The fields your LMS needs to capture

Strip away the dashboards and every audit-ready training record comes down to the same dataset. This is what should exist, per learner and per course, every time.

Miss any one of these and the record has a hole an auditor can find. Finding holes is their job. Not every regulation asks for all eight, so check which ones your own rules and your auditors expect.

Renewals, overdue learners and manager reporting

The part everyone forgets: renewals

Initial completion gets tracked. Renewal often doesn't, until it becomes a finding in an audit report.

Many compliance obligations repeat on a cycle. Data protection, anti-money laundering and health and safety training are commonly refreshed every year or every few years, depending on the rules and your own risk assessment. If your LMS treats a completed course as permanently done, you can end up with employees who look compliant for a certification that expired long ago.

A sound system tracks expiry the way it tracks completion: automatically, per employee, with a visible status the moment a certificate lapses. A spreadsheet someone updates when they remember doesn't do that, and neither does a calendar invite that gets declined.

Overdue learners need a trail, not just a list

A list of overdue employees is a start. What an auditor wants to see is the trail behind it: when someone became overdue, which reminders went out, who escalated it and to whom.

Two firms can have the same overdue numbers on audit day. The one that can show automated reminders, manager escalation and a documented resolution path looks like it has a working control. The one that can only show the list looks like it noticed the problem when the auditor pointed at it.

Manager and department reporting

Compliance risk doesn't spread evenly across an organization. It collects in particular teams, sites or managers whose training habitually lags, and a company-wide completion rate can hide those pockets.

Your reporting should break down by manager, department, location and role. A 96% company-wide completion rate means little if one warehouse sits at 40%.

What "exportable audit log" actually means

Almost every LMS claims to have reporting. Fewer produce something an external auditor or regulator can use. A usable export is:

• Complete. Every field in the table above, rather than a curated summary.
• Timestamped. Dates and times, not static snapshots.
• Attributable. Tied to named employees and named approvers, not anonymized totals.
• Portable. A format the auditor's own systems can read, such as CSV or PDF, not a screenshot of a dashboard.
• Traceable. If a record was corrected, a log shows the correction instead of a silently overwritten field.

If producing the export takes your compliance team three days and four people, your records are hard to rely on. Run the export as a test before the auditor does.

The cost of getting this wrong can be steep. Secureframe's 2025 compliance statistics roundup cites noncompliance-related data breaches costing $174,000 more on average, and $4.61 million overall, a figure that includes the scramble to reconstruct records nobody could produce on demand. HR.com's 2026 research adds that only 32% of organizations have proactive, structured monitoring at all.

Where 5Mins fits

5Mins is built to cut the admin around this work. Learners get microlessons of about 5 minutes, and course reminders go out in Slack, Microsoft Teams, email and push. Managers receive the Team Progress Email, which lists their team's overdue courses and the courses due in the next 30 days. The audit log can be exported as CSV, and 5Mins provides 100% compliance tracking. Customers can save up to 20 hours a month on training admin.

5Mins also offers 500+ accredited compliance courses, and compliance content is kept up to date as regulations change. 5Mins delivers 95%+ completion. None of this replaces your own judgment about which fields your regulator expects, but it takes much of the chasing out. Learn more about the compliance training solution or the 5Mins LMS.

This article gives general information on training records and related regulation as of November 2026. It isn't legal or compliance advice, and record-keeping requirements vary by industry and jurisdiction, so speak to a qualified adviser about your organization's circumstances.