What Records to Keep for Employee Compliance Training
Training your employees is only half the job. If you can't prove that they completed it when an auditor or investigator asks, from a legal perspective, the training never happened.
Here is exactly what data points you need to capture and retain when an employee completes a compliance requirement.
Note: This guide covers the operational aspects of record-keeping. To determine exact retention periods required by specific local or federal regulations, consult with your legal counsel.
The anatomy of a defensible training record
A robust compliance training record must answer who, what, and when securely. At a minimum, your system of record should capture:
- Employee Name & Identifier: Full name and an identifier (usually an email address or employee ID).
- Requirement / Course Name: The exact title of the training provided.
- Date and Time of Completion: A system-generated timestamp, usually stored in UTC and displayed in local time.
- Format / Version: Was this the 2024 Harassment Policy PDF, or the V2 SCORM module? If you update your training mid-year, the record must reflect which version the employee saw.
- Passing Score (if applicable): If the SCORM course included a graded quiz, the raw score achieved.
- Certificate or Digital Signature: An undeniable artifact. For an active SCORM course, a generated certificate. For a passive policy, a cryptographic or system-logged digital signature.
Why manual spreadsheets are risky
Many companies start by tracking training in Excel: typing "Done" next to an employee's name when they reply to an email.
The problem with this approach is that spreadsheets are infinitely editable. An auditor looking at a spreadsheet cannot verify if "Done" was entered on the actual completion date, or typed frantically the night before the audit. It lacks an undeniable system-generated timestamp.
How long should you keep records?
Retention periods vary wildly depending on the regulation (OSHA, HIPAA, FINRA) and your state (e.g., California's AB 1825 harassment training requirements).
However, a common best practice among HR professionals is to retain compliance training records for the duration of the employee's employment, plus 3 to 7 years after they leave. This ensures the records are available should a dispute arise after termination.
For exactly this reason, a dedicated compliance platform should never delete training records simply because you archive or deactivate a former employee's profile.
What about the actual content?
It's not enough to know an employee took "Harassment Prevention 2024". You also need to retain a copy of the actual course or policy document they consumed. If challenged, you must be able to produce the specific material that was presented to the employee on that date.
A better way to manage records
Ethica automatically captures system-timestamped records for every policy sign-off and SCORM completion. The system generates un-editable certificates and maintains a permanent audit log, even for deactivated employees. Ditch the spreadsheet and start your free trial.