Compliance training is easy to run and hard to prove. Most organisations can produce a training calendar and a stack of attendance sheets. Far fewer can show, for one named worker on one named date, which programme was assigned, when it was finished, what score was recorded and when the refresher falls due.
That gap is where audits go badly. An inspector or a customer’s auditor does not want a summary slide. They want a record per person, per topic, with dates that hold together and a way to check that the record is genuine.
This post sets out a way to run the programme so the evidence is a by-product of the work rather than a scramble in the week before the visit.
Start from the rule, not from the course
Before you buy or build anything, write down which obligation each programme answers. Indian law generally states the duty in broad terms and leaves the syllabus and frequency to you, your policy or a state rule, so the wording matters.
Two examples. The Factories Act, 1948 places on the occupier a general duty that includes:
the provisions of such information, instruction, training and supervision as are necessary to ensure the health and safety of all workers at work
The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 requires an employer to organise workshops and awareness programmes at regular intervals for sensitising the employees with the provisions of the Act and orientation programmes for the members of the Internal Committee in the manner as may be prescribed. Under the same Act the Internal Committee prepares an annual report each calendar year and submits it to the employer and the District Officer, and the employer includes the number of cases filed and their disposal in its own annual report.
Neither prescribes a number of hours or a fixed refresher interval in the Act itself. Sector rules, state rules, licence conditions and customer contracts often do. Check the current notification that applies to you rather than copying an interval from a template, and record the source next to the policy.
Assign compliance training by role, not by a list of names
Name lists rot. A person moves from stores to the crusher floor, nobody updates the spreadsheet, and the record says trained while the reality says otherwise. Assign to a role or a cohort instead, so the assignment follows the person.
Build a small matrix first. Keep it on one page so a supervisor can read it.
| Group | Programmes assigned | Assigned when | Refresher set by |
|---|---|---|---|
| All employees | Code of conduct, prevention of sexual harassment awareness, basic safety induction | Day one of joining | Company policy |
| Plant and site workers | Job-specific safety, permit to work, personal protective equipment, emergency response | Before first shift on the job | Applicable rule, else policy |
| Supervisors and managers | All of the above, plus incident reporting and complaint handling | On promotion or transfer | Company policy |
| Internal Committee members | Orientation on the statute and inquiry procedure | On appointment to the committee | Prescribed rules |
| Contractor staff | Site induction and job-specific safety | Before gate pass is issued | Contract and site rule |
The intervals in the last column are deliberately not filled in. Put your own figure there only after you have read the rule that applies to you, and note the rule number beside it.
Due dates and reminders that actually land
An assignment without a date is a suggestion. This sequence is dull and it works.
- Set a due date at the moment of assignment, counted from joining, transfer or the last completion, not from the start of the financial year.
- Send the first reminder at assignment, with the reason for the programme in one line.
- Remind again at seven days before due, on the due date, and then weekly until it is closed.
- Copy the supervisor after the due date passes, not before. Escalation at day one annoys everyone and stops working.
- Give a short grace window for people on leave or night shift, and record the extension rather than quietly moving the date.
- Report overdue counts by department every week, to the department head.
What counts as evidence of completion
A tick against a name is weak evidence, because an auditor will ask what the tick means. Aim for a record that answers that without a conversation.
- Identity: employee code, name and department as they appear in your payroll or gate system, not a free text field.
- What was taken: the exact programme and version, because content changes and last year’s version is not this year’s.
- Time on the material: start and finish timestamps per module, so a two-hour programme closed in four minutes shows up.
- An assessment result: the score, the pass mark in force on that date, and the number of attempts.
- An acknowledgement: a recorded confirmation that the person has read and understood, held with the same timestamp.
- A certificate that can be checked: a unique number an auditor can verify without asking you for a screenshot.
- The trail: who assigned it, who extended the date, who marked an exception and when.
Randomised question order and a timer on the assessment are worth turning on for compliance topics. They make a shared answer key much less useful and they cost nothing to enable.
Refresher cycles and expiry
Treat every compliance certificate as perishable. Give it an expiry date at the moment it is issued, and let the system re-assign the programme before the date rather than after.
A workable pattern: re-assign 60 days before expiry, remind at 30 days and 7 days, mark the person lapsed the day after, and show lapsed people on the dashboard the supervisor already reads. If a job carries a licence or a gate pass, tie the lapse to that.
The records an auditor asks for
| Question you will be asked | Record that answers it |
|---|---|
| Who was required to take this programme? | The role matrix, with the date each rule was mapped to each group |
| Show me this worker’s history | A per-person transcript: programme, version, dates, score, attempts, certificate number |
| How do I know he really completed it? | Module timestamps, assessment result, acknowledgement, verifiable certificate |
| What about people who did not complete? | The overdue register with escalation dates and the exception notes |
| Is this the current content? | Version history of the programme with effective dates and the approver |
| When is he due again? | Expiry date and the next assignment already raised against it |
| Who can change these records? | Role and permission list, plus the audit trail of edits |
Learner records are personal data
Training records carry names, employee codes and results, so India’s data protection framework applies to them. The Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025 with an eighteen-month period for phased compliance, and the framework places clear obligations on the organisation holding the data, including reasonable security safeguards and acting on erasure requests. The highest penalty under the Act, ₹250 crore, attaches to failure to maintain reasonable security safeguards.
So decide now how long you keep a training record after a person leaves, write that retention period into policy, and keep the number of people who can edit these records small, with edits logged. Where the records must stay inside your own network, the trade-offs are set out in our note on choosing between a self-hosted and a cloud LMS.
Frequently asked questions
How long should we keep completed training records?
Long enough to cover the audits and claims you can reasonably expect. Fix a period in writing, apply it consistently, and be able to explain it. Where a sector rule or a contract sets a period, that governs.
Is a classroom session still acceptable?
Yes, and many topics are better taught in person. The record is the issue, not the delivery. Log the session in the same system, mark attendance against employee codes, attach the material version and the assessment, and it produces the same evidence as an online course.
What about contractor and temporary staff?
Give them a cohort of their own, tie the induction to the gate pass, and report their completion separately. Contractor training is one of the first things a site auditor checks.
Do we need a separate system, or will a spreadsheet do?
A spreadsheet can hold the matrix. It cannot timestamp a module, grade an assessment, issue a certificate a third party can verify, or show who edited a row. Those four turn a claim into evidence.
Running this in one place
Compliance training becomes manageable when assignment, delivery, assessment, certificates and reporting sit in the same system, on your own servers if your policy says so. Quipu LMS covers roles and cohorts, randomised and timed assessments with auto grading, certificates with verification and expiry tracking, and progress analytics, with SCORM import for material you already own.
