The question at an audit
An auditor rarely asks whether training took place. That is in the training plan and it is usually accurate.
The question is more specific: show me that this employee, on this date, was instructed on this version of the procedure, and that you established they have mastered it.
At that point, in many organisations, a folder appears, or a spreadsheet somebody maintains alongside their actual job. And then it turns out the record exists but is not complete, or that nobody can work out which version of the procedure applied at the time.
Why an attendance list is not evidence
A signature on a participant list demonstrates that somebody was present. Nothing more.
Standards such as ISO 45001 ask for something else: determine what competence is needed, provide for it, and evaluate the effectiveness. That last step is where it goes wrong. Attendance is not effectiveness, and neither is an assessment everybody passes.
The version problem comes on top. Amend a procedure and last year’s instruction is formally superseded, even when the subject stayed the same. Anyone who does not record which version somebody worked through cannot demonstrate, after a change, who is still up to date.
What you do record
Four pieces of data separate a list from a file.
Person and date. At individual level, not per group or per department.
Which version. Of the module and of the underlying procedure. This is the field most often missing and most often asked for.
What was established. Not only passed, but on which components. After an incident you want to be able to check whether that particular component was assessed.
Validity. Until when, and what happens when that date passes. A designation that expired without anybody noticing is in practice the most common shortfall.
That last point is immediately the strongest argument for digital records: a system flags an approaching expiry date, a folder does not.
The contractor question
The blind spot is almost always with hired-in staff.
Your own people are in the system, have a personnel number and run along in the records. Contractors do not, while they often do the high-risk work and while you as client remain responsible for what happens on your site.
The practical answer is to decouple the record from the personnel system: run the induction on an email address rather than a personnel number, and make sure the evidence can be shared with the contractor’s own employer. Then it also works for somebody who is there for three weeks.
Anybody who arranges that discovers something useful beyond compliance as well: which share of the people on your site you had no picture of until then.
Record-keeping is one part of a larger whole. Where it meets the rest of your training structure is in the guide on setting up or renewing a corporate academy. What a learning platform has to be able to do for it is under learning management.