Compliance Registers: Proving What Happened and When

The auditor asks a simple question: “Can you show me that everyone on the night shift completed forklift refresher training before March?” You open the training tab, find a column of dates, and notice that three of them were typed last Tuesday. The certificates are somewhere in an inbox. The person who ran the session left in the spring.

The training probably happened. You just can’t prove it. And in compliance, those are two very different things.

The register’s real job is proof, not tracking

Most compliance spreadsheets are built to answer “are we up to date?” That’s a useful question, but it isn’t the one that matters when someone outside the team is checking. The question that matters is “how do you know?”

A good register answers both. It shows the current state (who is certified, which inspections are due) and it holds the evidence behind each claim, along with a trustworthy record of when each entry was made and by whom.

A spreadsheet struggles with the second part. Anyone with edit access can change a date, overwrite a cell or delete a row, and the file keeps no meaningful record of it. Try reconstructing “who changed row 214” from a list of autosaves.

Four record types, not one giant tab

Compliance registers usually cover a handful of distinct things, and each deserves its own record type:

The important shift is that a training completion is its own record, linked to a person and a course. It is not a date sitting in a cell where a person’s row meets a course’s column. That grid layout is tempting because it looks like a nice matrix, but it can only hold one date per cell, so the moment someone retakes a course, the old completion gets overwritten. Your history disappears exactly when you might need it.

If you’ve read From Rows to Records: How to Think About Your Data Like an Application, this is the same idea applied to a setting where losing history has consequences.

Evidence goes on the record, not near it

Every claim in the register should carry its proof: the signed attendance sheet, the certificate, the inspection photos, the completed checklist. Attach the file directly to the record it supports.

“Near it” is where things go wrong. A shared folder called “Certificates 2024” with filenames like scan_0043.pdf is not evidence anyone can use under pressure. When the file is attached to the training record for that specific person and course, the answer to “show me” is one click.

A few practical rules help:

• Make evidence required to close a record. An inspection can’t move to “Complete” without at least one attachment or a completed checklist.
• Capture evidence at the source. The inspector fills in the form on a phone while standing next to the fire extinguisher, photo included, instead of scribbling notes to type up later.
• Name files consistently, or let the tool do it. Even attached, “Certificate - J. Okafor - Manual Handling - 2025-02” beats “IMG_2231”.

An audit trail is history you didn’t have to write

An audit trail is an automatic log of changes: what was created, what was edited, the old value, the new value, who did it and when. Most proper internal tools keep one for you. You can’t edit it, which is the whole point.

This matters for two reasons. First, it shows that a record was entered close to the event rather than backfilled the week before an audit. Second, it shows when something was corrected, and that correction is fine. Mistakes get fixed all the time. What raises eyebrows is a correction nobody can explain.

Some habits make the trail more useful:

• Distinguish “date of event” from “date recorded.” The tool records the second automatically. People enter the first. A gap of a day is normal; a gap of four months deserves a note.
• Don’t delete, void. If an incident was logged twice, mark the duplicate as void with a reason. Deleting it leaves a hole that looks worse than the mistake.
• Lock records after sign-off. Once an inspection is approved, restrict editing to a small group, and require a reason for any change.

Post 43, Archiving, History and Never Losing a Record Again, goes deeper on the mechanics of keeping history.

Expiry dates should do work

Certifications and training expire. In a spreadsheet, someone builds conditional formatting that turns cells red, and then everyone learns to ignore red.

In a proper tool, expiry drives action. Say your forklift certification lasts two years. The record stores the expiry date as a calculated field (completion date plus 24 months), and the tool generates a reminder 60 days out to the person and their manager. At 30 days, it appears on a “due soon” view the safety lead checks each Monday. After expiry, the person shows as not certified on the shift roster view.

Nobody has to remember. The register reminds them, and it records that it did.

What “acceptable to an auditor” actually means

Requirements differ a lot by industry, location and the type of record, so don’t treat this article as a list of rules. Talk to whoever owns compliance in your organisation (your compliance lead, quality manager, health and safety officer or legal team) about what your specific obligations are, including how long records must be kept and who must sign off what.

In general terms, though, auditors tend to look for the same qualities:

• Completeness: every required event has a record.
• Traceability: each record links to the people, assets and evidence involved.
• Timeliness: records were made near the time of the event.
• Integrity: changes are visible and explained, not silent.
• Retrievability: you can find what’s asked for quickly, without a scavenger hunt.

Run your current spreadsheet against that list honestly. Most fail on integrity and retrievability first.

Where to start this week

1. Pick one record type. Training is usually the best first candidate because it’s high volume and the evidence is easy to collect.
2. Ask your compliance owner one question: “What would you want to see if we were audited on this tomorrow?” Design the fields around their answer.
3. Do a mock retrieval. Choose five random people and try to produce proof of their last required training in under ten minutes. Time it. That number is your baseline.
4. Stop the overwriting. Even before you migrate, add a rule that retakes get a new row, not an edited date.