Compliance
Training Audit: How to Evidence It Worked
A training audit that only collects completion certificates can prove attendance. It cannot prove competence. Regulators, tribunals, and boards increasingly know the difference. This page is a practical way to evidence that training actually worked — at each Kirkpatrick level — without building a surveillance culture.
I founded Real Talk Studio. The audit problem existed long before we did. What changed is that it is cheaper now to collect Level 3 evidence than it was when the only option was a human with a clipboard.
The audit problem
Someone will ask, after an incident: what did you do to make this person ready?
The folder you have is usually: policy acknowledged, module completed, quiz 80%, date stamp. That is Level 1–2 dressed as a defence. In UK harassment law it is already a weak story — Allay (UK) Ltd v Gehlen [2021] EAT treated brief or stale training as insufficient for a “reasonable steps” defence. From October 2026 the statutory wording moves toward all reasonable steps. I have written the legal-shaped versions in Worker Protection Act: reasonable steps and the earlier all reasonable steps essay. What to put in the board file is all reasonable steps; the appendix is the evidence checklist.
The same gap shows up in FCA Consumer Duty files, in sales enablement reviews, and in any board pack that says “94% trained.” Brandon Hall Group’s learning-measurement studies have, for years, found that few organisations track business impact well. We cited their “fewer than one in six” figure in competence, confidence, compliance. The Kirkpatrick model has been public since 1959. The reason people stop at Level 2 is not ignorance. It is that behaviour used to be expensive to see.
Training audit: how to evidence it without lying to yourself
A training audit is a filing system for claims. “We trained them” is a claim. Completions support a weaker claim: they were in the room, or they opened the module. The rest of this page is how to evidence the stronger one.
Kirkpatrick as an evidence map (not a religion)
Kirkpatrick Level 3 examples (the ones that survive a sceptical lawyer)
Kirkpatrick Level 3 examples that actually count:
- A scored simulation of the disclosure / the angry customer / the PIP, with a date, a transcript, and a fail or pass on the behaviours you named.
- A QA score on a real call of that type, not an average across the queue.
- A manager observation against a behavioural rubric, signed, with the moment named.
- A second attempt after a miss, so you can show improvement rather than a one-off performance.
Kirkpatrick Level 3 examples that do not count, however comforting:
- “We discussed it in the workshop.”
- A quiz that restates the policy.
- A survey that asks “I feel confident I would…”
- Attendance at a webinar.
Training effectiveness measurement is mostly the discipline of not letting Level 2 impersonate Level 3.
Level 3 practice evidence — dated, scored, with the words that were actually said.
What a sample looks like when you zoom out from one attempt.
How to collect Level 3 without a surveillance culture
You do not need to record every 1-1. You need a small number of high-stakes moments, practised and sampled.
- Name the conversations that create legal or commercial harm. Five is plenty. If you cannot name them, you are not ready to audit training. Use the workplace library.
- Practise those, on the record, in a safe room. Simulation is kinder than using a real complainant or a real customer as the exam.
- Sample live work of the same type. QA, deal review, a manager sit-in. Say so in the privacy notice. Do not pretend a mystery shopper is informal.
- Show the person the evidence you hold on them. Secret scoring is how you get a culture problem. Shared transcripts are how you get a coaching conversation.
- Refresh on a clock that matches decay and law. Annual e-learning is a calendar habit. Gehlen is about staleness. After a role change, after an incident, after a long gap — run the scenario again.
This is how you evidence training compliance without filming the office. The audit file is: risk assessment → the scenario → the attempts → the live sample → the refresh. Not a spreadsheet of completions.
Worked example: harassment-prevention, tribunal vs tick-box
Tick-box file (common). Policy emailed. 20-minute module. Quiz. 97% complete. Last completed 11 months before the incident. Manager “Sarah” scored 88%. No record that Sarah has ever spoken the words of a disclosure. When Priya tells her about a customer, Sarah says she will “look into it.” Priya leaves feeling dismissed. Later, a claim.
What the tick-box file proves. Sarah attended. It does not prove she could hold the moment. Under a reasonable-steps analysis, it may prove you provided training. It does not prove you evaluated whether it worked — which the EHRC’s technical guidance asks employers to take seriously.
A defensible file (still not legal advice).
- Risk assessment that named customer-on-staff harassment as a live risk for that site (hospitality, retail, field).
- Training that included the manager-moment: a disclosure, a “keep this between us,” a banter intervention — not only definitions. See leadership scenarios and colleague discloses harassment.
- Dated simulation attempts for Sarah and her cohort, with the behaviours scored (listen without minimising; no secrecy promise; correct signpost).
- A refresh after she moved from individual contributor to manager — not the same module she clicked as a new starter.
- A note of what you changed when attempts showed a pattern (for example: everyone promises secrecy). That last item is how you show the system learns.
The tribunal-shaped question is not “did you buy e-learning?” It is “what else could you reasonably have done, and did you check it worked?” Practice is one of the reasonable steps that is now cheap enough that “we didn’t” is a choice.
What to keep in the audit pack
- The risk assessment and the list of moments.
- The syllabus: what was trained, for whom, when.
- Level 2 for the facts that must be known (definition of harassment, how to report).
- Level 3 for the moments that must be done (sample of scored practice and/or QA).
- Exceptions: who has not yet passed, and what you have done about their queue / their line management.
- The refresh rule.
- A one-page narrative a lawyer can read at 11pm.
If you want the measurement philosophy behind our own product — competence, confidence, compliance as three measures — that is this article. If you want the method, scenario-based training. If you want the conversations, the hub.
A 90-day audit you can actually run
You do not need a consultancy deck. You need a month of naming, a month of sampling, and a month of filing.
Days 1–30. Pick five conversations from the last two quarters that created harm or near-harm. Write the tension in one sentence each. Map what evidence you already have at Levels 1–4. The gaps will be obvious. Most organisations discover they have a beautiful Level 2 and a blank Level 3. If you cannot name five, start with the workplace library and pick the ones that made you uncomfortable. That discomfort is usually the risk assessment you have not written down.
Days 31–60. Put a sample of the in-scope population through those five as practice (workshop or simulation) and, where you can, pull a live sample of the same type (QA, deal review). Share the evidence with the people it is about. Note the pattern, not the hero / villain.
Days 61–90. Write the one-page narrative. Change one thing in the programme — a refresh rule, a queue restriction, a manager huddle. File the change. That last step is how you show the system learns, which is what “evaluate your actions” means in the EHRC 8-step guide.
If you skip the change, you have a report. If you skip the sample, you have a story. If you skip the naming, you have a mood.
What not to do
Do not film every 1-1 “for quality.” That is how you get a surveillance culture and a union problem.
Do not buy a platform and call the login an audit.
Do not use a colleague as the devastated employee for entertainment.
Do not present Level 2 as Level 3 to a board that will not know the difference until a tribunal does.
This is not a substitute for your counsel, your DPO, or your HR process. It is the training-evidence part of the file.
See how practice becomes evidence
Try a scored practice conversation
FAQ
Frequently asked questions
01What is a training audit?
A structured look at whether training did what you claimed — not only whether people attended. It maps evidence at each evaluation level and flags where you only have completions.
02How do you measure training effectiveness?
Use Kirkpatrick as a filing system: reaction and learning are easy; behaviour and results are the ones that matter after an incident. Collect Level 3 on a few high-stakes moments rather than surveying everyone about everything.
03What are Kirkpatrick Level 3 examples?
A dated, scored attempt at the real conversation type; a QA score on that call type; a signed observation of the behaviour at work. Not a quiz and not a smile sheet.
04How do you evidence training compliance?
Keep the syllabus, the dates, who was in scope, Level 2 for knowledge, Level 3 for the critical behaviours, and a refresh rule. Completions alone are a weak compliance story.
05Can AI roleplay count as audit evidence?
It can count as Level 3 practice evidence if you keep the date, the identity, the scenario, and the score. It is not a substitute for live sampling, and it is not legal advice that it will satisfy every regulator.