Track Employee Training Records (2026)

Are employers legally required to keep training records in the UK?

Mostly no, and that surprises people. The Health and Safety at Work etc Act 1974 requires you to provide whatever information, instruction, training and supervision is necessary to protect your employees (HSE, INDG345). The Management of Health and Safety at Work Regulations 1999 pin down when training matters most. That means when people start work, when risks change, and when skills have gone rusty. The duty is to train, not to file.

Records enter through guidance. HSE’s own advice says keeping records “can help you manage training”. It also says you should monitor them so refresher training happens on time (HSE, INDG345). Following HSE guidance isn’t compulsory. But the same leaflet notes that if you follow it, you’ll normally be doing enough to comply with the law, and inspectors may refer to it.

So the honest framing is this: the training is the legal duty, the record is your defence. When anyone official asks, the record is the only version of events that counts.

Which UK regulators expect training records?

The general rule above flips in regulated sectors. There, the expectation to evidence training is explicit:

• Care (CQC). Regulation 18 requires staff to receive the training needed to do their job. CQC’s statutory guidance expects completed training to be monitored, with quick action when requirements aren’t met. Regulation 19 goes further: providers must assess competence and keep “relevant records” (CQC, Regulation 18; Regulation 19).
• Financial services (FCA). Every authorised firm sits under the “competent employees rule”. The FCA expects records of recruitment, training, competence assessment and supervision, not just course completions. Under SM&CR, certification staff must be reassessed as fit and proper at least once a year (FCA, Certification Regime).
• Food businesses. Food handlers don’t legally need a hygiene certificate. They must be supervised, instructed and trained in line with their work, and you’ll be expected to show how (FSA guidance on GOV.UK).

If your SME is in one of these sectors, the “do we need records” question is already answered for you.

What should an employee training record actually contain?

A record that satisfies an inspector answers five questions. Who was trained, in what, when, by whom, and when it expires. In practice that means one entry per person per course: the employee’s name, the course or topic, the completion date, and the trainer or provider. Add evidence of assessment where there was one (a score, a certificate), and the refresher due date where the training has a shelf life.

Two additions earn their place. A qualification or course code keeps entries consistent when the same course runs many times. And a link to the actual certificate beats “we think it’s in the filing cabinet” in any audit.

The test is simple: could a stranger reconstruct your training history from the record alone? Sign-in sheets and calendar invites fail that test. A clean row per person per course passes it.

How long should you keep employee training records?

There’s no single UK answer, and anyone quoting one number for everything is simplifying. UK GDPR’s storage limitation principle sets no fixed periods: you decide, justify it, and write it into a retention schedule. Keeping records to meet a legal or regulatory requirement is explicitly fine (ICO, storage limitation).

The practical baselines most UK employers work to come from CIPD’s retention guidance: 6 years after employment ends for personnel files and training records generally (CIPD, Retention of HR records, 2022). Statutory periods cover the specifics. First aid training: 6 years after employment. Fire warden training: 6 years. Health and safety representatives’ training: 5 years.

Regulated firms have harder numbers. FCA competence records must be kept at least 5 years after the person stops the activity for MiFID business, and 3 years for non-MiFID (FCA). Pension transfer specialists keep theirs indefinitely.

The operational point: retention only works if the record survives staff turnover and spreadsheet versions. “We deleted it when Karen left” is not a retention schedule.

Where the training spreadsheet stops coping

Not because spreadsheets are bad, but because this specific job quietly outgrows them. Field audits of real-world spreadsheets found errors in 86% to 91% of those examined (Panko, University of Hawaii, EuSpRIG 2000). A training matrix has all the classic ingredients: dates, formulas, many editors, and nobody checking.

The failure modes are predictable, and practitioners describe them in the same words year after year. A shared file everyone can edit, one accidental deletion from disaster. An expiry formula someone built that nobody else understands. Renewal amnesia, as one HR practitioner on Reddit put it: managers remember a certificate “within a month or so after its expiry, but not in time to renew it”. Multi-site sprawl, in one safety manager’s words: “limping along with a patchwork of spreadsheets, SharePoint folders and a clunky legacy tool”. And the quiet single point of failure: the whole system lives in one person’s head.

I ran training compliance across 850+ staff in 20 countries before founding Techspire IT. The spreadsheet’s worst trick is this: it looks fine right up until the day you query it in anger.

How do you track employee training records in a spreadsheet properly?

Honestly: a single-site team of 10 to 20 with a handful of annual courses is well served by a disciplined spreadsheet. Moving to software that early buys you admin, not safety. To track employee training records well at that size, give the sheet four things.

One row per person per course, never a grid of merged cells. Columns for the six fields above, with dates entered as real dates, not text. One named owner, with edit access for them and view access for everyone else. And a monthly fifteen-minute review where the owner checks upcoming expiries rather than trusting the colour coding.

Do that and you’re ahead of most. The point of this section isn’t that spreadsheets are wrong. It’s that the discipline, the owner, the review, the one-row-per-record shape, is the actual system. The spreadsheet is just where it lives, for now.

When should a UK SME move off the spreadsheet?

Watch for five triggers. Any two of them together mean the spreadsheet is now costing more than it saves:

• Expiring certificates. Once training has renewal dates, think first aid, food hygiene, fire warden, you need reminders that fire themselves. Formulas someone must remember to check don’t count. HSE strongly recommends annual refresher training for first aiders, for example, without mandating it (HSE, first aid FAQs).
• A regulator or big client in the picture. CQC registration, FCA authorisation, or a customer audit clause turns “roughly right” into “provably right”.
• More than one site or shift pattern. The single shared file breaks first here.
• Headcount past roughly 30 to 50. The volume of rows and joiners and leavers outruns a monthly review.
• The owner risk is real. If one person’s departure would take the system’s knowledge with them, it already has a failure date.