Audit-Ready Training Records Sri Lanka | ISO & BOI Evidence Trail

What ISO and BOI auditors actually want from your training file: traceable evidence per person per competency, retained for the required period—and why attendance sheets alone keep failing.

By Manikya SearathnaAugust 29, 2026

Auditor reviewing traceable training completion evidence for a Sri Lankan manufacturing site

Training audit findings are rarely about companies not training people. They are about companies not being able to prove it to the standard the auditor applies. The gap is evidential, and it is almost always created years earlier by a decision to record attendance instead of competence.

For BOI-registered manufacturers and ISO-certified operations in Sri Lanka, this shows up as a recurring non-conformance that everyone knows is coming and nobody can close, because closing it retrospectively means recreating evidence that was never captured.

The four links every record needs

The competency the training was meant to establish, defined before delivery.
The assessment used, and the score or observed outcome against a stated standard.
Who assessed it, and their basis for being qualified to assess.
The validity period, so current status is derivable rather than asserted.

Any record carrying all four survives scrutiny. A record missing the second or third is where findings land, because the auditor cannot distinguish training that worked from training that was merely scheduled.

Retention is a policy, not a habit

Paper training files get thinned when cupboards fill. Shared drives get reorganised when someone leaves. Both are how retention obligations quietly break. The fix is that retention periods are attached to record types and enforced by the system holding them, so nothing is disposed of because of a filing decision.

This matters more than it sounds for safety-critical roles, where the retention obligation can outlast the employment. If a former operator's certification history is gone, an incident investigation years later has no basis to work from.

Producing the file on the day

The test of the whole arrangement is simple: an auditor names a person and a competency, and you produce the full chain in under a minute without phoning anyone. Systems that store assessments against competencies do this as a lookup. Arrangements built on attendance registers and folders do not, regardless of how diligent the team is. See also mandatory training matrix and refresher tracking.

Frequently asked questions

Why do attendance sheets fail an audit?

An attendance sheet proves someone was in a room. It does not prove they were assessed, that they met a standard, or that the trainer was competent to deliver. Most audit findings on training are not about missing courses—they are about missing evidence that the course achieved anything.

How long should training records be retained?

It depends on the standard and the role, and it is frequently longer than people assume—often the employment period plus a defined number of years for safety-critical competencies. The practical requirement is that retention is a policy applied automatically, not a decision someone makes when clearing out files.

What makes a training record traceable?

You can pick any completion record and follow it to the competency it was assessed against, the assessment instrument and score, the date, the assessor, and the validity period. If any link in that chain is missing or reconstructed from memory, the record will not hold up.

Does this apply to companies outside manufacturing?

Yes. Healthcare, financial services, food handling, and education all carry training evidence obligations in Sri Lanka. Manufacturing and BOI-registered operations tend to be audited most visibly, but the record-keeping principle is identical.