Mandatory Training Matrix: How to Build and Maintain One

Three weeks before a subcontractor pre-qualification renewal, the operations manager at a fabrication and welding contractor we’ll call Halden Fabrication pulled the training spreadsheet and found four expired certificates, two people who’d moved from the shop floor into supervision without picking up the extra course that role required, and one colour-coded column nobody left in the business could explain. The procurement questionnaire didn’t ask for a spreadsheet. It asked for evidence.

A mandatory training matrix is a single record that maps every person to the training their role legally or organisationally requires, tracks when each item stops being current, and links to the evidence that proves it actually happened. Built properly, it separates training set by law from training set by your own policy, flags what’s overdue before a client or inspector does, and survives the person who built it moving on. Built as a spreadsheet colour-coded by best guess, it becomes the thing an audit — or a lost contract — finds fault with.

This isn’t another template pitch. It’s the four tiers of training that most guidance blurs into one list, the renewal intervals that are genuinely fixed by law versus the ones an organisation invented and now treats as gospel, and the six steps that turn a list of course names into a record a regulator, a client’s procurement team, or your own board can actually rely on.

What a Mandatory Training Matrix Actually Has to Prove

A training matrix is not a list of courses people have sat through. It’s a claim: that a named person, in a named role, is currently authorised to do the job because they hold in-date evidence of the training that role requires. Every cell in the matrix has to be able to answer four questions on demand:

• What training does this specific role require, and on what basis — statute, organisational policy, or the hazards of the job itself?
• Who currently holds it, and since when?
• When does it stop counting as current?
• Where is the certificate, assessment record or sign-off that proves it happened?

Miss the fourth question and what you have is a completion list, not a compliance record — a distinction covered in more depth in our guide to skills compliance. CQC’s own guidance on Regulation 18 is explicit that “all learning and development and required training completed should be monitored and appropriate action taken quickly when training requirements are not being met” — monitored, with action taken, not simply logged.

It also isn’t the same document as a skills matrix, which scores proficiency against a technical ability rather than tracking whether a mandatory course is still in date. Plenty of organisations need both, built with the same underlying discipline but answering different questions.

Statutory, Mandatory, Role-Specific, Leadership: The Four Tiers Vendors Blur Together

Most training-matrix guidance treats “mandatory training” as one category. In practice it’s at least four, and the difference matters because only some of it is actually a legal duty.

Statutory training is named by a specific piece of legislation. The Management of Health and Safety at Work Regulations 1999 require employers to provide health and safety training on recruitment, on transfer or a change of responsibilities, and whenever new equipment, technology or systems of work are introduced — training that must “be repeated periodically where appropriate” and take place “during working hours.” Since 6 September 2025, care providers face a genuinely new statutory duty here: the Oliver McGowan Code of Practice on learning disability and autism training is a rare example of a mandatory requirement that simply didn’t exist a year ago.

Mandatory training, in the stricter sense, is training your organisation requires even though no single statute names the course itself — an induction module, a code-of-conduct refresher, a company-specific safety briefing. It’s real and it belongs on the matrix, but conflating it with statutory training is how organisations end up believing a fixed legal interval exists where it doesn’t.

Role-specific training is tied to the actual hazards and duties of one job: working at height, a specific machine, a CSCS card for a particular trade. The Construction (Design and Management) Regulations 2015 frame competence as “skills, knowledge and experience, and, if they are an organisation, the organisational capability” — not a named course. A completed course is evidence towards competence; it isn’t competence itself.

Leadership and CPD training is the tier most matrices drop entirely, usually because it isn’t compliance-driven. It belongs on the same record anyway — a manager’s CPD obligations expire and need tracking exactly like a safety certificate does, just against a professional body’s rules rather than a regulator’s.

RAG Status, Defined by the Day Count

Search for “training matrix” and you’ll find plenty of screenshots with green, amber and red cells, and almost nothing that defines where the boundaries actually sit. That’s worth closing, because a RAG status only means something if the thresholds are written down and applied consistently rather than eyeballed.

A workable definition, adaptable to your own risk profile:

• Green — current. More than 60 days of validity remain on the certificate or course record.
• Amber — due soon. Inside the renewal window, typically 30–60 days before expiry — enough time to book a course before it lapses.
• Red — overdue. Past the expiry date. The person is no longer evidenced as competent for the task, whatever their historical record says.

Higher-risk tickets justify a wider amber window. HSE’s own guidance on refresher training suggests employers “consider a gap between training and refresher training of between three to five years, depending on the risks” — the same risk-based logic applies to how early you flag amber, not just how long a certificate lasts. The point of RAG isn’t the colour. It’s that a manager can see, without opening a single certificate, exactly who needs action this month and who doesn’t.

The Refresher-Interval Myth: What’s Fixed by Law, and What Isn’t

A specific claim circulates in training-matrix guidance: that CQC requires refresher training every three years. It doesn’t. CQC’s guidance on Regulation 18 uses only flexible language — staff should receive “appropriate ongoing or periodic supervision” — and leaves the interval to the provider, checking instead that whatever cycle you set is actually followed and acted on. The Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 themselves require staff to receive “such appropriate support, training, professional development, supervision and appraisal as is necessary” — necessary being a judgement your own risk assessment makes, not a number CQC hands you.

Some intervals genuinely are fixed, because a scheme sets them rather than a statute:

Training	Validity	Fixed by	What actually applies
First Aid at Work	3 years	HSE-recognised training providers	Annual refresher is “strongly recommended,” not a legal requirement.
CITB SMSTS / SSSTS	5 years	CITB Site Safety Plus	The refresher must be completed before expiry, or the full course is retaken.
CSCS Labourer card	2 years, then 5	CSCS	Reduced from a flat 5 years for cards issued from 1 February 2025.
General H&S refresher	Not fixed	Employer risk assessment	HSE suggests 3–5 years “depending on the risks,” not a set number.
CQC-regulated mandatory training	Not fixed	Provider policy	Monitored by CQC against Regulation 18; no numeric interval in the regulation itself.

Treat the fixed column as a floor, not a target, and be honest in your own documentation about which of your intervals are a legal minimum and which are a policy choice. An auditor who catches that difference being misrepresented will look harder at everything else on the matrix.

Building the Matrix: Six Steps, Worked Through Halden Fabrication

Back to the fabrication shop from the introduction. Here’s the process the operations manager ran to replace the spreadsheet, using three roles as the worked example.

1. List statutory duties per role. Every role got manual handling and fire safety, both statutory under the 1999 regulations above. Machine operators added the role-specific ticket for the equipment they used.
2. Add mandatory and role-specific tiers. Team leaders and the site manager added First Aid at Work; anyone working at height added that ticket specifically, not by default.
3. Set validity periods per course. First Aid at Work: 3 years, fixed by the scheme. Working at height and the machine ticket: set by the company’s own risk assessment, reviewed annually.
4. Define RAG thresholds and apply them uniformly. Amber at 45 days for anything safety-critical, 60 days for everything else — one rule, not a different guess per manager.
5. Name one owner, with a documented handover. The old spreadsheet had no named owner; when the person who built it left, nobody updated it for four months. The matrix now has one accountable name and a written handover note.
6. Attach the evidence, not just the tick. Every cell links to the actual certificate or sign-off, not a checkbox someone filled in from memory.

Simplified, three of Halden’s roles looked like this:

Role	Manual handling	Fire safety	First Aid at Work	Working at height	Leadership CPD
Machine operator	Current	Current	Due soon	—	—
Team leader	Current	Current	Current	Due soon	Due soon
Site manager	Current	Current	Current	Current	Current

Where These Matrices Quietly Fail

The build is the easy part. Most training matrices fail months later.

Role changes with no retraining trigger. Someone moves from operator to team leader and the matrix isn’t told. Nothing in most spreadsheets forces a re-check against the new role’s requirements — the record simply goes stale silently.

Long-term leave and apprentices. A certificate expiring during extended leave, or an apprentice partway through a multi-year qualification, doesn’t fit a simple pass/fail matrix, and almost no published guidance addresses either case.

Multiple sites, no single source of truth. Each site keeps its own spreadsheet, a subcontractor’s crew isn’t on any of them, and nobody can answer “who on this project is trained for X” in under a day.

The single named owner leaves. Naming one owner fixes the accountability gap on day one and creates a new one the day they resign, unless the handover is actually documented rather than assumed.

Checkbox instead of competence. A green cell says a course was completed. It doesn’t say the person can do the job — the distinction HSE draws when it defines competence as training, skills, experience and knowledge applied, not training alone. Some organisations close this gap by linking the matrix to a proper validation and revalidation cycle rather than treating “attended” as the finish line.

A 30-Day Plan to Get From Spreadsheet to Audit-Ready

If the matrix you have today is a spreadsheet nobody fully trusts, here’s a realistic first month rather than a rebuild.

Week 1 — export every current record into one sheet, one row per person, including subcontractors and agency staff. Don’t fix anything yet; just get it all visible in one place.

Week 2 — tag every requirement against one of the four tiers, and mark whether its interval is fixed by a scheme or set by policy. This single exercise usually surfaces the myths first.

Week 3 — apply one RAG rule across the whole sheet and attach evidence to the ten highest-risk roles first, not alphabetically.

Week 4 — name the owner, write the one-page handover note, and calendar a quarterly review. A matrix with no scheduled review reverts to a spreadsheet nobody trusts within two quarters.

How StaffCircle Keeps It Current Without the Spreadsheet

The mechanics above work in a spreadsheet, up to the point where the number of people, sites or subcontractors makes manual review unreliable. StaffCircle’s own training compliance pages describe validation and revalidation tracking with expiry alerts and high-risk role flagging built in — a claim from our own marketing copy, worth verifying against your rollout.

Evidence attached to every record

Rather than a tick in a cell, a training record can carry the certificate or assessment behind it, aimed at the same point-in-time, auditable record that trips up spreadsheet-based matrices during an inspection.

Automatic RAG-style alerts

Expiry tracking that flags a renewal before it lapses removes the single biggest failure mode covered above — the matrix that only gets checked when someone remembers to open it.

Frontline and deskless access

For sectors where a meaningful share of the workforce has no company email or desk — care, manufacturing, construction — mobile access matters as much as the record itself. The same access gap is covered in more depth in our piece on succession planning for frontline teams.

Final Thoughts

A mandatory training matrix earns its name when it can survive being questioned — by an inspector, a client’s procurement team, or a new operations manager three weeks before a renewal. That means separating what’s actually required by law from what your organisation decided to require, defining RAG status by a day count rather than a feeling, and attaching real evidence to every green cell rather than trusting the tick. None of that needs new software. It needs the discipline above, applied consistently, with one named person accountable for keeping it that way. Book a demo to see how StaffCircle turns that discipline into a system.

FAQ

What is a mandatory training matrix?

A mandatory training matrix is a record that maps every employee to the statutory, mandatory, role-specific and leadership training their role requires, tracks when each item expires, and links to the evidence — the certificate or sign-off — that proves it happened.

What’s the difference between a training matrix and a skills matrix?

A training matrix tracks whether a required course is completed and still in date. A skills matrix scores proficiency in a technical ability on a scale. Many roles need both, since one answers “are they compliant” and the other answers “how good are they.”

Is a mandatory training matrix a legal requirement in the UK?

No single law names “a training matrix” as a document you must hold. What is a legal requirement — under the Management of Health and Safety at Work Regulations 1999 and sector rules like CQC’s Regulation 18 — is that the training itself happens and can be evidenced. A matrix is simply the practical way most organisations meet that duty.

What’s the difference between statutory and mandatory training?

Statutory training is named by a specific law or regulation and applies regardless of employer policy. Mandatory training is required by your own organisation’s policy, even where no single statute names that exact course. Both belong on the same matrix, but only one is a legal floor.

Does CQC require training to be refreshed every three years?

No. CQC’s guidance on Regulation 18 uses flexible language — “ongoing or periodic supervision” — and leaves the exact interval to the provider’s own risk assessment. CQC checks that whatever cycle you set is actually followed, not that it matches a specific number of years.

What does RAG status mean on a training matrix?

RAG stands for red, amber, green. On a training matrix it typically means green for current (well inside validity), amber for due soon (inside a defined renewal window, commonly 30–60 days before expiry), and red for overdue (past the expiry date). The thresholds should be written down, not left to individual judgement.

How often should a training matrix be updated?

The underlying record should update continuously, whenever a certificate is renewed or a role changes. The matrix itself should be formally reviewed on a set cycle — monthly for RAG status, quarterly for whether the tiers and requirements per role are still correct — with one named owner accountable for both.

How long is a First Aid at Work certificate valid?

Three years. HSE guidance says annual refresher training is strongly recommended to keep skills current, but it is a recommendation, not a legal requirement — the fixed three-year figure is what actually has to appear on the matrix.

How long does an SMSTS or CSCS card last?

A CITB SMSTS or SSSTS certificate is valid for five years, and the refresher course must be completed before it expires or the full course has to be retaken. A CSCS Labourer card issued from 1 February 2025 is valid for two years initially, then renews for five years with evidence of continued employment in the role.

What is the Oliver McGowan Mandatory Training requirement?

It’s the statutory requirement, introduced under the Health and Care Act 2022, for CQC-registered health and social care providers to give staff learning disability and autism training appropriate to their role. The Code of Practice setting out the training standards came into force on 6 September 2025 and is now the benchmark CQC uses to assess compliance.

Do subcontractors and agency staff need to be on the matrix?

Yes, if they carry out work your organisation is responsible for. CDM 2015 requires whoever makes an appointment to take reasonable steps to satisfy themselves the appointee has the necessary skills, knowledge and experience — so their evidence needs to be visible on your matrix, not just held by their own employer.

What happens to training requirements when someone changes role?

Their entry on the matrix should be re-mapped against the new role’s tiers immediately, not at the next scheduled review. This is the single most commonly skipped step in published guidance, and it’s the one most likely to leave someone doing a job without the training it actually requires.

How long should training records be kept?

It depends on the sector and the type of record, and general employee-record retention principles apply on top of any scheme-specific rule. See our guide to how long employee records should be kept for the detail, including when GDPR requires records for former employees to be deleted rather than retained indefinitely.

Can a spreadsheet work as a mandatory training matrix, or do you need software?

A spreadsheet can work at small scale if someone disciplined owns it, applies RAG thresholds consistently, and attaches evidence rather than just a tick. It tends to fail as headcount, sites or subcontractor numbers grow, because nothing forces a review when a role changes or a certificate lapses — which is the gap dedicated software is built to close.

---