Preparing for a Skills Compliance Audit: What Inspectors Ask For

Most advice on preparing for a skills compliance audit starts with the training matrix: chase the overdue courses, get the percentage up, turn the red cells green. I think that is the wrong place to start, and the published inspection guidance backs me up. Inspectors rarely judge the matrix. They pick a person, or a task, and follow it.

A matrix that reads 96% complete says nothing about whether tonight's agency nurse has been assessed on the hoist, or who signed off the excavator operator. Those are the questions that get asked, and the answer sits behind one row, not in the total.

A skills compliance audit is a check that the people doing regulated or safety-critical work are competent to do it, and that you can prove it. Inspectors from bodies such as the CQC and HSE sample individual staff records, talk to workers and trainers, watch work, and ask how you review your own arrangements. Preparing well means rehearsing that trace, not polishing the training matrix.

Key facts

• No UK statute sets a single refresher interval; MHSWR reg 13 says training must be “repeated periodically where appropriate”.
• HSE inspectors can require any document they need for an investigation, not only records the law says you must keep.
• HSE defines competence as training, skills, experience and knowledge, plus the ability to apply them safely.
• There is no general HSE retention period for training records; UK GDPR requires a justified retention policy.

Your training matrix is an index, not evidence

The matrix tells you where to look, like a book's index. HSE's definition shows why that is not enough. It describes competence as “the combination of training, skills, experience and knowledge that a person has and their ability to apply them to perform a task safely” (HSE, What is competence?). A tick in a training column covers one of those four ingredients, and none of the ability to apply them.

So when you prepare, the useful question is not “is the matrix complete?” It is whether your system can answer these, for any person an inspector happens to choose:

• Which tasks is this person allowed to do on their own today?
• What standard did we set for each of those tasks, and is it specific to this site or job?
• Who assessed them as competent, how, and was that assessor competent to judge?
• When does each piece of evidence expire, and what happens if it lapses?
• When did we last check that the whole arrangement actually works?

If you have read our guide to skills compliance and how to prove workforce competence, you will recognise this as the evidence chain. This article is about the moment someone tests that chain from the outside.

Where the duty to prove competence comes from

Every audit question traces back to a few lines of law or a published standard. Inspectors test against the exact wording, so it pays to know it.

Source	The words that matter	What an auditor will test
Health and Safety at Work etc. Act 1974, s.2(2)(c)	“such information, instruction, training and supervision as is necessary”	Training and supervision, judged against the risk
Management of Health and Safety at Work Regulations 1999, reg 13	Training on recruitment and on exposure to “new or increased risks”; “repeated periodically where appropriate”	Whether training followed job changes, new equipment and new systems of work
PUWER 1998, reg 9	Users of work equipment must have “received adequate training for purposes of health and safety”; the duty extends to those who supervise or manage its use	Equipment-specific training, including for supervisors
CDM 2015, reg 8	Contractors must have “the skills, knowledge and experience” for the role; appointers must take “reasonable steps to satisfy themselves”	How you checked the competence of contractors you appointed
Regulated Activities Regulations 2014, reg 18	“suitably qualified, competent, skilled and experienced persons” who receive “support, training, professional development, supervision and appraisal”	Care staff records, supervision and appraisal
Regulated Activities Regulations 2014, reg 19	Staff must “have the qualifications, competence, skills and experience which are necessary for the work”	Recruitment files, including evidence of relevant qualifications
ISO 9001:2015, clause 7.2 (as summarised by ECESIS)	“Retain appropriate documented information as evidence of competence”	That competence evidence exists and is controlled, not just training logs

Two details in that table catch people out. First, reg 13 sets no fixed refresher cycle. It asks for training to be repeated “where appropriate” and adapted “to take account of any new or changed risks”, and it must “take place during working hours”. An auditor is more interested in whether your interval is justified than in whether it is annual. We cover how to set those intervals in competence validation and revalidation at scale.

Second, HSE's powers reach further than the records the law tells you to keep. Section 20(2)(k) of the 1974 Act lets an inspector require the production of documents that must be kept and also “any other books or documents which it is necessary for him to see” for an examination or investigation (HSWA s.20). Your voluntary training matrix, your toolbox-talk sign-in sheets and your assessor notes are all in scope.

What inspectors actually sample

Methods differ, but the published guidance points one way: sample individual records, talk to real people, and ask whether you check your own system.

CQC: records, staff feedback and observation together

The CQC's quality statement for safe and effective staffing says providers must make sure “there are enough qualified, skilled and experienced people, who receive effective support, supervision and development” (CQC, Safe and effective staffing). It also says recruitment practices must ensure “all staff, including agency staff and volunteers” are suitably competent. Agency workers are named, which is exactly where many records are thinnest.

CQC groups its evidence into six categories, including feedback from staff and leaders, observation and processes (CQC evidence categories). For care homes, the staffing evidence it lists under processes includes “recruitment records” and “staff records, including appraisal, training, development and competency”, while under observation it lists “staff practice” (CQC care homes evidence, Safe). Records and practice are read side by side.

CQC's Regulation 18 guidance adds the operational expectations: an induction programme, training needs assessed at the start of employment and “reviewed at appropriate intervals”, supervision until staff “can demonstrate required/acceptable levels of competence”, and monitoring with “appropriate action taken quickly when training requirements are not being met” (CQC Regulation 18 guidance). One caution: CQC has consulted on replacing its quality statements with supporting questions (CQC consultation), so check the current wording before an assessment.

HSE: talk to the people, then read the file

HSE's leaflet on what to expect from an inspector says they may “ask you about your workers and what they do” and “ask to see records or other documents”, and that “the inspector will need to talk to your employees or their representatives during the visit” (HSE, HSC14). Visits are not always announced.

The clearest picture of a competence inspection comes from a document few audit-prep guides mention: HSE's core topic guidance on competence assurance, written for inspectors of major hazard sites (HSE, Core topic 1: Competence assurance). It is aimed at COMAH sites, but its inspection points read like a template for any serious competence audit. Inspectors are told to:

• “Talk to trainers and assessors, and new employees (operators) or those in training.”
• “Focus on safety critical tasks & key MAH roles.”
• “Ask how on-the-job (i.e. process/job-specific) training is structured.”
• Check whether there are “standards for competency at all levels” that are site and job-specific.
• Consider the “quality of the trainers” and “the role of refresher training”.

The documents it recommends requesting are “training records for a selection of personnel” and “records of audit/review of the competency assurance system.” Its question set then asks whether there is a record system that shows “Records for each person?”, “Evidence of appropriate validation?” and “Evidence of training AND assessment?” The capital letters are HSE's.

Certification bodies and clients

An ISO 9001 or ISO 45001 auditor will usually sample against clause 7.2's demand for documented evidence of competence. Principal contractors and clients audit their supply chain against CDM's “reasonable steps” test; see how tier-one contractors assess supply-chain competence. For higher-risk buildings, the free BS 8670-2 readiness checklist covers the same question.

Run a mock audit before someone else does

A mock audit rehearses the trace. It needs four hours and someone who did not build the records, not a consultant. Here is the method I would use.

1. Choose the sample blind. Pick five people without looking at their files first: a new starter, an agency or contract worker, someone on nights or working remotely, a supervisor and a trainer or assessor. HSE’s guidance points inspectors at exactly these groups, and they are where gaps hide.
2. Trace one safety-critical task each. For each person, choose a task they did this week. Follow it from the standard, to the training, to the assessment, to the sign-off, to the expiry date. Write down every link you cannot show within a few minutes.
3. Talk to them. Ask each person what they are allowed to do unsupervised and who checked them. Ask the supervisor the same about their team. Compare the answers with the file.
4. Check the assessors. For every sign-off in your sample, ask who the assessor was and what makes them competent to judge. HSE’s guidance says trainers and assessors need to be trained and “credible” to the workforce.
5. Test the system, not just the people. Find the last time you reviewed your own competence arrangements. If there is no record, that is a finding in its own right.
6. Log every gap with an owner and a date. A gap you found, dated and assigned, is a very different conversation from one an inspector finds.

If your mock audit shows the records are scattered across spreadsheets, inboxes and binders, that is the real finding. Our guide to building a mandatory training matrix that is actually audit-ready is a good next step.

The gaps the guidance warns about

These are weak points the guidance itself calls out.

Training recorded, assessment missing

Attendance proves someone was in the room. HSE's question set asks for “training AND assessment”, and its key areas note that assessment should be proportionate to the risk, “e.g. by use of adequate testing, passmarks, performance checks”. If your records stop at a course completion date, that is the first gap an inspector will see.

Generic qualifications treated as job competence

HSE's competence-assurance guidance warns that operators “may assume that completion of generic VQs is sufficient for competency”, and that “there will always be gaps at site/process level”. Cards and passports are the same: a site-specific assessment shows they can do this job here.

Agency and temporary workers outside the system

The Management Regulations require you to give fixed-term and agency workers information on “any special occupational qualifications or skills required” before they start, and to tell the agency what the job needs (MHSWR reg 15). CQC names agency staff in its staffing statement. If agency workers have no record in your system, your sample will expose it.

Experience left out

HSE is blunt: “what we really mean when we say competent includes adequate experience.” A course with no supervised practice and no later sign-off misses it.

Nobody audits the audit

Both HSE documents ask whether the organisation checks its own arrangements. HSE's inspection points include the “site’s auditing themselves on the effectiveness of the training arrangements”.

On the day: how to handle the request

Produce what is asked for, quickly and honestly.

• Name one host. One person who knows where every record lives and can pull a full history for any name in minutes.
• Hand over what is asked for, not everything.
• Show the logged gaps. Your mock-audit log, with owners and dates, is evidence that the system is managed.
• Let staff speak for themselves. Inspectors will talk to them anyway.

On retention, there is no single number to quote. The ICO says “the UK GDPR does not set specific time limits for different types of data” but that you must not keep personal data “for longer than you need it” and need a retention policy (ICO, storage limitation). HSE's own training leaflet sets no retention period and says only that you should “monitor training records so that refresher training can be given when needed” (HSE, INDG345). Decide your periods, write down why, and apply them. Our guide on how long to keep employee records covers the wider picture.

Where StaffCircle fits

All of this is possible with spreadsheets. It is slow, and the trace breaks wherever a link lives somewhere else. StaffCircle keeps the chain in one record.

One record per person, retrievable at a point in time

StaffCircle's training compliance tools keep a retrievable, point-in-time record of who is trained, to what level, and when certifications expire. When an inspector asks for a named person's history, the host pulls it up rather than hunting through drives.

Standards defined per role, not per course

SKEB frameworks set out the skills, knowledge, experience and behaviours each role needs across A to E levels, so the “standard” layer of the trace exists before anyone is assessed against it. If you are starting from nothing, StaffCircle's AI-assisted competency framework builds a first draft of roles and levels for you to refine.

Revalidation that does not depend on memory

Automatic revalidation reminders flag evidence before it lapses, which is the difference between a logged, planned refresher and a red cell found on the day.

Competence connected to everyday management

Certifications and courses connect to reviews, objectives and personalised development plans, so the supervision and appraisal that CQC and HSE both ask about sit next to the competence evidence, not in a separate system.

Final thoughts

A skills compliance audit is rarely lost on the percentage. It is lost on one person whose story does not hold together: trained but never assessed, assessed by someone who was not competent to judge, or simply missing because they came through an agency. Rehearse that trace first and log what you find.

If you want to see how StaffCircle keeps the whole evidence chain in one place, book a demo and bring your hardest audit question.

FAQ

What is a skills compliance audit?

A check that people doing regulated or safety-critical work are competent, and that you can prove it. Auditors sample individual records, speak to staff, watch work and ask how you review your own arrangements.

How is a skills compliance audit different from a skills audit?

A skills audit compares the skills you have with those you need, usually for development planning. A skills compliance audit tests whether you meet legal or contractual competence requirements for named people on a given date.

What do CQC inspectors look at in training records?

For care homes, CQC lists recruitment records and staff records including appraisal, training, development and competency. It also observes staff practice and gathers staff feedback, so records are compared with what staff do and say.

What training records do HSE inspectors ask for?

Inspectors can ask for any records or documents they need. HSE's competence-assurance guidance recommends requesting training records for a selection of personnel and records of audit or review of the competence system.

Is a training matrix enough for an audit?

No. A matrix is a useful index, but it rarely shows who assessed each person, how, and whether that assessor was competent. Auditors follow the individual records behind it.

How do you prove staff competence to an auditor?

For a named person, show the role standard, the training, a recorded assessment by a credible assessor, the current expiry date, and that they only do work they are signed off for.

How often should training be refreshed?

UK health and safety law sets no single interval. The Management Regulations require training to be repeated periodically where appropriate and adapted for new risks. Set intervals by risk and record why.

Do agency staff need to be in our training records?

You should be able to evidence their competence. The Management Regulations require you to tell agency workers what skills a job needs before they start, and CQC's staffing statement names agency staff.

Are qualifications or cards proof of competence?

Not on their own. HSE defines competence as training, skills, experience and knowledge plus the ability to apply them safely, and warns that generic qualifications leave site-level gaps.

How long should training records be kept in the UK?

There is no general statutory or HSE retention period. UK GDPR says not to keep personal data longer than you need it, and the ICO expects a documented retention policy.

What is a mock audit for training compliance?

An internal rehearsal of an inspection. Someone independent samples a few staff, traces a task for each from standard to sign-off, talks to them, checks the assessors and logs every gap.

What happens if training is out of date at an inspection?

HSE outcomes range from advice to improvement or prohibition notices and prosecution. CQC cannot prosecute for a Regulation 18 breach but can take regulatory action. A gap you have already logged is viewed very differently.

---