Skills Compliance: How to Prove Workforce Competence and Stay Audit-Ready

Quick answer: Skills compliance is the practice of proving — with evidence an auditor will accept — that every person doing regulated, safety-critical or quality-critical work is actually competent to do it. It is not the same as training compliance. A completed course shows attendance; skills compliance requires a defined standard for the role, an assessment against that standard, the evidence behind that assessment, and proof the evidence is still in date. UK duties under CDM 2015, the Building Regulations, ISO 9001, ISO 45001 and CQC regulations all turn on demonstrated competence rather than course completion.

The gap tends to surface on the morning of an audit. The training dashboard is green, every mandatory course shows as complete, and then the auditor asks a different question: show me why this person is competent to do this task. Completion data cannot answer it, because completion was never the standard being tested.

The Health and Safety Executive is explicit about what competence means. HSE defines it as “the combination of training, skills, experience and knowledge that a person has and their ability to apply them to perform a task safely”. Training is one of four inputs, and the test is applied ability — not attendance.

What Is Skills Compliance?

Skills compliance is the discipline of maintaining continuous, provable alignment between what each role legally or contractually requires a person to be able to do, and what that person has been verified as able to do. It sits at the intersection of health and safety, quality management, HR and operations, which is precisely why it so often falls between them.

A working skills compliance system answers four questions about any employee, on demand:

• What is this person required to be competent in, for the role they hold?
• Who assessed them against that requirement, when, and how?
• Where is the evidence that assessment actually happened?
• Is that evidence still current, and who is accountable when it expires?

Skills Compliance vs Training Compliance

The distinction matters because the two are measured differently and fail differently. Training compliance is a completion metric: it goes up when people finish courses. Skills compliance is an evidence metric: it goes up when verified capability is recorded against a defined standard.

An organisation can be at 100% training compliance and still have a serious competence gap — for example, where a course was completed three years ago, the equipment has since changed, and nobody has re-verified anyone against the new process.

The UK Rules That Require Evidence of Competence

There is no single “skills compliance regulation” in UK law. Instead the duty is distributed across health and safety law, sector regulation and management-system standards. What they share is that each requires demonstrated competence, and several require it to be documented.

Instrument	Who it binds	What you must be able to evidence
Management of Health and Safety at Work Regulations 1999, reg. 7	Every employer	That the person appointed to assist with health and safety measures has “sufficient training and experience or knowledge and other qualities” to do so properly.
CDM 2015, reg. 8	Designers and contractors on construction projects	That anyone appointed has the skills, knowledge and experience necessary to fulfil the role — and that whoever appointed them took reasonable steps to check.
Building Regulations 2010, Part 2A (regs. 11F–11I)	Dutyholders on building work in England	That principal designers and principal contractors have the “skills, knowledge, experience and behaviours” needed — plus a duty to act when someone ceases to be competent.
ISO 9001:2015 and ISO 45001:2018, clause 7.2	Certified organisations	Determined competence requirements, competent people on the basis of education, training or experience, and retained documented information as evidence of that competence.
Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, reg. 18	CQC-registered providers	Sufficient staff with the qualifications, competence, skills and experience required, supported by appropriate training, supervision and appraisal.

Two features of that table are worth dwelling on. First, the statutory language is consistently about capability, not courses. Second, the Building Regulations go further than most by naming behaviours alongside skills, knowledge and experience — a signal that judgement and conduct are part of what has to be assessed. If you work in construction, our explainer on the BS 8670-2 competence standard covers how this plays out in practice.

The Five-Step Competence Evidence Chain

Auditors do not assess your intentions; they follow a chain. Each link is a question, and a break in any single link is a finding — regardless of how strong the other four are.

Step 1: Define the Standard

Write down, per role, what the holder must be competent to do. This is where a competency framework earns its keep: it converts “experienced operative” into a specific, assessable list. Without a documented standard there is nothing to assess anyone against, and steps 2 to 5 have no anchor.

Step 2: Assess the Person

Verify capability through observation of the task, a practical test, a structured sign-off or a professional registration — whatever is proportionate to the risk. The key change from training compliance is that somebody with the standing to judge has to make a judgement and put their name to it.

Step 3: Attach the Evidence

Store the artefact that proves the assessment happened: the certificate, the observation record, the assessor’s sign-off, the card copy. Evidence that lives in a manager’s inbox or a site folder is evidence you cannot produce under time pressure.

Step 4: Set the Expiry

Give every requirement a renewal date and a named owner who is alerted before it lapses, not after. Expiry is the most common single point of failure, because it degrades silently — nothing breaks on the day a certificate runs out, until it does.

Step 5: Re-verify and Report

Reassess on a defined cycle, and be able to produce the matrix on demand. If assembling your evidence for an auditor takes a week of manual collation, you do not have a skills compliance system — you have an archive.

What an Auditor Actually Asks For

In practice, audit questions escalate through four levels. Organisations that fail rarely fail at level 1 or level 3 — they have policies and they have certificates. They fail in between, at the assessment, and at the end, on currency.

Where Skills Compliance Breaks Down

The Spreadsheet Ceiling

Spreadsheets are excellent at recording that something happened and poor at everything else skills compliance needs. They hold no role standard, no assessor attribution, no attached evidence and no tamper-evident history, and they cannot alert anyone. A learning management system closes part of the gap but is still built around course delivery rather than verified capability.

Subcontractors, Agency and Temporary Workers

Competence duties do not stop at your payroll boundary. Under CDM 2015 the party making an appointment must take reasonable steps to check the appointee’s skills, knowledge and experience, which means the evidence chain has to extend to people whose records you do not own. Organisations that manage employee competence well and contractor competence in a separate inbox tend to discover the inconsistency during an incident investigation.

The Duty Most Teams Have Not Operationalised: Ceasing to Be Competent

Part 2A of the Building Regulations includes a specific duty around notifying when a dutyholder ceases to be competent. Almost no operational process accounts for this. Competence is treated as a one-way ratchet — once granted, never withdrawn — when in reality it can lapse through absence from the task, a change in equipment or process, a health change, or a performance concern. A mature system lets a manager remove a competence, with a reason and a date, as easily as they can grant one.

Competence Does Not Transfer Between Contexts

HSE stresses that competence has to be relevant to the actual workplace and its risks. Someone assessed as competent on one site, one machine or one product line is not automatically competent on another. Frameworks that record a skill once, globally, quietly overstate readiness across the organisation.

Nobody Owns the Records

Skills compliance fails structurally when HR owns training, operations owns assessment and health and safety owns the audit response. Whoever is accountable for producing the evidence needs authority over the system that holds it. For a wider view of how this fits the rest of your people data, see our guide to running a skills audit.

Getting Audit-Ready in 30 Days

You do not need a perfect framework to close the most dangerous gaps. Prioritise by risk, not by completeness.

1. Week 1 — Scope the critical few. List only the tasks where incompetence causes harm, regulatory breach or contract loss. For most organisations this is 10–20 requirements, not hundreds.
2. Week 2 — Write the standard for each. One paragraph per requirement: what must the person be able to do, to what level, judged how, by whom.
3. Week 3 — Find the evidence you already hold. Consolidate certificates, sign-offs and cards into one record per person. Expect gaps; log them rather than hiding them.
4. Week 4 — Load expiries and switch on alerts. Every requirement gets a date and an owner. A logged, dated gap with a remediation plan is a far better audit position than an unknown one.

How StaffCircle Handles Skills Compliance

StaffCircle’s training and compliance capability is built around the evidence chain rather than the course catalogue, so the four audit questions have a single answer each.

One Record Per Person, One Standard Per Role

Role-based competence requirements are defined once in the skills and development framework and applied automatically to everyone holding that role. Assessments, assessor sign-off and the underlying evidence files sit on the same employee record, so producing a person’s full competence history is a single view rather than a collation exercise.

Expiry Tracking That Escalates

Every requirement carries a renewal date, an owner and an alert window, so lapses surface as tasks before they become findings. Competences can be withdrawn as well as granted, with a reason recorded — which is what makes the “ceased to be competent” duty operable rather than theoretical.

Reachable by Frontline and Deskless Teams

The people whose competence is most often regulated are frequently the least likely to sit at a desk. Mobile access and Microsoft Teams integration mean evidence can be captured at the point of work — an observation signed off on site, not typed up three days later. Our guide to managing hybrid and deskless teams covers this pattern in more depth.

Reporting Built for the Audit, Not the Dashboard

Gap analysis runs across the whole organisation, by role, site, team or individual, and exports as the matrix an auditor expects to be handed. Construction and built-environment teams can see how this maps to sector duties on our competence management for construction page.

Final Thoughts

Skills compliance is not a heavier version of training compliance; it is a different measurement. The organisations that pass audits comfortably are not the ones with the highest completion percentages — they are the ones that can walk any assessor from a role standard, to an assessment, to the evidence, to the expiry date, in under a minute, for any person on the list.

That is a systems problem before it is an HR problem. Get the chain intact for your highest-risk tasks first, and the rest of the framework can follow. Book a demo to see how StaffCircle turns competence records into audit-ready evidence.

FAQ

What is skills compliance?

Skills compliance is the practice of proving that every person doing regulated, safety-critical or quality-critical work is competent to do it, with evidence an auditor will accept. It requires a defined standard for each role, an assessment against that standard, stored evidence of that assessment, and confirmation the evidence is still in date.

What is the difference between training compliance and skills compliance?

Training compliance measures whether people completed courses. Skills compliance measures whether people have been verified as able to perform the task. An organisation can be at 100% training completion and still fail an audit, because completion records attendance rather than demonstrated ability.

How do you prove employee competence to an auditor?

Show four things in sequence: the documented standard for the role, the record of who assessed the person against it and when, the underlying evidence such as a certificate or observation sign-off, and proof that the evidence has not expired. Findings usually arise at the assessment and expiry stages rather than the policy or certificate stages.

Is a training matrix enough to satisfy an auditor?

Only if the matrix links to the underlying evidence and shows who assessed each person and when. A matrix that lists names, courses and dates demonstrates activity but not verified capability, and cannot show that an assessment took place.

Can we manage skills compliance in a spreadsheet?

A spreadsheet can record that training happened, but it holds no role standard, no assessor attribution, no attached evidence files and no tamper-evident history, and it cannot alert anyone before a certification lapses. It becomes a liability once the number of people and requirements grows.

What does UK law say about workforce competence?

The duty is spread across several instruments. Regulation 7 of the Management of Health and Safety at Work Regulations 1999 requires competent persons to assist with health and safety measures. CDM 2015 regulation 8 requires designers and contractors to have the necessary skills, knowledge and experience. Part 2A of the Building Regulations 2010 requires principal designers and principal contractors to have the skills, knowledge, experience and behaviours needed. Regulation 18 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 applies equivalent requirements to CQC-registered providers.

Who is allowed to sign off that someone is competent?

Someone with the standing and subject knowledge to make the judgement, which varies by risk. That may be a line manager, a qualified assessor, a technical authority or an external certifying body. What matters for the audit is that the assessor is identified on the record and their basis for judging is defensible.

How often should competence be reassessed?

Set the cycle by risk and rate of change rather than a single organisation-wide interval. Safety-critical tasks, tasks using equipment that has changed, and tasks the person performs infrequently justify shorter cycles. Any change to the process, equipment or standard should trigger reassessment regardless of the calendar.

What should happen if someone stops being competent?

Competence should be withdrawable, with a reason and a date recorded, in the same way it is granted. Part 2A of the Building Regulations includes a specific duty around ceasing to be competent, and lapses can arise from long absence from the task, changes in equipment or process, health changes or performance concerns.

Does skills compliance apply to subcontractors and agency workers?

Yes. Under CDM 2015, whoever makes an appointment must take reasonable steps to satisfy themselves that the appointee has the necessary skills, knowledge and experience. That means the evidence chain has to cover people whose records your organisation does not own.

Is competence transferable between sites or equipment?

Not automatically. HSE guidance stresses that competence must be relevant to the actual workplace and its risks, so an assessment on one site, machine or product line does not by itself establish competence on another. Recording a skill once globally tends to overstate organisational readiness.

Do we need dedicated software, or can our LMS handle skills compliance?

An LMS is built to deliver and track courses, so it typically covers completion well but handles role standards, assessor sign-off, attached evidence and expiry escalation only partially. Dedicated competence management closes those gaps by treating the assessment, not the course, as the record.

What is the difference between a skills framework and skills compliance?

A skills framework defines what good looks like across the organisation and supports development and workforce planning. Skills compliance is the assurance layer on top of it, proving that specific people currently meet the specific requirements their role carries.