Security awareness training records for SOC 2

Training is a small control with an unforgiving population: it applies to every single person, so one missing record is a visible hole rather than a rounding error.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

Security awareness training evidence is a per-person completion record with a name, a completion date, and an identifiable course, tested against a population of everyone who was employed or engaged during the observation window. Auditors sample individuals and check two dates: completion against hire date for new joiners, and completion against your stated annual cycle for everyone else.

100 percent The only completion rate that produces no exception

What does the auditor actually sample?

They ask for the completion report covering the whole window, then reconcile it against your employee and contractor roster. Anyone on the roster and not on the report is a question. From the reconciled list they select individuals and ask for the underlying record for each. An aggregate percentage from a dashboard is never enough on its own.

Only put rows in your policy that you will run. A downloaded policy that promises quarterly phishing simulations and role-based training for four separate job families has committed you to four controls you did not know you had, and the auditor will test every one of them.

What do you do about contractors?

Contractors with access to systems in scope are in the population. This is the single most common gap in training evidence and it has the same root cause as the gap in access reviews: contractors are not in the HR system, so they are absent from the list that generated the training report.

1. Build the training population from your identity provider, not from payroll. If someone has an account, they need training.
2. Decide per contractor type whether they take your course or attest to their employer's equivalent. Both are defensible. Silence is not.
3. Where you accept an employer's training, get something in writing naming the person and the date, and file it in the same place as everything else.
4. Make training a gate in the access request rather than a task afterwards, so the record exists before the account does.
5. Include contractors in the annual cycle, not only at engagement, if the engagement runs longer than a year.

An agency developer with production access and no training record is the finding that makes an auditor widen the sample. The joiner and leaver evidence page covers building that one roster properly.

The person who never completed it

Every company has one. A founder, a sales lead who was travelling, an engineer who ignored eleven reminders. You have three honest options and one dishonest one.

1. Get it done now and record the real completion date, even though it is late. A late record inside the window is an exception on timing. A missing record is an exception on existence, and timing is the smaller of the two.
2. If the person has left, record that they left and when, and show they had training in a prior cycle if they did.
3. If the person has no access to anything in scope, document the scoping decision in writing before fieldwork rather than as an answer to the auditor's question. Retroactive scope arguments do not travel well.
4. Do not create a completion record with a date the person did not complete anything on. The learning platform stamps its own timestamps and the mismatch is visible.

Why does training evidence get bounced?

• An aggregate percentage with no names. A dashboard saying 96 percent complete cannot be sampled, and the missing 4 percent is what the auditor wants to see.
• A completion export with no course identified. A list of names and ticks does not show what anyone was trained on.
• Completion dates outside the window. Training from fourteen months ago does not evidence an annual control operating during a twelve month window that started later.
• The roster excludes contractors. Same failure as access reviews, same consequence for how much the auditor trusts your other populations.
• A calendar invite as evidence of a session. An invitation shows a meeting was scheduled. For live training, evidence is an attendance list with the date and the material presented.
• Policy acknowledgement conflated with training. These are usually two separate controls in the request list, and one record cannot answer both unless your policy explicitly defines them as one thing.

Getting the training file audit-ready

0 of 7 done · Reset

• One roster covering employees and contractors, generated from the identity provider.
• A named course with a stated syllabus, so the record says what was taught.
• Per-person completion records with dates, exported rather than screenshotted.
• New joiner enrolment triggered by the onboarding ticket, with a deadline that matches your policy.
• Annual cycle with a fixed month, so completion is easy to test against the window.
• Monthly completion tracking with a named chaser.
• Policy acknowledgement kept as its own record, separate from course completion.

The rules on exports beating screenshots are on the evidence collection page. The evidence tracker gives training its own row with a cadence and an owner, which is usually the difference between a control that runs and one that is remembered in month ten.

Common questions