Training Compliance Audit Checklist: An Ultimate 20-Question Self-Assessment for Organisations

Most organisations discover their training compliance gaps at the worst possible moment: when a regulator, client or certification body asks for proof. This training compliance audit checklist for Nigerian organisations lets you find those gaps first. It is a scored self-assessment of 20 statements across five areas, it takes about ten minutes, and it ends with a plain-language result that tells you where to start. You do not need a login, and your answers stay in your browser unless you choose to send them.

The assessment is written for HR leads, L&D managers, compliance officers and operations heads who are responsible for showing that people are trained, not just that training was scheduled. It reflects what auditors and regulators commonly ask for across sectors: a clear list of who needs what, records that prove it, deadlines that do not lapse unnoticed, evidence for contractors as well as employees, and someone accountable for the whole system.

How Does the Self-Assessment Work?

You read 20 statements about your organisation and answer each with one of three options: “Yes, consistently” scores 2, “Partly, or only in some places” scores 1, and “No, or I don’t know” scores 0. The maximum is 40. The statements are grouped into five domains of four questions each, so every domain scores out of 8, and you see both your total and a domain-by-domain breakdown.

The three-option scale is deliberate. Compliance is rarely a clean yes or no. A company may track expiry dates perfectly for its drivers and not at all for its office staff, and “partly” is the honest answer. The “I don’t know” option scores zero on purpose, because in an audit, not being able to answer quickly is functionally the same as not having the control.

Answer for your organisation as it works today. If different sites or departments differ, score the weakest material part, since that is where an auditor is most likely to look.

What Do the Score Bands Mean?

• 35 to 40, audit-ready. Your fundamentals are strong. The risk now is drift: requirements change, people move, and records decay. Keep a quarterly retrieval drill in your calendar.
• 27 to 34, mostly ready. You could probably handle a routine request, but one or two weak domains would slow you down under pressure. Work on the lowest-scoring domain first.
• 14 to 26, significant gaps. An auditor would likely find missing or inconsistent evidence. Fix records and deadline tracking first, then extend the same standard to contractors and governance.
• 0 to 13, high exposure. Training may well be happening, but you could not prove it quickly. Start with a single record standard and a written list of mandatory training for your highest-risk roles.

No score guarantees an audit outcome, and a high score is not legal advice. The bands are a practical guide to where your effort will pay off most.

What Are the 20 Questions, and Why Do They Matter?

Domain 1: Coverage and requirements

1. We have a written list of the training each role must complete, and what requires it (regulation, procedure or policy).
2. That list is reviewed at least once a year and whenever a procedure, regulation or role changes.
3. New joiners are assigned their mandatory training automatically or on a fixed schedule, with a deadline.
4. When someone changes role or site, we check that their new training requirements are met.

These come first because everything else depends on them. You cannot prove people are compliant if you have not defined what compliant means for each role. Learnep’s guide to role-based learning paths explains how to build the matrix, and the compliance training LMS guide shows how requirements connect to the regulators in your sector.

Domain 2: Evidence and records

5. For any named employee, we can produce a full training record (courses, dates, results, expiry) within 15 minutes.
6. Each completion records which version of the course or procedure the person was trained on.
7. We keep evidence of competence (an assessment result, observed sign-off or supervisor confirmation), not just attendance.
8. Our records show who created or changed them, and when.

This is the domain where attendance registers fail. Auditors look for proof that a named person met a named requirement under a specific version of the procedure, and that someone checked the training worked. The follow-up guide on audit-ready training records goes through each property of a good record, and the article on running a compliance training sprint before an audit covers what to do when time is short.

Domain 3: Deadlines and renewals

9. We can say today exactly who is overdue or expired on any mandatory training.
10. We track expiry dates for certifications and licences, with alerts at least 30 days before they lapse.
11. Overdue training is escalated to line managers automatically or by a fixed routine.
12. Every mandatory course has a defined refresher cycle (for example annual or every two years).

Lapsed certificates are the easiest finding for an auditor to make and the easiest for an organisation to prevent. Nobody needs to remember when a first-aid certificate or a professional licence expires if the system does. Learnep’s guide to LMS-based certification and credentialing explains how expiry tracking works in practice.

Domain 4: Contractors and all sites

13. Contractors, agency and temporary staff have the same documented training requirements as employees where they do the same work.
14. We can show training status for contractors and third parties on our sites at any time.
15. Training is verified before contractors start work or gain site or system access.
16. Training for all sites and departments is recorded in one place, not in separate local files.

Auditors do not distinguish between a risk created by an employee and one created by a contractor doing the same job. They also do not accept “that site keeps its own files” as an answer. If you operate in construction, oil and gas, power, mining or logistics, where third-party workforces are large, this domain often scores lowest. The article on health and safety compliance training covers the safety side.

Domain 5: Governance and effectiveness

17. A named person owns training compliance and reports on it to management at least every quarter.
18. We measure whether training worked (test scores, observations, incident or error trends), not only completion.
19. We log failures, missed training and corrective actions, and follow them through to closure.
20. In the past 12 months we have run a mock audit or a record-retrieval drill.

The 2025 survey on compliance and ethics training from the governance body OCEG, which drew 347 qualified responses from professionals responsible for training design, delivery or oversight, put the problem bluntly: “organizations overwhelmingly measure training activity rather than training impact.” Question 18 is a direct test of whether you are in that majority. Questions 19 and 20 matter because they show a control that works: a record with no exceptions at all is harder to believe than one showing a problem found and fixed.

What Does Real Enforcement Tell Us About Evidence?

Regulators in Nigeria are active, and the pattern in the data is that they punish what they can document. According to a report on the Central Bank of Nigeria’s 2025 annual report, the CBN imposed ₦1.69 billion in penalties across 32 sanctions in 2025. Of that total, ₦430 million came from 21 penalties for complaints handling and other consumer-protection breaches, and ₦1.26 billion came from 11 penalties for regulatory breaches and failure to respond to regulatory queries.

The report could not confirm which banks were sanctioned. These are not training penalties, but the second category is worth noticing: failing to respond to a regulator’s query is a penalty in its own right, which is exactly the situation an organisation faces when it cannot produce records on request.

The case of Fidelity Bank shows how long and document-heavy these processes are. According to a summary by Infusion Lawyers, the NDPC opened an investigation in April 2023, issued a ₦250 million remedial-fee demand in December 2023, and announced a ₦555.8 million fine on 21 August 2024. The NDPC’s reported findings concerned encryption, access controls and breach notification, not training.

The bank disputes them: it says there was no data breach, that the account in question was never operational because the customer’s documentation was incomplete, and, as its statement put it, that it “does not agree with the NDPC’s findings and enforcement order.” The matter is contested in the public record, and we take no position on who is right. What the timeline illustrates is how much of a regulatory process runs on documents: notices, responses, meetings and written policies. In its reported response, the bank pointed to its data protection policy, under which online accounts without full documentation cannot operate and are closed after 30 days.

That is the kind of written control, backed by system records, that any organisation will want to be able to produce when its own practices are questioned. If a regulator asks how you train people on a policy, the same logic applies.

For a closer look at how Nigerian data protection obligations apply to staff training, see Learnep’s guides on NDPA training for HR teams and what L&D leaders should know about the NDPC. Financial institutions can also read the AML training requirements guide.

What Should You Do in the 30 Days After You Score?

Treat the result as a work plan, not a grade. A realistic 30-day sequence looks like this.

Week 1: Confirm the score. Ask two other people, such as a compliance officer and an operations manager, to complete the assessment independently. Where your answers differ, you have found your first gap: if people disagree about whether a control exists, it is not reliable.

Week 2: Pick one domain. Choose the lowest-scoring domain, or the one tied to your highest-risk role, and write a one-page fix. Resist spreading effort across all five.

Week 3: Run a retrieval drill. Pick five employees at random, including one contractor, and time how long it takes to produce a complete training record for each. Note what was missing, who had to be asked and which system held the answer.

Week 4: Report and schedule. Share the result and the fix with whoever owns compliance, put the next assessment in the calendar for three months’ time, and agree who owns each action.

If your drill exposes records scattered across spreadsheets and folders, that is the point at which a platform becomes worth evaluating. The LMS vendor comparison scorecard and the guide to data-driven decisions in L&D help you decide what to look for.

How Often Should You Retake the Assessment?

Quarterly is a sensible rhythm for most organisations, and after any major change such as a restructuring, a new site, a new regulation or the adoption of a new system. The domain scores give you a simple trend to share with leadership: a movement from 4 to 7 in the evidence domain is easier for an executive to grasp than a paragraph about record-keeping. Keep your earlier results so you can show improvement over time.

Who Should Complete It?

The person who owns training compliance should lead, but the most useful results come from three perspectives: someone from HR or L&D, someone from compliance or risk, and a line manager from an operational area. Their disagreements are informative. HR may believe contractors are covered because a policy says so, while an operations manager knows nobody checks. Reconcile the differences before you finalise the score.

Common Training Compliance Audit Checklist Pitfalls to Avoid

Scoring the policy instead of the practice. A written procedure that nobody follows earns a “no”. Answer for what actually happens.

Answering for your best site. If one location is excellent and three are not, your honest answer is “partly”.

Treating “I don’t know” as neutral. It is a finding. If nobody can say who is overdue, the control does not work.

Fixing everything at once. Spread across five domains, the effort rarely lands. Pick one domain, close it and retake the assessment.

Using the result as a certificate. The score is a prompt for action. It does not replace legal advice, sector-specific requirements or a real audit.

Frequently Asked Questions

Is this assessment specific to Nigeria? The questions reflect good practice that applies in any regulated environment, and the examples and guides linked here are Nigerian. Sector rules differ, so use the result alongside the requirements of your own regulator, such as the NDPC, CBN, NCAA or NUPRC.

What is a good score? Thirty-five or more out of 40 indicates strong fundamentals, and 27 to 34 means you are mostly ready. Below 27, expect an auditor to find gaps in evidence. The most useful number, though, is your lowest domain score, because an audit tends to find your weakest area.

Do I need a learning management system to score well? No, a small team with disciplined spreadsheets can score reasonably. As headcount, sites and contractors grow, retrieval gets slower and changes become harder to trace, and that is usually where a system pays for itself.

What happens to my answers? They stay in your browser unless you choose to send them. Any email option is only available if the site owner has enabled it, and it asks for your consent first. See the Learnep privacy policy.

Where This Fits in Your Compliance Programme

The self-assessment is the starting point of a larger programme. Once you know where you stand, the compliance training LMS guide gives the regulatory foundation, and the audit-ready records guide shows how to build evidence that retrieves in minutes.

If you would like to walk through your result with someone who sees these gaps every week, book a demo and bring your score. You can also explore the Learnep features or read the FAQ page.