Most quality teams know their next regulatory inspection is coming. They know broadly what will be reviewed. They have procedures in place, records maintained, and systems running. Yet when the inspector arrives — announced or unannounced — a recurring scenario plays out: the organization spends the first hours of an inspection retrieving records it should have been able to produce in minutes.

The problem is not usually that the records don’t exist. It’s that the records exist in pieces — some in the LMS, some in the QMS, some in binders, some in spreadsheets — and assembling a coherent picture of who was trained on what, when, and to what standard of competency requires manual work under precisely the pressure that makes manual work least reliable.

Across every regulatory framework that governs quality in regulated industries — FDA for pharmaceuticals, biologics, medical devices, and food; ISO 13485 and the QMSR for devices; AS9100 Rev D for aerospace; IATF 16949 for automotive; FSMA and GFSI schemes for food and beverage; GMP requirements for cannabis and hemp — training records occupy a central position in what investigators and auditors actually examine. Understanding what each framework requires and what experienced inspectors look for is the first step toward inspection readiness that doesn’t depend on a pre-visit sprint.

Why Training Records Are Always in Scope

Every major quality regulatory framework connects personnel competency to product quality — because the link is causal, not incidental. People who don’t know what they’re supposed to do, or who don’t understand a process change that happened last month, produce quality events. Quality events that trace to training gaps generate findings. Findings that repeat generate enforcement action.

Regulators across every framework have internalized this logic. When an investigator or auditor arrives at a facility, they are not just asking whether training happened. They are asking whether the right people had the right knowledge at the right time — and whether the organization has documented evidence to prove it.

That evidence takes different forms in different regulatory contexts. But the underlying question is the same: can your records demonstrate, at any point in time, that every person performing a quality-critical task was qualified to perform it under the current version of the applicable procedure?

Organizations that can answer this question quickly and completely — because their training records are current, structured, and retrievable on demand — experience fundamentally different inspections than organizations that cannot.

An FDA investigator walks through the door unannounced. For one company, this moment triggers panic — staff scrambling through files, managers frantically pulling records, executives on damage-control calls. For another, it’s Tuesday. Personnel calmly escort the investigator to a prepared workspace. Documents appear within two minutes of the request. Subject matter experts answer questions without hesitation or speculation. The difference isn’t luck — it’s a sustained culture of readiness built into daily operations.

What FDA Investigators Look for in Training Records

Pharmaceutical and Biotechnology

FDA inspections of pharmaceutical and biotech manufacturers under 21 CFR Parts 210 and 211 consistently probe training records as a core inspection element. Investigators arrive having reviewed the facility’s previous inspection history, warning letters, and 483 observation patterns. They know the recurring themes, and inadequate training has appeared in the FDA’s top ten inspection observations every year since 2015.

What pharmaceutical investigators specifically examine:

Job function training documentation

21 CFR Part 211.68 and related regulations require that personnel responsible for manufacturing, processing, packing, or holding drug products receive training in GMP principles and training in their specific job functions. Investigators will ask to see training matrices that map each employee’s role to the procedures governing their work. Generic GMP training records satisfy one requirement. Job-specific procedure training satisfies another. Both must exist, and both must be current.

Training currency relative to document versions

When an investigator pulls a batch record and traces it to a manufacturing SOP, the next question is whether the employees who performed those operations were trained on the current version of that SOP at the time they performed the work. This requires the training record to show not just that training occurred, but which version of the procedure was trained, and when. An employee trained on version 3.1 of a procedure, performing work governed by version 3.3, represents a training gap — regardless of whether both training records exist.

Competency assessment beyond completion

FDA’s position, reflected in warning letters across multiple years, is that training completion records alone do not demonstrate competency. Investigators increasingly ask what assessment was used to verify that an employee understood the training content and can apply it correctly. Written quizzes, practical demonstrations, or observation records from qualified supervisors all satisfy this standard. A sign-off sheet confirms the training was delivered. Only an assessment confirms it was absorbed. eLeaP’s GMP training LMS guide details exactly what competency evidence FDA investigators expect to find.

Data integrity training for electronic systems

Under 21 CFR Part 11, organizations using electronic records and electronic signatures must maintain training records demonstrating that users understand their responsibilities — including what an electronic signature means, how audit trails function, and what constitutes proper record creation and correction. FDA warning letters and 483 observations related to Part 11 frequently cite the following deficiencies: inadequate audit trails, shared user accounts, disabled audit trail systems, and retrospective documentation created after the fact to satisfy inspector requests. Training records that demonstrate personnel understand these prohibitions are part of a complete 21 CFR Part 11 compliance picture.

Point-in-time historical retrieval

Investigators routinely ask for training records as of a specific date in the past — the date of a deviation, the effective date of a procedure change, or the date of a quality event. This requires records that preserve historical states, not just current states. An LMS that shows only who is currently trained on a document, rather than who was trained on which version at what date, cannot satisfy this requirement.

Medical Devices

Under the QMSR (21 CFR Part 820, effective February 2026), which incorporates ISO 13485:2016 by reference, FDA investigators examining device manufacturers now operate under the Compliance Program 7382.850 framework. Training records appear across multiple QMS Areas that investigators examine under this framework.

ISO 13485 Section 6.2 requires device manufacturers to determine the competence necessary for personnel affecting product quality, provide training to achieve that competence, evaluate the effectiveness of that training, and maintain documented evidence of all of it. Under QMSR, FDA investigators can now review internal audit records, supplier audit reports, and management review minutes — which means they can see whether competency gaps identified in internal audits generated appropriate training responses, and whether management review discussions of quality trends resulted in documented training interventions.

The two-minute standard for document retrieval has become an informal benchmark in device inspection readiness guidance. An investigator who must wait while staff searches through multiple systems for training records is seeing a quality system that is not organized for accountability. That observation — how quickly and completely records appear — shapes the tone of everything that follows.

CDMOs and CROs

Contract development and manufacturing organizations face inspection readiness requirements from two directions simultaneously: their own regulatory framework (typically FDA for pharmaceutical products) and the client quality agreements that define additional training documentation standards for each program.

FDA’s BioResearch Monitoring (BIMO) program, which governs clinical sites and CROs, specifically examines whether personnel performing clinical activities are qualified to do so and whether their qualifications are documented. The BIMO compliance program guidance finalized in December 2025 — which replaced earlier inspection documents and formalized Remote Regulatory Assessments as a permanent oversight mechanism — explicitly addresses staff training and qualification verification.

For CDMOs, the training readiness question extends to role-specific qualification across multiple concurrent client programs. An operator who works across three client studies needs documented qualification records that are program-specific, not just facility-generic. When a client conducts a supplier audit, training records for study personnel are standard review items. CDMOs that cannot demonstrate program-specific qualification for clinical and manufacturing personnel face corrective action requests that affect commercial relationships as well as regulatory standing.

What ISO Notified Body Auditors Look for in Device Training Records

For medical device manufacturers pursuing or maintaining ISO 13485 certification through Notified Bodies — as required for CE marking under EU MDR and for market access in numerous other jurisdictions — training record expectations parallel the FDA’s under QMSR but are applied through a certification audit framework rather than a compliance enforcement framework.

Notified Body auditors examine training records through the lens of Clause 6.2 and the related record requirements in Clause 4.2. They specifically look for:

A documented training matrix

A mapping of roles to required competencies, with clear identification of which procedures, work instructions, and quality system elements each role requires training on. The matrix must reflect the current document set — an outdated training matrix that doesn’t include recently revised procedures or recently implemented quality system elements is itself a finding.

Evidence of competency evaluation, not just training delivery

ISO 13485 explicitly requires that organizations evaluate the effectiveness of actions taken to achieve required competence. Notified Body auditors apply this requirement consistently: a training record that documents delivery without assessment doesn’t satisfy the effectiveness evaluation requirement. eLeaP’s dedicated resource on QMSR training requirements explains what effectiveness evidence must include and how it links to controlled document versions.

Connection between quality events and training responses

When a CAPA identifies a training gap, the training response and its effectiveness verification should be traceable in both the CAPA record and the training record. Notified Body auditors reviewing CAPA records will follow the thread to training records. A CAPA that closed on the basis of training completion, where the training record shows only a sign-off, represents an incomplete CAPA closure from the auditor’s perspective.

What AS9100 Auditors Examine in Aerospace

AS9100 Rev D, the quality management standard for aviation, space, and defense, derives its competency requirements from ISO 9001:2015 Section 7.2 and adds aerospace-specific expectations around safety-critical task qualification, first-article inspection personnel qualification, and configuration management training.

Aerospace auditors approach training records differently from other frameworks because the consequences of competency gaps in this industry include safety risk to human life. This context shapes how auditors evaluate the completeness and reliability of training documentation.

Role-specific qualification for safety-critical processes

AS9100 Rev D requires that personnel performing work affecting product conformity — and particularly personnel performing special processes such as welding, brazing, non-destructive testing, and surface treatment — demonstrate documented qualification to the current version of the applicable specification. These qualifications typically have expiration dates. An aerospace auditor will examine not just whether qualifications exist but whether they were current at the time the work was performed. Expired qualification records for personnel who performed safety-critical operations are among the most serious training findings in AS9100 audits.

Training currency following engineering changes

When a design change, process revision, or specification update propagates through the engineering change control system, AS9100 auditors ask whether affected personnel received training on the change before performing the relevant work. This is a configuration management requirement as much as a training requirement — in aerospace, an untrained operator applying an old process to a new specification is a configuration control failure, not just a training oversight.

First-article inspection (FAI) personnel qualification

AS9100 Rev D and the associated AS9102 standard for first-article inspection require that personnel conducting FAIs are qualified to do so. Auditors examine FAI documentation for personnel qualification references, then pull the referenced qualification records to verify currency and scope.

What IATF 16949 Auditors Look for in Automotive

IATF 16949:2016, the automotive quality management standard, includes more prescriptive training and competency requirements than ISO 9001 alone. Clauses 7.2.3 and 7.2.4 establish specific requirements for internal auditor competency, manufacturing process auditor competency, and second-party (supplier) auditor competency that go beyond the general personnel competency requirements in Clause 7.2.

IATF 16949 7.2.3 requires documented competency for auditors that includes understanding of automotive core tools — FMEA, MSA, SPC, PPAP, APQP, and Control Plans — as well as applicable customer-specific requirements. Competency requirements include an ongoing demonstration of competency via a minimum number of audits, refresher training, and updates to revised requirements. An auditor examining IATF 16949 compliance will look for training records that capture not just initial qualification but ongoing competency maintenance.

For production and quality personnel more broadly, IATF auditors examine:

Job skills training at each workstation

IATF 16949 requires operators to receive documented training for each workstation they are assigned to operate. This is more granular than most other frameworks — it’s not sufficient to document that an operator received general training on a process family. The training record must show qualification for each specific workstation and operation, current to the current control plan version.

Training records linked to control plan revisions

When a control plan changes — in response to an engineering change, a customer requirement update, or a process improvement — the affected workstation training records must reflect the updated requirements. Automotive auditors specifically examine whether control plan revisions triggered corresponding training updates for the operators working on those control plans.

Customer-specific requirement training

Major automotive OEMs — Ford, GM, Stellantis, and others — publish customer-specific requirements that supplement IATF 16949. Training records must demonstrate that quality and production personnel are aware of and trained on the applicable CSRs for the OEM customers they serve. An auditor conducting a supplier assessment on behalf of an OEM customer will examine CSR training records as a standard audit item.

What FSMA Inspectors and GFSI Auditors Look for in Food and Beverage

FDA’s FSMA inspection framework for food manufacturers centers on the Preventive Controls for Human Food rule under 21 CFR Part 117. Training requirements in this framework are tied directly to the Preventive Controls Qualified Individual (PCQI) requirement and the broader requirement that all food handlers receive training appropriate to their role.

FSMA inspectors specifically examine:

PCQI qualification documentation

The PCQI is the individual responsible for preparing the food safety plan, validating preventive controls, and reviewing records of corrective actions and verification activities. FDA requires that the PCQI demonstrate qualification through training equivalent to the FSPCA’s standardized curriculum or equivalent job experience. Inspectors will ask for documentation of the PCQI’s qualification and will review whether that qualification is current, including whether the PCQI has received updated training when the food safety plan was revised.

Training currency for preventive control monitoring personnel

Personnel responsible for monitoring critical control points, implementing preventive controls, and verifying their effectiveness must be qualified through training appropriate to their responsibilities. When a food safety plan is updated — a new hazard identified, a CCP modified, a control measure changed — the personnel responsible for executing those controls need training on the change before they perform the relevant work. FSMA inspectors examine the relationship between the food safety plan version history and training record timestamps.

Allergen control training

Allergen cross-contact is a leading cause of food recalls. FSMA inspectors specifically examine whether personnel involved in handling allergenic ingredients, performing sanitation activities, and conducting label verification are trained on allergen control procedures — and whether that training was updated when allergen-related procedures changed.

In 2024, approximately 74% of food facility inspections resulted in No Action Indicated, while less than 2% resulted in Official Action Indicated, the most serious classification. The organizations in the NAI category consistently maintained current, complete, and retrievable training records. The organizations in the OAI category typically couldn’t demonstrate that training had kept pace with process and procedure changes.

GFSI-recognized schemes, including SQF Level 2 and Level 3, BRCGS, and FSSC 22000, apply parallel training record requirements through their certification audit frameworks. These schemes require not just that training occurred but that training effectiveness was assessed, that records identify the trainer and the training method, and that training was refreshed when related procedures changed. Retailers that require GFSI certification as a supplier qualification standard are effectively mandating the same training record quality that FSMA inspectors look for.

What GMP Auditors Look for in Cannabis and Hemp

Cannabis and hemp processors operating under GMP requirements — whether under 21 CFR Part 111 (dietary supplements) or 21 CFR Part 117 (food), depending on product type — face third-party GMP audits that specifically examine staff training as one of six major GMP sections. State licensing bodies, including New York’s Office of Cannabis Management, require proof of a qualified third-party GMP audit as a condition of final licensure.

GMP auditors examining cannabis and hemp operations look for training records that demonstrate:

Role-based training documentation

Personnel performing extraction, manufacturing, quality control, and sanitation activities must have documented training records specific to their roles. A GMP audit examines whether each employee’s training record maps to the current SOPs and procedures governing their actual job functions — not just a general orientation or facility onboarding.

SOP training currency

Because the cannabis and hemp regulatory environment is evolving rapidly — with state regulations tightening, testing requirements expanding, and labeling requirements changing — SOPs in this sector change more frequently than in more established industries. GMP auditors specifically examine whether SOP revisions generated corresponding training updates and whether those updates were completed before affected personnel continued performing the relevant work.

Training records are accessible for auditor review

Auditors conducting third-party GMP audits expect training records to be produced quickly and in a format that allows them to verify completeness. Paper-based or spreadsheet-managed training records that require manual assembly often cannot demonstrate the completeness and currency that GMP auditors require. Digital training management systems that generate role-based training reports on demand materially reduce the risk of audit findings related to training record presentation.

The Four Training Record Gaps That Generate Findings Across Every Framework

Regardless of which regulatory framework applies, the same four training record gaps generate findings across pharmaceutical, device, aerospace, automotive, food, cannabis, and general manufacturing audits.

Gap 1: Version Mismatches Between Training Records and Procedure Records

The most common training record finding across every framework is the discovery that an employee’s training record documents training on an earlier version of a procedure while the current version is already effective. This gap appears at the intersection of document control and training management — and it appears most frequently in organizations where those two functions run in disconnected systems.

When a document revision completes its approval workflow, the document control system records the new effective date. Without an automatic trigger to the training system, the connection between the new version and the training requirement exists only in someone’s awareness. When that awareness doesn’t translate into action within an appropriate window, version mismatches accumulate — invisibly, until an inspector asks.

Investigators and auditors handling this finding treat it as evidence of a systemic quality system gap, not a one-time administrative failure. They will typically request training records for multiple documents to determine whether the version mismatch pattern is isolated or pervasive. A pervasive pattern elevates the finding from an observation to a systemic concern. eLeaP’s guide on QMS and LMS integration explains how a unified system eliminates version mismatches by design — document approval triggers training assignment automatically.

Gap 2: Completion Records Without Competency Assessment Evidence

Training completion records document that a training event occurred. They do not demonstrate that the employee who completed the training achieved competency. Every major regulatory framework requires competency evaluation — FDA’s pharmaceutical and device frameworks, ISO 13485, AS9100, IATF 16949, FSMA, and GMP requirements for cannabis all include explicit or implicit requirements for training effectiveness verification.

Organizations that record training completion without recording the competency assessment used to verify it are maintaining records that satisfy the training delivery requirement, but not the effectiveness requirement. Investigators who see completion records without assessment evidence ask for the assessment methodology. If the answer is that assessment is performed informally or not at all, the finding is the same as if no assessment existed.

An investigator should be able to trace from a complaint to the related CAPA to the affected procedures to training records without asking questions. That traceability requires that training records capture not just when training occurred but how competency was verified — and that both elements link coherently to the relevant procedure version.

Gap 3: Training Records That Can’t Be Retrieved Point-in-Time

A training record system that shows only current qualification status — who is currently trained on the current procedure version — cannot satisfy regulatory requirements for historical point-in-time retrieval. Investigators and auditors routinely ask for training records as of a specific date: the date a batch was manufactured, the date a quality event occurred, or the date an SOP became effective.

If the training management system cannot produce a point-in-time snapshot of training status — showing which version of each procedure each employee was trained on as of a specific date, with training completion and competency verification records — the system cannot answer the questions that inspections actually ask. Organizations that discover this gap during an inspection, rather than before it, face the audit equivalent of being reorganized by the investigator’s agenda rather than their own.

Electronic records must be protected to enable their accurate and ready retrieval throughout the applicable retention period. Training records subject to 21 CFR Part 820 QMSR requirements have a minimum two-year retention period for device records; pharmaceutical records under 21 CFR Part 211 must be retained for periods defined by the applicable regulation. FSMA requires retention of records for two to three years, depending on the record type. AS9100 and IATF 16949 retention requirements align with the product lifecycle and customer contractual requirements. Records that cannot be retrieved within those retention periods — or that exist only in systems that have since been decommissioned — represent compliance failures independent of whether the underlying training occurred. A 21 CFR Part 11-compliant LMS preserves historical records with their version references and timestamps intact, making point-in-time retrieval a routine operation rather than an emergency reconstruction.

Gap 4: Training Gaps That Weren’t Caught Until Inspection

The most costly training record gap is one that the organization didn’t know it had.

Organizations that regularly audit their own training records — examining version currency, competency documentation, and point-in-time retrieval capability as part of routine quality operations rather than pre-inspection preparation — consistently catch and close gaps before inspectors find them.

Organizations that manage training records reactively, assembling reports and verifying currency when an inspection is announced, are operating in a compliance mode that creates risk rather than managing it. Mock inspections that specifically test training record retrieval speed, version currency, and competency documentation depth reveal the actual state of inspection readiness before it matters.

Conduct a mock inspection without advance notice to test true readiness, not rehearsed performance. Test document retrieval speed — a two-minute standard for any requested record is a reasonable target. Practice the sequence of questions inspectors actually ask about training records: who performed this operation, what procedure governed it, what version was in effect, what training record shows that person was qualified to perform it, and what assessment was used to verify their competency.

If those questions can be answered in two minutes without manual reconciliation, the training records are inspection-ready. If they require assembling data from multiple systems, the gap exists — and the time to close it is before the inspector walks in, not after. eLeaP’s 21 CFR Part 11 compliance software guide walks through exactly how to run a mock internal audit against your LMS before the real inspection.

Building Training Records That Satisfy Every Framework

Organizations that serve multiple markets or operate across multiple regulatory frameworks — a medical device company also subject to FSMA for a combination product, a CDMO serving both pharmaceutical and biotech clients, an aerospace supplier also certified to IATF 16949 — face training record requirements from multiple frameworks simultaneously.

The training record architecture that satisfies all of them has consistent elements regardless of which specific framework applies.

Role-specific training matrices tied to current document versions

Every employee whose work affects product quality needs a training matrix that maps their role to the current version of every procedure, work instruction, and quality system element governing their work. The matrix is a living document that updates automatically when documents change — not a static assignment created at hire and never revisited.

Competency assessment records linked to each training event

Every training event generates two records: a completion record showing when the training occurred and an assessment record showing how competency was verified and what the result was. Both records reference the same procedure version. Both are retrievable together. The 21 CFR Part 11 compliant LMS guide outlines the technical requirements these records must meet for FDA inspection.

Point-in-time historical records preserved through system changes

When quality management systems or training management systems are upgraded or replaced, historical training records must migrate with their version references and timestamps intact. A system migration that resets training histories or loses version reference data creates retroactive compliance gaps for all historical periods.

Audit-ready report generation on demand

The training management system must generate role-based training reports, document-based training currency reports, and point-in-time training status snapshots without manual data assembly. These reports must be producible in minutes, not hours — because inspections don’t wait for data reconciliation, and because the speed of record retrieval itself signals inspection readiness to investigators. An LMS with a validated audit trail generates these reports as a standard output, not a manual compilation.

Electronic record integrity under 21 CFR Part 11, where applicable

For organizations using electronic training records under FDA jurisdiction, the system must maintain immutable audit trails, prevent unauthorized record modification, support electronic signatures with unique user credentials, and generate records suitable for inspection, review, and copying by the FDA. These requirements apply to the training management system itself — not just to the manufacturing and quality records it documents.

The Readiness Posture That Changes Inspection Outcomes

Inspection readiness is a daily operating state, not a pre-visit sprint. The organizations that consistently achieve No Action Indicated inspection outcomes are not the ones that work hardest in the two weeks before an announced inspection. They are the ones that maintain training records at inspection-ready quality every day — because their quality management and training management systems are integrated well enough that inspection-ready records are a natural output of normal operations.

When a procedure changes in an integrated system, training assignments are generated automatically, and version references carry through to training records. When a quality event occurs, the qualification status of affected personnel is immediately visible. When an inspector requests training records for a specific procedure as of a specific date, the system produces the report in minutes without manual reconciliation.

That capability doesn’t emerge from better pre-inspection preparation. It emerges from a quality system architecture in which training records are always current, always complete, and always linked to the quality events and document versions they need to support.

The inspector who arrives on a Tuesday to a team that experiences it as a Tuesday is seeing the output of that architecture. The inspector who arrives at a scramble sees its absence.

eLeaP’s unified QMS and LMS platform maintains training records that satisfy FDA 21 CFR Part 11, ISO 13485, QMSR, AS9100, IATF 16949, FSMA, and GMP requirements — with role-based training matrices, competency assessment tracking, point-in-time record retrieval, and audit-ready report generation built into a single validated system. Learn more at eleapsoftware.com.