Training matrix template: keeping training records that stand up to a DOSH audit

What a training matrix is

A training matrix (also called a competency matrix or skills matrix) is a single table that shows, for each person, which training their role requires and whether it is current. Rows are employees or contractor workers; columns are the required courses, certificates and briefings; each cell holds the date completed, the expiry date and a status colour.

It answers three questions at a glance:

• Is everyone trained for the job they are doing today?
• What is expiring soon, so refreshers can be booked before a certificate lapses?
• Where are the gaps by department, site or contractor, so effort goes where it is needed?

A competency matrix goes one step further than a training record: it shows not only that someone attended, but that their competence was checked, for example by an assessment, a practical demonstration or a supervisor sign-off.

The legal duty to train under the OSH Act 1994

Malaysian law puts the training duty on the employer and, since 1 June 2024, on the principal as well:

• Section 15(2)(c): the employer's general duty includes "the provision of such information, instruction, training and supervision as is necessary to ensure, so far as is practicable, the safety and health at work of his employees".
• Section 18A(3)(c): a principal must provide the same information, instruction, training and supervision for contractors, subcontractors and their employees working under the principal's direction.
• Section 19: breaching sections 15 to 18B carries a fine of up to RM500,000, up to two years in prison, or both.
• Section 31A: the Minister may, by order in the Gazette, require a class of persons to attend a specified OSH training course run by a registered training provider. The employer must ensure the person has completed it before allowing them to do the work it covers. The Director General may also direct a person to attend a refresher course. Breaching the employer's duty under section 31A(2) carries a fine of up to RM50,000, up to six months in prison, or both.

The Act does not prescribe a training matrix or a record format. But "so far as is practicable" is judged on evidence, and after an incident the employer has to show what was provided. A matrix plus the underlying records (attendance, assessment results, certificates) is that evidence. Section 26 also means you cannot charge employees for training provided under the Act. See our OSHA amendment 2022 guide for the wider changes.

If your organisation is certified to ISO 45001, clause 7.2 on competence also asks you to determine the competence workers need, act to close gaps, evaluate whether those actions worked and keep documented information as evidence of competence. A well-kept matrix covers most of that.

How to build a training matrix

1. List roles, not just people. Group people by role or job (for example production operator, forklift driver, maintenance technician, office staff, site supervisor, contractor crew).
2. Map the requirements for each role. Pull them from your risk assessment (HIRARC), legal requirements, Gazette orders under section 31A that apply to your work, client or contract requirements, and company standards. Typical columns: site induction, emergency response and fire, first aid, permit to work, energy isolation, confined space, working at height, chemical handling, forklift or crane, plus non-safety compliance such as anti-bribery and data protection.
3. Mark each requirement as mandatory, role-specific or optional so the matrix does not imply every person needs every course.
4. Set the validity for each column: the issuer's validity for external certificates, your own interval for internal courses.
5. Populate it from evidence, not memory: attendance lists, certificates, assessment results, LMS exports.
6. Colour-code status: current, expiring soon, expired or missing, not required.
7. Assign an owner and a review rhythm: who updates it, and when it is reviewed with managers (monthly works for most sites).

A short example:

Our free training matrix template uses this layout on A4 landscape, with a status legend and space for dates and expiry.

Training records for DOSH audits and inspections: what evidence to keep

DOSH officers investigating an incident, and auditors checking an OSH management system or a contractor, usually work from a person back to the evidence. For any name they pick, be ready to show:

• The requirement: why this role needs this training (risk assessment, legal requirement, procedure).
• The record: date, course title and version, duration, delivery method, trainer or provider and their credentials where relevant.
• Proof of attendance: signed attendance list or a timestamped electronic record.
• Proof of competence: assessment result against a pass mark, practical check, or supervisor sign-off.
• Certificates for external courses, with numbers and expiry dates, and for courses under a section 31A order, evidence that the provider is a registered training provider.
• Refresher history: that expired training was renewed, and what happened to people whose training lapsed.
• Contractor evidence: the site induction and competence documents checked before work started.

Common findings are matrices that do not match the records behind them, certificates that expired months ago while the person kept doing the work, inductions with no date or content, and training that shows attendance but no check of understanding. Make sure records can be produced quickly; a spreadsheet nobody can find on the day does not help.

Refresher intervals and expiring certificates

There is no single refresher interval for all training in Malaysian law. Set it column by column:

• External certificates follow the validity the issuing body sets. For example, CIDB construction personnel registration (the green card) for MyKad holders is valid for one to five years, and renewal can be applied for 60 days before expiry. Check each certificate's own validity rather than assuming.
• Courses under a section 31A order follow the order, and the Director General may direct an individual to attend a refresher.
• Internal training (inductions, awareness, procedures) follows your own risk assessment. You might, for example, refresh high-risk topics every year and lower-risk awareness every two or three years; whatever you choose, record the reason.

Also retrain on triggers, not just dates: after an incident or near miss, when a procedure or piece of equipment changes, when someone changes role or site, and when someone returns after a long absence.

For expiring certificates, add an "expires in the next 90 days" filter or column, book refreshers early (external courses can have waiting lists), and decide in advance what happens when a certificate lapses: usually the person stops that task until it is renewed. Write the rule down and apply it consistently.

Common training matrix mistakes

• Everyone needs everything. A matrix with every column marked mandatory hides real gaps. Tie each requirement to a role and a reason.
• Contractors left out. Under section 18A, contractor workers under your direction need to be in the picture too.
• Attendance treated as competence. Add the assessment result or supervisor sign-off.
• Several versions in circulation on different laptops. Keep one master copy with an owner.
• No link to the evidence. Each cell should point to a certificate, attendance list or system record.
• Expiry dates not tracked, so lapses are found by the auditor rather than by you.

Keeping training records in a learning platform

Spreadsheets work for small teams. As headcount, sites and contractors grow, most of the matrix can come straight from a learning platform, so records are created when training happens rather than typed in later. Our compliance training platform guide compares the options.

In the WorkQuest2U company workspace, administrators import staff from a spreadsheet, assign programmes by department with due dates, and see progress by person, department and programme, including what is overdue. Each assessment is graded against a pass mark and recorded with a timestamp, certificates carry unique IDs, and managers can download timestamped CSV snapshots for HR, management and audit. Comparing first attempts with later results shows whether knowledge is sticking. Try it with synthetic data in the sample workspace. Lessons such as HSSE Laws & Regulations and Safety Leadership are good starting columns. Keep records for external and practical training (first aid, competent person courses) alongside them.