The phone call you do not want is the one where someone asks for proof of training after the thing it was supposed to prevent has already happened. An incident on site. A WorkCover claim. An audit that arrives with a list of names and a fixed date range. A dispute where an operator says they were never told. In every one of those moments, a training record stops being an administrative artefact and becomes evidence. And “we think we kept it” is not an answer anyone wants to give under that kind of scrutiny.
This is the part of a learning management system that nobody demos, because it is invisible right up until the day it is the only thing that matters. Lattice Learn treats training records the way a serious records system has to: as evidence that has to survive challenge, not just data that has to be stored.
An LMS is a records system whether you admit it or not
Every completion, every quiz result, every certificate, every auto-enrolment is a record about a person and what they were deemed competent to do. Under the Privacy Act and the Australian Privacy Principles, holding that information carries obligations — to keep it only as long as you have a reason to, to keep it accurate, and to let the person it concerns see and correct it. Under the model WHS laws, the same records are the thing you reach for when you need to show that a worker was trained for the task they were doing.
Most platforms treat this as someone else’s problem. Records accumulate in a table, nobody ever deletes anything because deleting feels risky, and the “retention policy” lives in a document that does not touch the system at all. That is not a records system. That is a pile.
Because Lattice Learn lives in the same schema as compliance rather than bolted on beside it, a completion is already a compliance input — it recalculates the live score, materialises a skills record, and can gate a high-risk task on site. Records that are wired that deeply into consequence have to be held to a higher standard than a course-tracking spreadsheet, because the system is making decisions off them in real time.
Retention you can set on purpose
Records should live exactly as long as they must, and then no longer. Keeping everything forever is not caution — it is a liability that grows every year, and it sits awkwardly against the principle that you do not hold personal information past the point you have a reason to.
Lattice Learn uses tiered retention schedules. Different classes of record carry different obligations: an accredited Statement of Attainment for an RTO tenant has a long, regulator-driven lifespan; a routine internal completion may not. You set the schedule per class, the system tracks each record against the schedule that governs it, and you can answer the question “how long do we hold this, and why” with a rule rather than a shrug.
The point of a schedule is not to delete more. It is to make the holding period a deliberate decision with a stated basis, so that whether a record is kept or disposed of, there is a reason on the record either way.
Disposal you can prove
Here is where most systems quietly fail. When a record reaches the end of its life, the typical implementation is a DELETE — a row vanishes, and there is no trace that it ever existed or that anyone decided it should go. From a defensibility standpoint that is the worst of both worlds: you have lost the record and you cannot show that losing it was lawful and deliberate.
Lattice Learn makes disposal a deliberate, provable action:
- It is a two-step action, not a single click. Disposal is initiated and then confirmed — it does not happen in one irreversible motion.
- There is a cooling-off window. Between the two steps, there is time to catch a mistake before anything is acted on. A disposal proposed in error can be stopped.
- It is signed. The person authorising the disposal is recorded against it. Disposal is an accountable act with a name attached.
- It is append-only. The disposal event is written to the ledger, not erased from it. You do not lose the fact that a disposal occurred just because the underlying record is gone.
The result is that you can always answer three questions: what was disposed of, when, and under which retention schedule. That is the difference between “the record is gone” — which sounds like spoliation — and “the record was disposed of on this date, under this schedule, authorised by this person, after a cooling-off window” — which is exactly what a defensible recordkeeping process looks like. The same append-only discipline runs through the certificate ledger: nothing can be backdated, and nothing important disappears without a trace of its disappearance.
A log of every automated decision
The harder problem in a modern LMS is not the records a human creates. It is the records the system creates on its own. When a mandatory rule authored at a peak-body level cascades down and auto-enrols a cohort by position, a person was enrolled in training and nobody pressed a button. When a quiz is auto-graded above the configured pass threshold, the system decided someone passed. When a competency expires and a licence is withdrawn at the pre-start gate, an automated process changed what a worker is allowed to do.
Each of those is a decision with a consequence, and “the algorithm did it” is not an explanation anyone can stand behind months later. So Lattice Learn keeps an automated-decisions log: every algorithmic outcome — auto-pass, auto-enrol, auto-expire, the route taken through a branching scenario — is recorded with the inputs that produced it. An automated outcome is therefore explainable after the fact. You can show why a person was enrolled, why an assessment was marked a pass, why a competency lapsed on the date it did. The automation stays fast and hands-off in the moment, without becoming a black box when someone asks it to account for itself.
This also feeds the other side of the obligation: the right of a learner to see and correct what is held about them. When data-subject requests are handled without a ticket queue, the record they are looking at is one the system can already explain.
Stored is not the same as defensible
Plenty of systems can store a training record. Far fewer can stand behind one. The gap between the two is retention you set on purpose, disposal you can prove, and a log that makes automated decisions explainable — the unglamorous machinery that turns a pile of data into evidence that holds up when it is challenged.
Australian-built and Australian-hosted, with Melbourne as the primary site and Sydney on standby, Lattice Learn keeps these records inside the same compliance platform that acts on them. You can see how the records layer fits the wider learning system on the Lattice Learn page, how it sits within the broader platform, and how we treat data and infrastructure on the trust centre.