Safety audits: how traceable video legally protects both the company and the HR Manager

In a workplace safety audit, training you can't prove is training that doesn't exist. Video with digital traceability turns every training session into verifiable legal evidence.

There's a question every HR or health and safety manager should ask themselves before an auditor walks in: can I prove, right now, that every worker received role-specific training, completed it, and understood it?

We're not talking about whether training happened. We're talking about whether you can prove it. Because in a labor inspection or regulatory audit, the burden of proof falls on the company. And what most people don't realize is that this responsibility can be personal: the HR director or safety officer with delegated functions answers with their own name, not just the company's.

In this article, we break down what a workplace safety audit requires in Spain, why traditional record-keeping methods fail when it matters most, and how video-based training with digital traceability creates a layer of legal protection for both the organization and the person managing prevention.

What a workplace safety audit requires (and what evidence it accepts)

Article 19 of Spain's Occupational Risk Prevention Act (LPRL) requires employers to ensure every worker receives theoretical and practical training that is sufficient and appropriate for their role. Not just any training: it must be role-specific, delivered at the time of hiring, and updated whenever job functions or equipment change.

Article 23 of the same law goes further: it requires the company to document and preserve those records for the labor authority. Without documentation, the training never happened as far as the law is concerned.

Royal Decree 39/1997 regulates mandatory safety audits. For companies performing high-risk activities (those listed in Annex I), audits repeat every two years. For the rest, every four years. The auditor doesn't just check paperwork: they verify on-site that documentation reflects actual preventive practice, including whether workers received training adapted to their specific role.¹

And this is where the data reveals a systemic problem. According to the ESENER survey and analysis by Spain's National Institute for Occupational Safety and Health (INSST), 32% of Spanish companies deliver generic training not tailored to the job role. 79.8% provide theory-only training with no practical component.² Both situations violate the legal requirement of "sufficient and appropriate" training.

For an auditor, the question isn't just "did you train?" but "did you train well, the right person, at the right time, and can you prove it?".

The HR Manager's personal liability: beyond the company

When we talk about workplace safety violations, the natural assumption is that penalties land on the company. But the Spanish Criminal Code contemplates individual liability for whoever manages prevention.

Articles 316 and 317 of the Criminal Code establish that those legally obligated who fail to provide the necessary means for workers to perform their duties with adequate safety measures can face criminal consequences. And an accident doesn't need to happen: creating serious risk to a worker's life or physical integrity is enough.

Article 318 extends this liability to executives and managers acting on behalf of the legal entity. If the HR director holds delegated executive functions in occupational safety (and in practice, many do), they can be held criminally liable in three scenarios: when the employer delegated the safety function to them, when they act as "service manager" under Article 318, or when the failure to implement preventive measures is directly linked to their responsibilities.³

This isn't theoretical. In 2025, Spain's Supreme Court convicted a safety technician (ruling STS 563/2025) for failing to adapt a generic risk assessment from an external prevention service to the actual conditions of a workplace. The court emphasized that the offense under Article 316 is not limited to the employer.⁴

Another relevant case: the Superior Court of the Canary Islands ruled against a company for the total disability of a French worker who didn't understand Spanish. The safety manual was exclusively in Spanish. The court attributed negligence to the failure to provide training in a language the worker could understand.⁵

These liabilities are also cumulative. A single violation can trigger administrative sanctions (fines up to 983,736 euros under the LISOS), civil liability (compensation plus a 30-50% surcharge on benefits), criminal liability (imprisonment and disqualification), and disciplinary liability within the employment relationship.⁶ For a deeper look at penalty structures and the full sanctioning framework, check our article on the legal cost of not training.

Why sign-off sheets won't protect you in an audit

The most common method for documenting safety training is still the attendance sign-off sheet. The problem is clear: a signature proves physical presence, not comprehension or retention of the content.

A worker can sign without having paid attention. They can sign off on a generic session that didn't cover the specific risks of their role. And worse: that sheet can get lost, damaged, or left incomplete. What goes unrecorded, as far as the law is concerned, might as well never have happened.

Paper-based documentation carries other operational problems. Preparing for an audit with physical records can take two to three weeks: tracking down scattered sign-off sheets, consolidating attendance data, verifying every worker is covered, locating the correct version of the training content delivered.

When subcontractors are involved, the problem multiplies. Managing Business Activity Coordination (CAE) through email threads and spreadsheets becomes what many safety managers describe as a black hole of administrative hours.⁷

And the broader context doesn't help: 49% of prevention plans in Spain are generic documents not adapted to the actual company. 17% of companies, twenty-five years after the LPRL was enacted, have no preventive organization whatsoever.² If your evidence system relies on paper and good intentions, the question isn't whether you'll have a problem at the next audit, but when.

If you want to evaluate your readiness for an ISO 45001 audit, we recommend reviewing our digital audit checklist.

Traceable video: what it is and why it works as legal evidence

Traceable video refers to video-based training with an integrated automatic tracking system. Every playback is recorded: who watched the content, when, for how long, whether they completed it, and when assessments are included, whether they demonstrated understanding.

This traceability addresses the core gaps in traditional record-keeping:

Automatic, immutable evidence. Playback and completion timestamps are generated automatically, without relying on manual signatures. They don't get lost, they don't deteriorate, and they're independently verifiable by an auditor.

Proof of understanding, not just attendance. Embedding quizzes or assessments within the video itself proves the worker didn't just watch the content but absorbed the key concepts. This goes beyond what a sign-off sheet can credential.

Role-specific training. Video-based knowledge infrastructure enables creating modules tailored to each role, shift, or location, meeting the LPRL Article 19 requirement of "sufficient and appropriate" training. Tools like Vidext automate this process, enabling teams to generate and assign modular content without repeating entire in-person sessions.

Automatic multilingual coverage. The Canary Islands court case showed that training in a language the worker doesn't understand is equivalent to no training at all. Automatic translation into 40+ languages eliminates this risk at its root, especially in sectors like manufacturing or logistics where the workforce is diverse.

Audit-ready reports in minutes. When an auditor arrives, the safety manager doesn't dig through folders or consolidate spreadsheets: they filter by period, department, or worker, export the report, and present it. Audit preparation goes from weeks to minutes.

These capabilities align with what we call knowledge infrastructure: not a video tool, but a system that keeps training alive, current, and legally traceable.

What changes for the company and the HR Manager with digital traceability

The difference between managing training with traditional records and doing it with digital traceability comes down to this:

Aspect	Traditional records	Video with traceability
Attendance evidence	Sign-off sheet (paper)	Automatic playback logging
Comprehension evidence	None	Integrated assessments with results
Role customization	Generic sessions	Modules specific to role and location
Multilingual coverage	Manual or nonexistent	Automatic translation (40+ languages)
Audit preparation time	2-3 weeks	Minutes (filter and export)
Content updates	Repeat entire in-person session	Edit module and redistribute
Risk of document loss	High (paper, emails, Excel)	None (immutable digital records)

For the HR or safety manager, the shift is substantial. They go from collecting signatures and managing spreadsheets to having a system that generates evidence continuously. Every video watched, every assessment completed, every module assigned is logged with date and authorship. That doesn't just make audits easier: it constitutes evidence of due diligence.

And due diligence is exactly what a judge evaluates when personal liability is on the table. If you can demonstrate that you designed a role-specific training program, distributed it to all workers, confirmed completion, and updated it when regulations changed, you're in a radically different position than someone presenting generic sign-off sheets.

Training is no longer a box to check once a year. With digital traceability, it becomes a continuous state of compliance that protects both the company and the people who manage it.

Conclusion: the audit starts before the auditor arrives

Most companies think of an audit as a one-time event they need to prepare for. But the reality is that preparation should be a continuous state. Every time a worker joins, changes roles, or a procedure gets updated, the company needs to generate evidence that training kept pace with the change.

Video with digital traceability isn't just a more efficient way to train. It's a legal protection layer that works quietly, generating immutable records with every playback, every assessment, and every update. For the HR Manager with delegated safety functions, that can make the difference between responding with a report exported in five minutes or responding before a judge with a folder of incomplete sign-off sheets.

The question is no longer whether you can afford to implement traceability in your training. It's whether you can afford not to.

Frequently asked questions

What records does a workplace safety audit require in Spain?

The LPRL (Article 23) requires companies to maintain the prevention plan, risk assessment, preventive activity planning, and records of training and information provided to workers. The auditor verifies that these documents reflect the company's actual preventive reality, not just that they exist on paper.

Can an HR Manager face criminal charges for insufficient safety training?

Yes. Articles 316-318 of the Spanish Criminal Code allow criminal liability for anyone with delegated executive functions in occupational safety, including HR directors. An accident doesn't need to occur: creating serious risk to a worker's life or physical integrity is sufficient.

Are sign-off sheets enough as evidence in an audit?

A sign-off sheet proves physical presence but doesn't demonstrate that the worker understood the content or that the training was specific to their role. In rigorous audits, this limitation can generate non-conformities or reveal non-compliance with Article 19 of the LPRL.

What advantages does traceable video have over in-person training for audits?

Video with traceability generates automatic records of who watched what content, when, and whether they completed it. It allows embedding assessments that prove comprehension, delivers role-specific training, and exports compliance reports in minutes, compared to the weeks it can take to prepare an audit with paper records.

How often are mandatory safety audits conducted in Spain?

According to Royal Decree 39/1997, every four years for most companies. For those performing high-risk activities (listed in Annex I), every two years. The first audit must be conducted within twelve months of having the preventive planning in place.