3 seats free

Feature · Audit evidence

When the auditor asks,
the answer is one export away.

A PDF or CSV showing which people drilled on which procedures, sourced from which version of which document, on which dates, with which results. This page is what's in the export, how it lands in your hands, and the regulator framings it was designed against.

§ 01 · What the export contains

Per-person, per-skill, per-source-version, per-date.

An evidence pack is generated for a date range, a group (or set of groups), and a module (or set of modules). It contains a row for every drill answer in that scope. Each row carries: the learner's identifier, the module, the source document version, the source passage the drill came from, the question shape, the date and timestamp of the answer, and whether the answer was correct.

PDF audit pack

A narrative cover, a per-learner summary, and the per-drill detail table, formatted for handing across the table to an auditor. The version your compliance officer signs and submits.

CSV detail export

The same data, machine-readable. Drop it into your GRC tool, pivot it in Excel, or merge it with HRIS data. One row per drill answer, all fields included.

§ 02 · Why this shape is what regulators want

Completion records don't answer "did they actually learn it." This does.

A traditional LMS export shows: learner X completed course Y on date Z. A regulator follow-up question — "and how do you know they remembered any of it the next month?" — has no answer in that format. The HeyLoopy export answers the next-month question by design, because the drill is a retrieval attempt and the result is logged.

When the auditor asks "show me which staff were trained on the updated procedure within thirty days of the SOP change," the export filters to that date range and that source-document version, and the answer is in the table. The chain from a specific procedure in a specific document version to a specific learner answer on a specific date is traceable end to end. The named admin who approved that drill's wording is tracked separately inside the product (see drill quality control); a compliance-grade audit log of approvals is on the near-term roadmap and not exported today.

Admin · Course analytics The data behind the export. Per-module, per-group, per-skill, with trend over time.
heyloopy.com/admin/analytics
HeyLoopy course-analytics view: per-module performance over time, broken down by group and by skill, used as the source data for audit exports.
§ 03 · Regulatory framings the export was designed against

Not certification. Evidence shape that holds up under regulator review.

US financial · FFIEC, BSA/AML

The FFIEC examination manual sections on BSA training expect evidence that staff were trained on current typologies and that training is current. The export shows per-officer, per-typology, per-date, per-source-version: the exact shape examiners want to see.

US safety · OSHA recordkeeping

OSHA 29 CFR expects documentation of training content, dates, and who was trained. The export covers all three; the source-passage anchor adds the content provenance most internal-only training records skip.

US clinical · Joint Commission

Competency-assessment requirements expect evidence the clinical team can apply the procedure, not just acknowledge it. Drill answers against scenario-shaped questions provide a stronger artifact than completion certificates.

India · DPDP Act, Factories Act, NABH

The same evidence shape works for the Indian regulatory environment. The export does not impose a US-only schema; the auditor's specific format expectations are met by selecting fields in the CSV view or annotating the PDF cover.

UK · FCA, HSE, CQC

FCA operational-resilience expectations on staff competency, HSE training-records guidance, and CQC fundamental-standards expectations on staff training all read the same evidence shape comfortably.

EU · pending DPF/DPA work

EU customer onboarding requires DPA template and SCCs work in progress on our side. The audit export shape itself is compatible with GDPR Article 28 processor expectations; the contractual posture is what's pending. See trust and data residency.

§ 04 · How the export is generated

Pick a date range. Pick a scope. Download.

From the admin dashboard, an authorized administrator selects the date range, the modules or groups in scope, and the format (PDF audit pack, CSV detail, or both). The export generates and downloads. There is no waiting on a HeyLoopy support ticket. There is no spreadsheet hand-built off raw data. The artifact your auditor sees is the artifact the product produces directly.

For recurring audits, the same export can be scheduled (roadmap item) and routed to a fixed location. For ad-hoc regulator requests, generation is on demand. Compliance-grade controls on the export action itself (immutable retention, separation-of-duties enforcement) are roadmap; today the product tracks who generated the export and when.

§ 05 · What the export does not do

Honest scope.

Not a SOC 2 substitute

The export is evidence of training; it is not a substitute for your own SOC 2 controls. HeyLoopy aligns to SOC 2 Type II controls but is not yet independently certified. See trust and data residency.

Not a regulator-pre-approved format

No regulator pre-approves training-evidence formats. The shape and contents were designed to hold up under examiner review based on the framings above. We do not promise specific regulators have endorsed the export.

Not retroactive

The export covers drill activity since your team started using HeyLoopy. Prior training records from your previous LMS are not magically migrated; those stay where they were.

See what your audit pack would look like.

Free for teams up to 3 seats. Or email the founder for a sample audit pack PDF tailored to your regulator.