When an inspection, an accident or a dispute with a subcontractor occurs, the decisive question is rarely about the present. In most cases, what needs to be established is whether the company and its workers were compliant on a specific date. This is where document history for audits becomes essential, because it makes it possible to reconstruct the path of each document with evidence.
In this article, we explain how to use document history to respond to audits and inspections, what information should be available, how to prepare an evidence report and which mistakes undermine the evidential value of records.
The question every audit asks: Was it compliant on that date?
An audit is not limited to checking whether documents are valid today. Above all, the auditor wants to understand whether controls worked over time. For example, they may ask for proof that a worker held valid training on the day they carried out work at height, eight months ago.
Without reliable history, this question has no solid answer. Indeed, the current certificate may have been uploaded after the date in question. Likewise, insurance renewed today does not prove that the previous policy was in force when the work took place.
The value of history therefore lies in its ability to show the document status on a past date, and not just the latest version of each document.
What information document history should allow you to reconstruct
To be useful in an audit, the history must store more than files. Above all, it is the metadata for each event that gives the evidence context and credibility.
| Event | Evidence required | Why it matters |
|---|---|---|
| Upload | Date, time and user who submitted it | Proves the document existed before the work |
| Validation or rejection | Person responsible, date and reason | Shows that a technical review took place |
| Replacement | Previous version and new version | Prevents the loss of older evidence |
| End of validity | Expiry date and alerts sent | Shows that deadline control worked |
| Site access | Status of the company and the worker on that date | Links document compliance to actual operations |
In addition, the history must be immutable. In other words, no user should be able to change or delete past records, even with an administrator profile.
Situations where document history makes the difference
Document history for audits is useful in several contexts, each with different requirements:
- Workplace accident: the worker’s training, medical fitness and authorisations on the day of the accident must be proven.
- ACT labour inspection: the inspector may request evidence of subcontractor control over a previous period.
- ISO 45001 audit: the standard requires documented information to be retained as evidence of results.
- Client audit: many contracts provide for checks on contractor documentation for the full duration of the site works.
- Contractual dispute: the history shows when a document was requested, delivered, rejected or corrected.
In all these cases, the quality of the response depends on how quickly the company can gather consistent and complete evidence.
Practical example: Reconstructing compliance after an accident
Consider an industrial company where a subcontracted worker falls during a job on a roof. Two weeks later, the inspection authority requests evidence of three things: the worker’s work-at-height training, a valid medical fitness certificate and the subcontractor’s approval status.
In a company without a structured history, the safety team finds only the current version of the documents. Moreover, it discovers that the training certificate was replaced the day after the accident. Consequently, it cannot prove that a valid certificate existed before the job.
By contrast, in a company with a platform that records every version, the answer takes minutes. First, the team filters by worker and accident date. Next, it exports the document status on that day, with upload, validation and expiry dates. Finally, it adds the site access record. In this way, the company demonstrates that its controls were working.
How to prepare a document history report for an audit
A good evidence report should be clear, complete and easy to verify. To achieve this, we recommend following these steps:
- define the period, companies and workers covered by the request;
- export the document status on the date or period under review;
- include the versions of documents that were valid during that period;
- add the validation records, with the person responsible and the date;
- attach the expiry alerts sent and the responses received;
- cross-check the information with site access records, where available;
- review the file before submitting it, to ensure dates are consistent.
This way, the auditor receives organised evidence rather than a collection of loose files. It is also easier to answer follow-up questions without new searches.
Mistakes that undermine the evidential value of history
The most serious mistake is allowing documents to be replaced without keeping the previous version. In that case, the platform shows only the current status and the past is lost. Another frequent mistake is using shared accounts. When several technicians use the same login, it is no longer possible to know who validated each document.
It is also common to validate documents outside the platform, by email or phone, and record only the final result. However, this practice removes the evidence of the review. Finally, many companies do not define retention periods. As a result, they delete records too early or keep personal data for longer than necessary.
Who should be involved in managing document history
Managing history is not just a technical matter. It also involves several functions within the company, each with its own responsibilities.
- Management: approves the retention policy and ensures the necessary resources;
- Occupational health and safety: defines the mandatory documents and validates the technical evidence;
- Procurement and contracting: ensures that contractor agreements require documents to be delivered and kept up to date;
- Data protection: confirms that retention periods and access comply with the GDPR;
- Platform administrator: configures profiles, alerts and exports, without being able to change past records.
When these responsibilities are clear, the history no longer depends on one person’s memory. In addition, the company can maintain the same quality of response even when the team changes. Similarly, contractors understand the rules better and meet deadlines more consistently.
Finally, it is advisable to review the policy at least once a year, or whenever the platform, legislation or client requirements change.
Checklist: Is your document history ready for an audit?
- Are all document versions kept after each replacement?
- Does each action have an associated user, date and time?
- Are records immutable, even for administrators?
- Can the document status on a past date be viewed?
- Are rejection reasons recorded and visible?
- Can the history be exported in a format auditors can read?
- Are retention periods defined and approved?
- Is access to the history limited to authorised profiles?
If any answer is negative, it is worth correcting the platform configuration or internal policy before the next audit.
Frequently asked questions
What is the difference between document history and an archive?
An archive stores the final documents. History, on the other hand, records every event linked to each document, such as uploads, validations, rejections and replacements. That is why history is what makes it possible to reconstruct what happened on a specific date.
How long should the history be kept?
It depends on the legal, contractual and regulatory obligations that apply to each type of document. However, the period should be defined in writing and respect the GDPR principle of storage limitation for personal data.
Is a record exported from the platform accepted as evidence?
In general, yes, especially when the platform guarantees record integrity and identifies who performed each action. Even so, the final assessment always rests with the auditor or the authority reviewing the case.
Does document history for audits replace on-site checks?
No. History proves that document control worked. However, it should be complemented by evidence of supervision, such as inspections, safety observations and induction records.
Can contractors view their own history?
Yes, and this is recommended. When each contractor can see expiry dates, rejections and the reasons for them, they can fix problems faster. This reduces the number of requests for clarification and increases transparency in the relationship.
Conclusion: Document history for audits as proof of compliance
Document history for audits is what turns document management into concrete proof of compliance. When versions, validations and access are recorded immutably, the company can respond quickly and rigorously to inspections, audits and disputes.
It is therefore worth reviewing the platform configuration and internal policy today, rather than discovering the gaps on the day the evidence is requested.
Read also: Document history policy and The importance of contractor approval.
For information on occupational safety and health obligations, see the Portuguese Authority for Working Conditions (ACT).