How to build a GxP training matrix that holds up in an inspection

A GxP training matrix is a controlled record of which roles must be trained on which documents and competencies, by which method, and how often. To hold up in an inspection it has to do four things: derive every requirement from a defined role, point to the version of each document that is actually in force, stop people from performing a task before their training is complete, and let you prove all of this for any person on any past date within a few minutes. That last point is often harder than delivering the training itself.

This guide covers the regulatory basis, a practical matrix layout, how to handle SOP revisions, what inspectors ask for and when a spreadsheet stops being enough.

What the regulations require

No GMP regulation uses the word "matrix". The requirements are about trained, competent people and records that prove it. The matrix is simply the most common way to show that you meet them.

• EU GMP, Part I, Chapter 2 (Personnel). Training is required for everyone whose duties take them into production, storage or control laboratories, explicitly including technical, maintenance and cleaning staff, and for anyone else whose work could affect product quality (2.10). New staff need basic GMP training plus training for their assigned duties, continuing training must be given and its "practical effectiveness" periodically assessed, training programmes must be approved by the head of Production or Quality Control, and records must be kept (2.11). People working where contamination is a hazard need specific training (2.12).
• 21 CFR 211.25 (US drug CGMP). Each person must have the education, training and experience to perform their assigned functions. Training must cover the particular operations the employee performs and the CGMP rules and written procedures that relate to their job. It must be given by qualified individuals, on a continuing basis and often enough that employees stay familiar with the requirements.
• ISO 13485:2016, clause 6.2 (medical devices). The organisation must document its process for establishing competence, providing training and ensuring awareness. It must determine the competence needed, provide training, evaluate the effectiveness of what it did and keep records of education, training, skills and experience. A note to the clause says the effort spent checking effectiveness should be proportionate to the risk of the work. Since 2 February 2026 the FDA's Quality Management System Regulation incorporates ISO 13485 by reference; see our overview of the QMSR.
• EU Good Distribution Practice (2013/C 343/01), section 2.4. Wholesale staff must be trained on GDP and be competent "prior to commencing their tasks". Training is initial and continuing, based on written procedures and a written programme. It must cover recognising falsified medicines, plus specific training for products with stricter handling conditions such as temperature-sensitive goods. All training must be recorded, and its effectiveness periodically assessed and documented.

Read together, these give you the design requirements: role-based scope, a written programme, initial and continuing training, effectiveness checks and complete records.

The structure: roles across, requirements down

A matrix that holds up is built from roles, not from names. If you assign training person by person, every new hire and every reorganisation becomes a manual reconciliation exercise, and gaps creep in.

A practical layout, whether in a spreadsheet or a system, has five parts:

1. Role catalogue. One entry per job role with a short description: for example production operator, QC analyst, warehouse operative, maintenance technician, QA officer. Keep roles at the level of real work, not job titles from HR.
2. Requirement catalogue. One entry per thing someone can be trained on: each controlled document (SOP, work instruction, form), general modules such as GMP induction and data integrity, and practical competencies such as aseptic gowning or operating a specific machine. For each requirement record the ID, title, current effective version, effective date, training method, assessment method, refresher interval and owner.
3. Role-to-requirement assignments. For each role, which requirements apply and by which method. This is the grid in the illustration above.
4. Person-to-role assignments. Each person holds one or more roles, with start dates. A person's training needs are the union of their roles' requirements, plus any individual additions such as a supervisor qualification.
5. Status per person per requirement. Current, due, overdue or not required, each with the completion date and the version trained on.

Keep the requirement catalogue linked to your document control system so that a revision automatically shows up in the matrix. If your document list and your training list are maintained separately, they will drift. Our guide to writing GMP SOPs covers how to scope procedures so they map cleanly onto roles.

Read-and-understand versus practical, assessed training

Not every requirement deserves the same method. The regulations ask for training that actually produces competence, and ISO 13485 makes the risk link explicit. A workable approach is to choose the method by what goes wrong if the person gets it wrong:

• Read and understand. The trainee reads the document and confirms they understood it. Suitable for informational procedures, low-risk administrative tasks and minor revisions. On its own it proves only that someone opened a document, so do not use it for tasks where an error reaches the product.
• Read and understand with a quiz. Adds a short assessment with a pass mark. A good default for GMP principles, data integrity and procedures people must understand but do not perform by hand.
• Instructor-led training. Classroom or virtual sessions for concepts that need discussion, such as investigations or batch record review. Record attendance and assess understanding.
• On-the-job training with observed performance. A qualified trainer demonstrates the task, the trainee performs it under supervision, and the trainer signs off that the trainee can do it alone. Required in practice for manufacturing, testing, cleaning and equipment operation.
• Qualification. A formal, repeatable assessment such as gowning qualification for clean areas or analyst qualification on a method. Often has a fixed expiry.

Record the method in the requirement catalogue, not on each training record, so that the method is decided once and applied consistently.

Initial, refresher and event-driven training

Training needs arise from three sources, and your matrix should handle all three:

• Initial training. GMP induction plus all requirements of the person's roles. EU GMP and GDP both expect this before people work independently.
• Continuing or refresher training. 21 CFR 211.25 requires CGMP training "on a continuing basis", and EU GMP and GDP both require continuing training. The regulations do not fix an interval. Many companies run an annual GMP refresher and set risk-based intervals for critical practical tasks; whatever you choose, write it down in the training programme and apply it.
• Event-driven training. A new or revised document, a role change, new equipment, a return from long absence, or a deviation or CAPA that identifies a training gap.

Retraining when an SOP revision becomes effective

This is where most matrices break. The safe pattern separates the approval date of a document from its effective date and uses the period in between for training.

1. Classify the revision when it is drafted. An editorial change (typo, formatting) may need no retraining. A minor change may need read and understand. A change to how a task is performed needs the same method as initial training, often on-the-job.
2. Approve the document, then open training. When the new version is approved, the matrix should show every person in an affected role as "due" on the new version.
3. Check completion before the effective date. If key people have not completed training, either move the effective date or restrict the task to those who have.
4. Make the version effective. From that date the old version is withdrawn, and records show who was trained on which version.

Illustrative example: SOP-PRD-014 version 6 adds a second-person check to line clearance. It is approved on 3 March with an effective date of 17 March. All production operators and shift supervisors are assigned on-the-job training on the new step. On 14 March, two operators who are on leave have not yet completed it, so the shift planner keeps them off line clearance duties until they are trained. The training record for each operator shows version 6 and a completion date before 17 March, or a restriction in place.

Revisions usually come from change control, so link the change record to the training it triggers. Our article on change control traceability covers that chain.

Training before performing a task

GDP says it outright: staff must be competent "prior to commencing their tasks". The GMP texts say the same in substance, since training must enable a person to perform their assigned functions. The practical controls are:

• Supervisors and planners check training status before assigning people to tasks or shifts.
• Where systems allow it, the person's training status is checked when they sign for a step.
• Batch record review includes a check that signatories were trained on the version in force on the day.
• Trainees who are still under supervision sign together with their trainer.

A classic finding is an operator who signed a batch record for a step on a date before their training on that procedure was complete. It is easy to spot when an inspector compares two dates.

Proving that training is effective

EU GMP asks for the "practical effectiveness" of training to be assessed, GDP for effectiveness to be assessed and documented, and ISO 13485 for the effectiveness of actions to be evaluated. A signature sheet does not do this. Useful evidence includes:

• Assessment results: quiz scores, observed-performance sign-offs and qualification outcomes.
• Trends in deviations where the root cause points to a procedure being misunderstood or not followed.
• Supervisor observations and internal audit sampling of people doing the job.
• A periodic review of the training programme itself, recorded in management review.

Be cautious with "retrain the operator" as the default corrective action. If the procedure is unclear or the task design invites error, retraining will not prevent recurrence. Our guide to CAPA effectiveness checks explains how to test whether a fix worked.

Training records that meet ALCOA+

Training records are GMP records, so the data integrity principles in the PIC/S guidance PI 041-1 apply to them as to any batch record: attributable, legible, contemporaneous, original and accurate, plus complete, consistent, enduring and available. For a training record that means:

• The trainee is identified uniquely, by name and a personal ID or user account.
• The record names the document ID and the exact version, not just the title.
• It states the method, the assessment result and, for practical training, the trainer.
• It is dated and signed when the training happens, not filled in later in a batch.
• Corrections are traceable, and electronic records keep an audit trail.
• It is retained and retrievable at least as long as the batch records it supports.

For more on applying these principles, see our article on ALCOA+ and data integrity.

What inspectors ask for

Inspectors rarely ask to see your matrix in the abstract. They start from a real event and work backwards. Expect requests like these:

• "Show me the training record for the operator who performed this step on batch X." You need the person, their role on that date, the procedure version in force on that date and a completion record dated before the batch.
• "Who trained this person, and how do you know the trainer was qualified?" 21 CFR 211.25 requires training by qualified individuals.
• "Where is the training programme, and who approved it?" EU GMP 2.11 expects approval by the head of Production or QC.
• "This SOP was revised last month. How many affected people were trained before it became effective?"
• "Show me the training records for your cleaning and maintenance staff, including contractors." EU GMP Chapter 2 names cleaning and maintenance personnel explicitly.
• "How do you assess whether training is effective?"
• "What is overdue today, and what are you doing about it?"

The common thread is reconstruction at a point in time. A matrix that only shows today's status cannot answer the first question.

Where spreadsheets stop working

A spreadsheet is a reasonable starting point for a small team. It becomes risky as the numbers grow: 40 people and 150 controlled documents already gives 6,000 person-document combinations to keep correct by hand. Typical failure points are:

• The document list is copied from document control and goes out of date as soon as a revision is approved.
• A person holding two roles is counted once, and requirements from the second role are missed.
• Historical status is overwritten, so you cannot show what was current on a past date.
• There is no audit trail of who changed a status, and several copies circulate by email.
• Reminders and overdue tracking depend on one person remembering to filter a column.

If two or more of these sound familiar, it is time to move the matrix into a validated system linked to document control.

Checklist: an inspection-ready training matrix

• Every role is defined, and every person is assigned to roles with start dates.
• Every requirement points to the current effective version of its document.
• The training method and refresher interval are set per requirement and justified by risk.
• Practical tasks require observed performance signed off by a qualified trainer.
• Revisions trigger retraining before the effective date, and late completions lead to task restrictions.
• Contractors, cleaning and maintenance staff are in scope.
• Effectiveness is assessed and reviewed, not assumed.
• Records name the version, method, result, trainer and date, and have an audit trail.
• You can produce any person's training status for any past date within minutes.
• The training programme is written down and approved.

Running this in an eQMS

Training management is easier to keep honest when it lives next to document control. In QFacts, training is assigned automatically when documents are published or roles change. Quizzes can carry a passing score, and each completion creates a timestamped, signed record. You can generate training matrices and individual training histories on demand, and document management keeps the full version history of each procedure. You can try it on your own procedures with the 14-day free trial on the pricing page.