COR Audit Training Records Ontario: What COR Auditors Actually Check

If you bid public construction in Ontario, sooner or later a buyer makes COR® (Certificate of Recognition) a condition of the tender. This is a working owner's guide to COR audit training records Ontario buyers expect to see: how the COR® 2020 audit is structured, which construction buyers gate their work behind it, what an auditor is actually looking for, and why the attendance sheet — the record most contractors reach for first — is the weakest exhibit in the binder. The training element is often where preparation pays off most — and where thin records tend to show up first.

What COR® is, and who runs it in Ontario

COR® certifies that your company operates a functioning occupational health and safety management system (OHSMS) — that you systematically identify hazards, train workers, inspect the work, investigate incidents, and audit yourselves. It is not a claim about your injury count. It is a claim about your system.

In Ontario, COR® is administered by the Infrastructure Health & Safety Association (IHSA), which describes itself as the "Authority having Jurisdiction" to grant COR® in the province. The COR® standard is nationally trademarked and endorsed through the Canadian Federation of Construction Safety Associations (CFCSA), so the standard itself is recognized nationally through CFCSA members. The full path to certification — what COR gets you, what it takes, and which buyers gate on it — is its own subject; this article is about one thing: what the audit does with your records.

The COR® 2020 audit has 14 elements

The current standard is COR® 2020. It contains 14 elements, and your audit scores every one of them:

1. Health and Safety Policy
2. Hazard Assessment, Analysis and Control
3. Controls
4. Procurement and Contractor Management
5. Company Rules
6. Personal Protective Equipment
7. Preventative Maintenance
8. Training and Communication
9. Workplace Inspections
10. Investigations and Reporting
11. Emergency Preparedness
12. Statistics and Records
13. Legislation and Other Requirements
14. Management Review and Management of Change

You'll see older write-ups reference different counts — the pre-2020 tool was structured differently, and some blogs still quote it. The authoritative number for the current standard is 14, straight from the IHSA COR® 2020 Standard. Element 8, Training and Communication, is the one this article circles back to, because it asks a question a stack of attendance sheets can't answer.

Which Ontario construction buyers require COR® — or an equivalent OHSMS certificate

On gated Ontario public work, holding COR® — or an accepted OHSMS equivalent like MLITSD's Supporting Ontario Safe Employers (SOSE) program or ISO 45001 — has moved from nice-to-have to table-stakes. Major construction buyers that require it, or are phasing it in, to bid include:

• City of Toronto — an OHSMS certificate on all construction contracts regardless of value, effective March 31, 2025.
• City of Ottawa — an OHSMS certification requirement, phased in down to small contracts as of 2026.
• Metrolinx — COR® for general contractors regardless of project value; vendors without the required status at bid submission are disqualified.
• Infrastructure Ontario — COR® as a pre-qualification requirement on major projects.
• Toronto Transit Commission (TTC) — COR® for construction contracts regardless of value.
• Region of York — OHSMS certification for general contractors on publicly tendered construction.
• City of Brampton — COR® for construction projects over $5 million (as of January 2026).
• The Greater Toronto Airport Authority (GTAA), a not-for-profit airport authority, is also among the buyers that have requested COR®.

Verify the current requirement and thresholds against each buyer's own procurement page before you rely on it — thresholds, phase-in dates, and accepted certifications change, and a named buyer in an old announcement is not a clause in today's tender.

The audit checks ongoing activity, not a one-time binder

Here is the mechanic that catches contractors off guard. The COR® audit is not satisfied by a well-drafted manual. IHSA's program guideline is explicit: the evidence you submit "must have been created within the 12-month period prior to the audit submission date." Records from the previous year are what prove your program is actually running.

That single rule reframes the whole exercise. A policy you wrote three years ago and never touched doesn't prove your program is implemented on audit day. What proves your system operates is a rolling stream of dated, recurring records from the last twelve months: inspections done, toolbox talks held, incidents investigated, training delivered and evaluated. This is the same documents-versus-records distinction that decides WSIB validations — a document states what you intend to do, a record proves you did it — and it applies with equal force here. (We walk that distinction through a full worked example in the WSIB evidence story.)

You cannot backfill twelve months of operating evidence the week before an audit. That's why the calendar, not the consultant, is usually the critical path to certification.

Internal audit, external audit, and the three-year cycle

COR® runs on a fixed rhythm you should budget for:

• Year 1 — initial internal audit, then external audit. Your OHSMS has to be in place for at least one year before you begin. Your own trained internal auditor first completes an initial internal audit, which IHSA reviews; once you clear the benchmark, a qualified third-party external auditor conducts the external audit against the COR® 2020 standard. Pass, and IHSA issues your Certificate of Recognition.
• Years 2 and 3 — internal maintenance audits. Your trained internal auditor conducts a self-audit each year, and the results are reviewed by IHSA. A Letter of Good Standing, issued in years 2 and 3, confirms you're maintaining the system.
• Recertification. Certification is valid for three years, so you return to an external audit to recertify — and for recertification you again complete an internal audit and provide it to the external auditor to validate that it was done.

Every audit in that cycle — internal or external — reaches back into the same trailing-12-month evidence. The system never gets to go quiet.

Why attendance proves delivery, not learning

Now to element 8. The COR® 2020 training procedure requires you to identify "competencies for each task" and includes, in plain text, "evaluation of learning." The communication requirements ask that communication be "delivered in a manner that is understood by the receiver of the message," accounting for ability, language skills, and literacy — and the communication procedure has to cover the everyday forms: attendance sheets, agendas, meeting minutes, and toolbox-talk records.

So attendance has a real job in the file. An attendance sheet is valid supporting evidence that a briefing was delivered and communicated — the audit tool expressly asks for those forms. What it can't do is answer the separate question the standard also asks: did the organization evaluate learning the way its procedure says it will? A sign-in sheet proves presence. A training certificate proves a course was completed on a date. A training matrix proves you tracked who was assigned what. Each is a delivery record — none is, on its own, an evaluation of learning.

That distinction is exactly what the audit tool tests. "Does the organization evaluate learning as per the procedure?" is a documentation question the auditor scores in its own right — separate from the questions about whether training was delivered. Evidence that answers it looks like assessments tied to the training, demonstrated competency, or follow-up checks — per your own procedure, dated and reviewable. Delivery evidence you almost certainly have; the evaluation-of-learning piece is the one worth building deliberately. The gap between attendance and understanding is the whole subject of why sign-in sheets don't prove comprehension.

Where a daily comprehension record fits

A documented evaluation-of-learning procedure needs evidence that you actually follow it — and that evidence is hard to reconstruct before an audit, easy to have if your everyday workflow produces it.

That's where Dashpot helps. Each morning, the Job Safety Plan your crew already fills out triggers a short per-worker check on that day's hazards — producing a per-worker, per-hazard record of verified comprehension that's dated and exportable. That can serve as dated evidence supporting your documented learning-evaluation procedure — subject, like any evidence, to the auditor's assessment against that procedure. Because it runs every day, it also builds up the ongoing, within-12-month record COR® audits reach for, and because it's tied to real work, it speaks to the "understood by the receiver" language rather than attendance alone.

To be clear about the boundary: Dashpot can produce dated records that support an organization's learning-evaluation process. It doesn't determine COR® conformity, it isn't a substitute for legislated training, and your OHSMS build and written procedures still come from you and your consultant. It complements your toolbox talks rather than replacing them.

Frequently asked questions

How many elements are in the COR® 2020 audit?

The COR® 2020 standard, administered in Ontario by IHSA, contains 14 elements: Health and Safety Policy; Hazard Assessment, Analysis and Control; Controls; Procurement and Contractor Management; Company Rules; Personal Protective Equipment; Preventative Maintenance; Training and Communication; Workplace Inspections; Investigations and Reporting; Emergency Preparedness; Statistics and Records; Legislation and Other Requirements; and Management Review and Management of Change. Older articles sometimes quote a different count from the pre-2020 tool, but 14 is the number in the current standard.

Which Ontario construction buyers require COR® certification to bid?

Metrolinx requires COR® certification for general contractors on its projects regardless of value, and disqualifies vendors who lack the required status at bid submission. Infrastructure Ontario made COR® a pre-qualification requirement for major AFP projects in 2016 and phased it into Direct Delivery real estate projects over $10 million. The City of Toronto has since moved beyond COR® specifically: as of March 31, 2025 it requires an occupational health and safety management system (OHSMS) certificate on all construction contracts regardless of value, accepting COR® 2020, the MLITSD Supporting Ontario Safe Employers (SOSE) program, or ISO 45001:2018. The City of Ottawa is phasing in a similar OHSMS requirement, and buyers such as Region of York, City of Brampton, the TTC, and the GTAA have adopted or requested COR/OHSMS as well. Confirm the current requirement on each owner's own procurement page, because thresholds and accepted certifications change.

How often do you need a COR® audit?

COR® certification is valid for three years. You earn it through an external audit conducted by a certified external auditor in year 1, maintain it with internal maintenance (self) audits in years 2 and 3 — each reviewed by IHSA, which issues a Letter of Good Standing — and then recertify through another external audit. Every audit in the cycle relies on records created within the 12-month period before the audit submission date.

Do attendance sheets count as COR® training records?

Yes — as evidence of delivery and communication. The COR® 2020 communication procedure expressly calls for forms recording attendance, agendas, meeting minutes, and toolbox talks, so an attendance sheet is valid supporting evidence that a briefing happened. What it doesn't do is answer the separate audit question — "does the organization evaluate learning as per the procedure?" — which checks that you actually run the learning evaluation your procedure specifies, not just that workers were present. You need both: attendance for delivery, and evaluation-of-learning evidence for the training element's effectiveness question.

Can you prepare for a COR® audit at the last minute?

Not for the parts that matter. IHSA requires audit evidence to have been created within the 12 months before submission, so operating records — inspections, toolbox talks, investigations, and evaluated training — have to accumulate as you work. Written policies can be drafted quickly, but the dated, recurring records that prove the system runs cannot be backfilled. That is why the training-effectiveness evidence, which takes the longest to build, is the smart place to start first.

---

Dashpot Safety complements legislated certification training such as Working at Heights and WHMIS — it never replaces it. Nothing here is legal advice.

Sources: IHSA COR® 2020 Standard (the 14 elements; the Training and Communication element, its "evaluation of learning" and competency requirements, and the "understood by the receiver" communication language), COR® 2020 Program Guideline (OHSMS in place at least one year before the initial internal audit, three-year validity, internal maintenance audits in years 2 and 3, Letter of Good Standing, the recertification internal audit provided to the external auditor, and the 12-month evidence window), and the COR® 2020 Audit Tool ("Does the organization evaluate learning as per the procedure?" scored as a two-point documentation question, and the communication procedure's attendance/agenda/minutes/toolbox-talk forms); the City of Toronto OHSMS certificate requirement (effective March 31, 2025 — COR® 2020, MLITSD SOSE, or ISO 45001:2018, all construction contracts, subcontractors exempt) with the earlier City of Toronto COR™ communiqué as historical context; Metrolinx COR Implementation; and Infrastructure Ontario; the Toronto Transit Commission (COR® for construction contracts regardless of value), Region of York (OHSMS for general contractors), City of Brampton (COR® for projects over $5 million as of January 2026), and the City of Ottawa (a phased OHSMS certification requirement) — confirm current thresholds on each buyer's procurement portal. Verified July 2026 — confirm current buyer requirements and program details with IHSA and each buyer.