For a CPE audit, keep three things for every activity you claim: proof of completion with your name, the activity, the date and the hours; an agenda or outline of what it covered; and a note of how you worked out the credits. Keep them for the longest period any of your certifying bodies sets. For ISC2 that is at least 12 months past the end of your current cycle. For ISACA it is at least three years under its CPE Policy.
ISC2, ISACA and CompTIA all audit at random. EC-Council’s policy only says to keep evidence. Below is what each body’s own pages said when we checked them on November 1, 2026, then a checklist that covers all four.
What each certifying body asks for
ISC2
ISC2’s Certification Maintenance Handbook (PDF) says it audits submitted CPE activities at random. If you are selected, you get an email with instructions, unless you already provided the documents when you submitted. You then have 90 days to respond with the required information. Accepted proof includes course transcripts, diplomas, certificates or receipts of attendance, research or prep notes for speaking or teaching, official meeting minutes, and registration rosters or materials.
For books and magazines, keep proof of possession: the book itself, a receipt, an invoice or a library record. It should show the title and, for a book, the author and ISBN. For education activities without proof of completion, ISC2 accepts a description of no more than 250 words on what you learned, plus a certificate or letter of attendance.
ISC2 advises keeping proof for at least 12 months beyond the end of your current cycle. It also recommends uploading it to the Supporting Documentation section of the CPE portal when you submit.
ISACA
ISACA’s CPE Policy (PDF) says it selects a random sample of certification holders for audit each year, and the notification email lists the activities included. Its maintain certification pages say the documentation covers a specific calendar year. Each record should include your name, the sponsoring organization, the activity title, a description, the date and the CPE hours. Acceptable forms are a letter, a certificate of completion, an attendance roster, a Verification of Attendance form or another independent attestation of completion.
ISACA gives two retention periods. The CPE Policy says a minimum of three years. The maintain pages say 12 months after the end of each three-year cycle. Keep whichever is longer for you. If you don’t comply with an audit, ISACA revokes the certification.
CompTIA
CompTIA’s CE FAQ says submitted CEUs are accepted automatically and audits are performed at random. Its Training and Higher Education page lists the documents for each activity: a detailed outline of the content, plus a completion certificate showing your name, the activity, the date and the hours. For webinars and conference sessions, a registration email can stand in for the certificate. College courses need a transcript. Work experience needs a letter on company letterhead signed by your supervisor. Work orders, work performance reports and resumes are not valid.
EC-Council
EC-Council’s CPE Policy has a short Audit Requirements section: certified members must keep sufficient evidence of their involvement in each activity that earns credits. It doesn’t list document types, describe the audit process or set a retention period. Use the stricter rules above.
The rules side by side
| Certifying body | Audit | Keep records |
|---|---|---|
| ISC2 | Random; respond within 90 days | At least 12 months beyond the end of the current cycle (advised) |
| ISACA | Random sample each year; the email lists the activities audited | At least three years (CPE Policy) or 12 months after the cycle ends (maintain pages) |
| CompTIA | Random, after automatic acceptance | No period stated on the pages checked |
| EC-Council | No process described; keep sufficient evidence | No period stated |
Per-activity checklist
Save these the week you finish the activity, not the week the audit email arrives:
- Proof of completion: certificate, transcript or attendance letter with your name, the activity title, the provider, the date and the hours.
- Agenda or outline: the session list or course outline. CompTIA asks for one with every training, webinar, conference and college activity.
- Registration or receipt: the confirmation email or invoice.
- Your hours worked out: educational time only, with breaks and lunch removed. ISACA counts 50 minutes as one CPE hour. ISC2 typically gives one CPE credit per hour.
- Your description: two or three lines on what you learned, matching what you entered in the portal.
- Where you claimed it: each certification, the category or group, and the credits.
- Submission screenshot: what the portal showed when you submitted.
- For books: proof of possession with the title, author and ISBN.
Use a file name that sorts by date, so a whole year comes together in one place: 2026-03-14_provider_activity-title_certificate.pdf. ISACA recommends storing CPE documentation on a personal drive. That is sound advice for any body, since you can lose access to an employer’s systems when you change jobs.
If the audit email arrives
- Note the deadline. ISC2 gives 90 days.
- List the activities or the year the audit covers.
- Pull the proof for each one. Fill any gap with what the body accepts, such as ISC2’s 250-word description plus a letter of attendance for an education activity.
- Answer in the format the body asks for, and keep a copy of what you sent.
Keeping proof with the claim in MyCertRenewal
In MyCertRenewal, each activity has an audit package. You choose a Document type such as Certificate, Agenda, Registration, Transcript or Submission screenshot, and the checklist ticks off each type as you add it. Certificate, Agenda and Registration are the core documents (Add evidence: the audit package). For a whole cycle, Submission & audit package on the cycle page prints to PDF, and Download evidence (ZIP) gives you every file in a folder per claim, plus a claims.csv. Files you attach to an activity also show up in the Evidence Vault.
None of this changes what a certifying body accepts. It keeps your proof findable. More on the approach on our audit-ready evidence page, and if one activity supports several certifications, see how one activity can count toward multiple certifications.
If your proof currently lives in an inbox and a downloads folder, Start free and attach it to the activity it supports. Free covers one person and up to 2 certifications.
Frequently asked questions
How long should I keep CPE records?
ISC2 advises at least 12 months beyond the end of your current certification cycle. ISACA’s CPE Policy says at least three years, and its maintain certification pages say 12 months after the end of each three-year cycle. CompTIA and EC-Council don’t state a period on the pages we checked. Keep records for the longest period that applies to you.
What happens if I am selected for an ISC2 CPE audit?
You get an email with instructions, unless you already uploaded the documents when you submitted. You must respond with the required information within 90 days, which may mean proof of attendance or a brief description of the activity.
Does CompTIA audit CEUs?
Yes. CompTIA says submitted CEUs are accepted automatically and audits are performed at random. Keep the outline, the certificate or registration email, and the hours for every activity.
What should a CPE certificate show?
At a minimum: your name, the activity title, the provider or sponsoring organization, the date and the hours. ISACA also asks for an activity description.
What if I lost the certificate for an ISC2 activity?
For education activities, ISC2’s handbook says that without proof of completion you can provide a description of no more than 250 words about what you learned, plus a certificate or letter of attendance.
Certification rules change. Always confirm current requirements with the certifying body. MyCertRenewal is not affiliated with ISC2, ISACA, CompTIA or EC-Council.
