What is compliance training?

Compliance training is learning designed so that people know, understand and can apply the requirements that govern their work. Its purpose is narrower than general professional development: it exists because an obligation exists, and it should change behavior in the situations where that obligation applies.

The term is anchored by ISO 37301:2021, the certifiable international standard for compliance management systems published in April 2021. ISO 37301 defines compliance obligations as requirements an organization "mandatorily has to comply with as well as those that an organization voluntarily chooses to comply with". Compliance training therefore covers legislation and regulator rules, and also codes, contracts and internal policies the organization has adopted. The obligations themselves are usually listed in a compliance obligations register.

The ISO technical committee's published FAQ lists "personnel trainings and communications" among the measures the standard requires, alongside identifying obligations, assessing compliance risk, monitoring and corrective action. Training is one control, not the whole system.

Effective compliance training runs as a cycle that starts from obligations, not from content. The steps below reflect the sequence implied by ISO 37301 and by regulator guidance.

1. Identify obligations. List the legal, regulatory and voluntary requirements that apply, and keep the list current when rules change.
2. Assess risk and exposure by role. Decide which roles face which obligations and how serious a breach would be.
3. Define learning outcomes. Write what a person must be able to do, not only what they must read. See learning outcomes.
4. Design and deliver. Choose formats that fit the risk: short e-learning for awareness, supervised practice for high risk tasks.
5. Assess and record. Check understanding or competence and keep records that link each person to the obligation and version of the material.
6. Review. Refresh on a defined cycle and whenever an obligation, process or risk changes.

Laws usually set the outcome rather than the course. For example, section 19(3)(f) of Australia's Work Health and Safety Act 2011 requires a person conducting a business or undertaking to ensure, so far as is reasonably practicable, "the provision of any information, training, instruction or supervision that is necessary to protect all persons" from work risks, as Comcare's regulatory guide sets out. In the European Union, Article 39(1)(b) of the General Data Protection Regulation (GDPR) makes it a task of the data protection officer to monitor compliance, "including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations".

Compliance training overlaps with several terms that are often used interchangeably but mean different things.

The practical difference between completion and competence is explored in completion tracking vs competency verification.

The table below is an illustrative example for a whistleblower obligation in an Australian public company. The Australian Securities and Investments Commission (ASIC) RG 270 says an entity should conduct upfront and ongoing training on its whistleblower policy for every employee, with specializt training for staff who receive disclosures (RG 270.131 and RG 270.134).

Knowledge Foundry records each obligation, the concepts a person needs, and the assessment points that prove understanding before any training content is written. Each learning outcome then carries a link back to its source obligation, so the mapping in the example above is held as data rather than rebuilt for each audit.