Mandatory compliance training: deciding what is required and proving it happened

Mandatory compliance training is the training an organisation must provide because a law, a regulator, a licence condition or a contract requires it — not because it is good practice. The distinction matters: good-practice training can be flexed when people are busy, while mandatory compliance training has to happen, to the right people, at the right interval, with evidence. Most failures are not missing courses but missing mapping: nobody wrote down which obligation requires what, for whom.

Build the mandatory compliance training list from obligations

1. List the obligations first: health and safety duties, data protection, anti-money laundering, anti-bribery, sector licences, customer contracts that specify training.
2. For each obligation, state what training it actually requires — some specify content, some only require that staff are "trained and competent".
3. Map each requirement to roles, not to everyone; blanket assignment inflates cost and hides the roles where it truly matters.
4. Set the interval from the obligation where one exists, and from risk where it does not.
5. Decide what counts as evidence for each: a completion, a test pass mark, a practical assessment, a signed acknowledgement.
6. Name an owner for each requirement who is accountable when it lapses.

Common mandatory topics, and why they recur

• Health and safety induction and role-specific hazards — required wherever there are employees.
• Data protection and information security — driven by regulation and, increasingly, by customer contracts.
• Anti-money laundering for regulated sectors, where the training duty is explicit and inspected.
• Anti-bribery and conflicts of interest, which reduce exposure when something goes wrong.
• Harassment and conduct training, required in some jurisdictions and expected in most.
• Sector-specific topics — food hygiene, manual handling, working at height — tied to the work itself.

Annual compliance training is a cadence, not a requirement. Many obligations do not specify annual refreshers; choosing annual is fine, but record it as your decision so you can justify both the interval and any exception.

Content is bought; evidence is yours

Most of the paid search activity around compliance training comes from course vendors, and buying content is often sensible. But the vendor's completion report is not your compliance record. Hold your own record of who was required, who completed, when, and against which version — Ettex Records is built for that register, and policy acknowledgements can be collected through Ettex Signature. Ettex does not provide the course content; it holds the proof.

Formal courses are only part of the picture on operational sites. A short toolbox talk at the start of a shift, with signed attendance, covers task-specific hazards that no annual course can anticipate.

A single policy only works inside a function that is resourced and heard. Compliance program management sets the charter, the annual plan and the reporting line, including the escalation route that goes past the executive being assessed.

Proving it happened

• Completion rates by requirement and by role, with named exceptions.
• Evidence attached to every completion that an obligation specifically requires.
• Decisions recorded for extensions, exemptions and equivalent external qualifications.
• Version history of the training content, matched to who completed which version.
• Escalation records for persistent non-completion — the step regulators look for when rates are low.

The operational pieces sit elsewhere: employee training tracker software tells you who is due, and each employee training record holds the evidence. Mandatory compliance training is the layer above both — the reasoned list of what must happen and why.