Compliance Training

What compliance training covers

Compliance training falls into three groups.

Required by law for many employers. In the US, OSHA standards require specific safety training for many hazards and tasks, such as hazard communication for chemicals, forklift operation and bloodborne pathogens in healthcare. Several states, including California, New York, Illinois, Connecticut, Delaware and Maine, require harassment training for employers above certain sizes, with set content and frequency. Rules vary by state and change, so check the current requirements for every state where you have employees.

Required by industry regulation. Banks and financial institutions train staff on anti-money-laundering and Bank Secrecy Act rules. Healthcare employers train workforce members on HIPAA privacy and security. Payment-card handlers follow PCI DSS training requirements. Government contractors may face additional requirements.

Expected as good practice. Code of conduct, anti-bribery, conflicts of interest, information security and phishing awareness, data privacy, fair employment practices for managers, and workplace violence prevention. Even where no statute requires them, regulators and courts often look at whether an employer trained people when they assess its response to misconduct.

Why compliance training matters beyond the checkbox

The legal case is real. In harassment cases, the US Supreme Court's 1998 decisions in Faragher v. City of Boca Raton and Burlington Industries v. Ellerth created an affirmative defense for employers that exercised reasonable care to prevent and correct harassment. Training and a working complaint process are a common part of showing that care. Under the US Sentencing Guidelines, an effective compliance and ethics program, including training, is a factor in how organizations are treated when violations occur.

The operational case is often bigger. A contact center agent who reads out a full card number on a recorded line, a recruiter who asks a candidate about pregnancy, or a warehouse worker who skips a lockout step causes harm long before any lawsuit. Compliance training that actually changes behavior prevents those incidents. Training that people click through while doing something else does not.

How often to run compliance training

Frequency depends on the topic and the rule:

• At hire: code of conduct, harassment prevention, data privacy, safety for the specific role, and any industry rules the role touches. Many regulated tasks require training before the person does the task at all.
• Annually: most organizations refresh core topics every year. Some rules require it; for others it is the common standard.
• On a set cycle defined by law: some state harassment laws set the interval, for example every two years in California for covered employers.
• When something changes: a new law, a new system, a new product, or an incident that shows a gap.

Track due dates by person in your learning management system and automate reminders and escalations to managers. Overdue rates by team are worth reporting monthly.

Record-keeping

If it is not documented, you cannot show it happened. Keep for each employee: course name and version, date completed, duration, assessment score if any, and an acknowledgement where the policy needs one. Keep copies of the content as delivered, since auditors and opposing counsel may ask what employees were actually taught at the time.

Retention periods depend on the rule. OSHA training records and state harassment training records each have their own requirements, and many employers keep training records for the duration of employment plus several years. Set one retention schedule with legal counsel and apply it consistently.

Making compliance training work

1. Keep it relevant to the role. A warehouse associate does not need the same data privacy course as a payroll specialist. Segment by job family where you can.
2. Use scenarios from your own workplace. A short case about a recruiter pressured to skip a background check step teaches more than a list of rules.
3. Make it shorter and more frequent. A long annual module followed by quarterly short refreshers usually beats one long session.
4. Test application, not recall. Ask what the person should do in a situation, not what section 4.2 says.
5. Train managers separately. Managers receive complaints, make hiring and discipline decisions, and set the tone. They need content on their specific obligations, like how to respond to a harassment report.
6. Connect it to the [code of conduct](/glossary/code-of-conduct/) and other policies people already sign, so the rules feel like one system.

Common mistakes

• One generic course for everyone. It bores most people and under-trains those in risky roles.
• Treating completion as compliance. A 100% completion rate with no change in incidents means the training is a record, not a control.
• Ignoring multi-state requirements. Remote and multi-site employers often miss state-specific harassment training rules for employees outside headquarters.
• Paying nothing for the time. For non-exempt employees, required training is generally paid work time under the FLSA. Schedule it properly.
• No language access. If a large part of your workforce speaks another language at work, train in that language. Some state rules require it.