What should be your organization’s compliance training frequency? How does the amount of training positively or negatively impact an overall training strategy? Unfortunately, these are not questions answered by the 2020 Update or the 2020 FCPA Resource Guide. However, every compliance training program should be “well-designed” and “appropriately tailored” for training and communications.

Often compliance professionals think that compliance training needs to be conducted very frequently, even if it means repeating the same training courses every year. However, Shawn Rogers analogizes compliance training to an automobile’s windshield wiper system in a discussion of how frequently compliance training should be administered. He went on to explain, “it would not make any sense to run your wipers constantly, even when it is not raining. First, it would be extremely annoying to the passengers if the wipers were always running. And second, eventually it would wear out both the wiper blades and the wiper motor. It would simply be nonsensical.” Requiring overly repetitive training is like running your windshield wipers in clear weather. The learners are going to be annoyed, the training will be viewed as a waste of time and energy and, finally, your employees will not take training as seriously when it is really needed to address a specific situation as the compliance training will be viewed literally and figuratively as a “check-the-box” exercise.

Compliance training should be applied in a similar way, that is risk based. It should be available and ready to be used when the risks are present, and it should be applied in such a way so that it directly addresses those risks. In other words, before a company deploys its compliance training, it needs to know what the risks are and the training program should be designed to mitigate those specific risks. Here the Department of Justice (DOJ) does provide some guidance in the 2020 Update where it posed the following questions in the section entitled “Risk-Based Training”.

• What analysis has the company undertaken to determine who should be trained and on what subjects?
• What training have employees in relevant control functions received?
• Has the company provided tailored training for high-risk and control employees, including training that addresses risks in the area where the misconduct occurred?
• Have supervisory employees received different or supplementary training?

What about the situation where you need to clean or “refresh” your windshield? Over time, dirt can accumulate on the windshield and a little squirt of wiper fluid and a few swipes of the wipers will instantly clean the windshield and clear the driver’s view. Can compliance training be viewed in the same way? Once again this is one place that the 2020 Update can provide some guidance when it stated, “companies have invested in shorter, more targeted training sessions to enable employees to timely identify and raise issues to appropriate compliance, internal audit, or other risk management functions.” Rogers believes it would be “fantastic if we viewed compliance training in the same way instead of giving an hour-long course on a topic they have heard before, what if instead employees received a 10-minute “refresher” training just to maintain their awareness and get the message that they should constantly be vigilant?”

What about compliance or other topics which are so important to your organization that training needs to be required fairly regularly, maybe even annually. Rogers suggested a few topics he has found important enough to provide reminder compliance training on annually:

• The importance of our Code of Conduct;
• The importance of speaking up when a concern is observed, and how to report the concern;
• An understanding of the company’s non-retaliation policy;
• The importance of workplace safety; and
• The requirement to disclose conflicts of interest.

While new employees should be required to take more detailed courses during their first year so that they are exposed to the key risks in detail, after that full-length courses can be staggered in a three-year interval so you can keep the courses updated and to avoid over-training. In the interim, you can move towards a less frequent repetition of lengthy training courses and more frequent refreshers or reminder training modules that keep the risk top-of-mind without assuming that lengthy courses need to be repeated every year. Once again this fits the 2020 Update prescription that “companies have invested in shorter, more targeted training sessions to enable employees to timely identify and raise issues to appropriate compliance, internal audit, or other risk management functions.” Rogers concluded, “It is a very common sense and defensible approach to compliance training.”

[View source.]