Training and monitoring that test understanding

Identify the duty and the audience

Training requirements differ across regimes. Under regulation 24 of the Money Laundering Regulations, relevant persons must take appropriate measures for relevant employees and specified agents to understand relevant law and receive regular training, and must keep written records. That is not a requirement that every UK business takes the same AML course.

For data protection, the ICO's training guidance addresses induction, refreshers and specialist responsibilities. Its audit material is guidance about expected measures, rather than a universal statutory course syllabus. Choose the resource appropriate to your organisation and check any guidance-update notice.

Design around the decision staff must make

A suggested training plan begins with the tasks and failure points in each role. Reception staff may need to recognise a request or report a misplaced document. Procurement staff may need to identify a supplier handling personal data. A manager may need to decide when an exception requires escalation.

Teach the real internal route alongside the legal context. Use a realistic example, show where the procedure lives and ask the learner to explain what they would do next. Provide accessible formats and a route to ask questions. Where a role changes materially, review the learning requirement rather than relying on its previous completion record.

Keep evidence of understanding

A completion rate answers who finished the activity; it does not show that the process works. Combine proportionate knowledge checks with feedback from operational review. Avoid collecting unnecessary personal information about staff.

• Record the audience, learning objective, material version and delivery date.
• Keep completion, assessment outcome and follow-up where more support is needed.
• Review missed deadlines and unresolved gaps with the responsible manager.
• Sample the work the training is intended to improve and compare recurring errors.
• Amend unclear procedures as well as training when staff repeatedly struggle.

Use monitoring to improve the programme

For FCA-supervised firms, the Financial Crime Guide discusses practical, role-appropriate training and assessment of its effectiveness. Other organisations can use this as a carefully labelled benchmark, while following their own supervisory requirements.

A concise management report should show the affected roles, unresolved weaknesses, work-quality findings and the next improvement. Repeat an exercise after remedial training and retain the result. Set refresher timing to the applicable requirements and risk; do not present an arbitrary annual cycle as the law for every topic.

Build a compliance monitoring plan

A compliance monitoring plan turns selected obligations and risks into scheduled checks. The structure below is an editorial working template, not a prescribed regulatory form. Cover the programme’s relevant activities, not only training completion. Ask the responsible specialist to confirm the applicable requirements and the proposed test before relying on its conclusion.

• Scope and requirement: record the entity, activity, obligation reference and risk being tested; explain any exclusion.
• Test question and criteria: state what should happen, the evidence needed and what would count as an exception.
• Population and sample: identify the period and records in scope, the selection method and the reason for the sample size; do not present a small sample as proof about every case.
• Frequency and triggers: choose a risk-based review interval, then record changes or incidents that require an earlier check. Keep legal deadlines separate from internal dates.
• Responsibility and challenge: name the test owner, reviewer, reporting recipient and escalation route; disclose limits to independence.
• Results and evidence: retain the records examined, findings, uncertainty and the basis for the conclusion. Missing evidence remains an open question.
• Remediation and closure: assign an action owner and target date, specify the evidence needed for a retest, and record who accepts closure.
• Programme review: compare recurring findings, overdue actions and uncovered activities; update the plan when the evidence changes.

Illustrative monitoring record: a supplier change

In a fictional business, procurement changes a supplier onboarding procedure after a review finds that the intended privacy check is sometimes omitted. Its monitoring record links the relevant requirement and procedure, defines the period and population of new suppliers, and explains how cases will be selected for review. The reviewer checks the recorded assessment and approval rather than relying on a training attendance list.

Any omission becomes a finding with an owner, corrective action and retest requirement. The report states which cases were examined and what remains uncertain. This fictional process example is not client experience, research data or evidence that a particular organisation complies. A dedicated downloadable whole-programme monitoring template is not included in this guide.