Does your Compliance Training programme need a health check?

David Bernardi has over 20 years of Compliance training experience working at investment banks such as Credit Suisse, BNP Paribas, Nomura and Commerzbank.

Background to the article 

• From our speaking to a number of firms in recent weeks, it is clear the COVID-19 lockdown has challenged the effectiveness of compliance training programmes which were not designed to support a largely working from home workforce.
• The ability to keep staff trained and competent remains a core FCA Senior Manager regulatory obligation, however, many compliance training programmes are not effective. They are poorly designed, deficient in content, follow a one-size fits all approach – not tailored to the audience and are largely tick-box exercises.
• In this article we have asked David Bernardi to explore some of the common pitfalls in compliance training programmes and provide helpful practical insight into some of the success factors to consider in developing an effective compliance training framework.

Introduction – effective compliance training is a core regulatory obligation

• The Senior Manager and Certification Regime (SMCR) is one of the most significant regulatory changes to impact UK financial services firms in recent years. Governance and accountability requirements for senior management, the certification regime for staff in higher risk roles, Conduct Rules applying to the vast majority of staff.  Achieving SMCR compliance requires significant efforts on the part of a firm and needs the buy-in from all staff from the top down and that includes training.
• Under SMCR, senior managers and certified staff must be assessed as fit and proper on an annual basis. In making the assessment, a firm must consider the individual’s competence and capability including the training they have been given.  But can a firm satisfy that requirement if all a senior manager or trader has done is complete the online training courses that were released across the firm?  Is that enough?
• SMCR also requires a firm to provide Conduct Rules training. As well as training on the headline rules, a firm must provide suitable training to help staff understand how those rules apply to them.  But can a firm stand by delivering a one size fits all course, one that is also given to senior managers despite certain Conduct Rules only applying to them?  Can a firm view the training as a success because one hundred percent of staff completed it?  Is that what SMCR is really about?

Common pitfalls in Compliance Training Frameworks

How effective is your compliance training framework? Does it need a health check? Does it suffer some of the following symptoms?

1. Box ticking exercise?

• SMCR embodies the UK regulatory need to drive real cultural and behavioural change across the industry.  For training to play any part, it cannot be viewed as a box ticking exercise.  Not just training specifically designed to target SMCR’s stated requirements but any form of training.  So the ethos and intent behind SMCR is raising the bar for a firms’ training activities.
• No firm has the perfect training approach. But ask a handful of professional trainers what real behaviour changing training looks like and they may use words like relevant, targeted, concise and engaging.  In other words, good.  It is less likely they will use words like irrelevant, blanketed, long and boring.  In other words, bad.  But unfortunately, they are the words that many staff who have undertaken compliance training may use.

2. Lack of stakeholder engagement?

• To create effective compliance training, a firm must engage the right people at the planning stage and that doesn’t just mean someone whose job title or job description includes the words compliance training.  There are a much wider range of stakeholders who must be engaged such as representatives from other compliance teams, the business and key risk functions like internal audit whom will have a view on control risk issues.
• But what if stakeholders don’t engage? They may ignore meeting invitations or send a much more junior delegate in their place.  Or they attend but don’t review the planning outputs such as draft plans or proposals.  Lack of meaningful stakeholder engagement at the outset can lead to a training plan being agreed on that doesn’t address the real risks and training needs facing the firm.
• Engagement issues can also occur once the firm starts developing and delivering training courses. Perhaps a member of markets advisory committed to writing market abuse case studies for an online course or review the course at the various stages of its development.  But when their help is needed, they’re too busy and the task is handed to a team member lacking the requisite subject matter expertise.  The end result, a course that at best doesn’t do the course justice or at worst is technically wrong.
• To use another example, a member of the financial crime team may have committed to delivering sanctions training to hundreds of staff, but when that time comes, a major sanctions issue within the firm has to be addressed.  The training is postponed or cancelled.  They may find another colleague to do it, someone with the right knowledge but lacking the right presentational skills.  The end result, training that is less than memorable for the audience.

3. Content quality challenges

• Engaging the most knowledgeable, capable and willing stakeholders throughout the planning stage may lead to a good quality compliance training plan being produced. But as mentioned, it is no guarantee that good quality compliance training will follow. Sometimes, the development and delivery requires the involvement of members of staff who lack the right skills to instructionally design online content or lack presentational skills.  Sometimes, the problems are more structural.
• By way of an illustration, a couple of thirty minute face to face training sessions may have been planned. The sessions are intended to remind a small audience of twenty or so traders about some quite specific policies.  The person who committed to presenting is an in-house compliance subject matter expert and an on the face of it an excellent presenter.  They circulate their draft slides which represent no more than pages of text lifted from the policies.
• Compliance management decide that the presenter should also include some internal audit findings and a few enforcement cases and for good measure, it is decided that a few slides repeating the primary regulatory rules would be useful.  To bring the session to life, the presenter decides to write some scenarios.  On review, they’re technically excellent but very specific and far too long.  Attempts are made by the compliance training team to cut them down in size but they receive pushback.
• Finally, a ‘better safe than sorry’ decision is made at business management level that the training topic is so important and given the audit findings and enforcement cases, the entire trading floor should get the training.  In the end, hundreds of front office staff are taken away from the desks to attend a one hour plus presentation, the vast majority of whom feel the course wasn’t targeted at them and is largely irrelevant.

4. Training overload – no joined up thinking?

• Left unchecked, a compliance training plan can soon become too big because there are so many risks that must be mitigated with training. And with a ‘better safe than sorry’ approach in mind, rather than targeting those staff who really need each course, a decision is made to give all courses to as wide a target audience than is necessary.  Perhaps everyone.
• In some firms, a local compliance training plan may not be the only one in play. The firm may also have regional and global plans out of which come regional and global courses for the local staff.  One topic could be trained on three times, each course sharing the same intent but referencing different terminology and requirements. Multiply that issue across a number of training topics and staff can soon feel overwhelmed by the volume of courses they receive.
• Some may argue that overloading is a necessary evil if a firm is to cover all of the risks it wants to with training. But such an approach, particularly where many of the courses lack real relevance, can have adverse consequences.  Staff may expect any future course they receive to equally lack relevance to them.  So when they are asked to complete an online course that is relevant and has been tailored to their needs, they may click through it without paying attention.

5. Face-to-face classroom-based training had stopped during lock-down

• An effective compliance framework must include an element of 1-1 or classroom-based training. Compliance induction training is typically delivered face-to-face, annual compliance refresher training programmes are generally classroom based and workshops might be used to address business specific training needs.
• The COVID-19 lockdown and remote working has posed significant challenges for firms who don’t have effective learning management systems and tools which have the functionality to deliver classroom based training over some form of video-conference facility.
• Delivery of pre-recorded training presentations and one-way video conferences is sub-optimal to classroom based training in terms of 2 way discussion and audience participation.

6. Learning management system – is it fit for purpose?

• As already mentioned, COVID-19 has posed challenges for firms, such as those who want to deliver classroom-based training. A firm may typically use their learning management system to launch and record online training but can’t or don’t for face-to-face sessions.  Whilst the technology allowing a firm to do that is available, a firm nevertheless may not do so for a number of reasons.
• It may be that the system doesn’t allow for the launch and tracking of face to face training. It may be that the system’s functionality only allows for pre-recorded video files to be loaded up and launched but not tracked.  There may be IT concerns about bandwidth if a firm proposes for video to be used as opposed to online training.
• A number of platforms are evolving in the marketplace to accommodate the wide range of training solutions available to a firm, including pre-recorded and live streamed events. As well as allowing a firm to launch training through the platform, they can provide a firm with analytics such as how long the individual spent on the training and whether they completed it.
• The right training approach has always been one that accommodates the needs of the audience who will usually want a blend of both online as well as face to face training. And that doesn’t just mean a one hour classroom session for example.  It may be that all the audience need is a simple bite-sized five minute video update on a particular topic but if the technology isn’t there, it can’t happen.  And in the current climes of COVID-19, despite the appetite for face to face being there, all that a firm can offer its staff is online training.

How to nurse your framework back to better health: how is good and effective training produced?

• So what is the answer? How does a firm produce courses featuring good quality content that really engages?  How does it ensure that training is only targeted at those that needed?  How does it make sure that all stakeholders are engaged?  A firm would be forgiven for deciding to undertake a wholesale review of its courses as a starting point, to make sure they are of a suitable quality and meet the target audience’s needs. But the question must be asked, if a firm has concerns about its current training offering, why and how were they created like that in the first place?
• A starting point must be the firm’s compliance training framework. A firm must have clear and well understood policies and procedures which anticipate some of the challenges mentioned in this article so that good training can consistently be produced.  There must also be the right levels of governance around the firm’s approach to compliance training. Senior management must want to make sure that staff are receiving the right training, that it is of the right quality and that it is being completed.   And when we think back to the beginning of this article, that it is making a difference within the firm.
• Set out below are just some of the factors to consider in developing a good compliance training framework. They have been framed in the form of questions that a firm may ask, to help it consider where its weaknesses may be and how its approach to training could be improved.

1. Does your firm have a compliance training policy which:

• Details how and when an annual compliance training plan is planned and delivered?
• Identifies who the training stakeholders are by role and explains their responsibilities?
• Details the committees/forums at which stakeholders meet to plan and review training?
• Features the reviews and sign-offs needed for the plan to be ratified?
• Sets out the minimum quality standards for any training course?
• Addresses cross-border training plan demands?
• Allows for regular senior management progress reporting and escalation?

2. Has it got a compliance training procedure which:

• Explains in detail the steps needed to produce and deliver each planned course?
• Explains the process for deciding who the target audience should be?
• Sets out individual role responsibilities as part of the production and delivery?
• Features the quality control steps to ensure content is effective and correct?
• Identifies the sign-offs needed before each course can be launched?
• Explains the escalation process for non-completion of training?
• Sets out disciplinary actions for non-completion that the firm actually takes?

3. Are your training stakeholders:

• Fully aware of the compliance training policy?
• Drawn from across compliance, the business and key functions like audit?
• Committed to engaging in the planning, development and delivery of training?
• Given the time by the firm to meaningfully engage?
• Given clear responsibilities such that they are well understood?
• Held accountable for their engagement (e.g. through performance appraisals)?

4. Does your compliance training planning factor in drivers such as:

• Needs analysis exercises conducted across compliance, business and functions?
• Risks already identified by areas such as advisory, monitoring, assurance, audit?
• Breaches identified in any breaches register?
• Internal disciplinary cases?
• External enforcement cases?
• New regulations or forthcoming changes to policies and procedures?

5. Are your senior managers given training MI which:

• Is routinely prepared and presented (e.g. monthly)?
• Explains progress to date against the delivery of the compliance training plan?
• Features metrics gathered to measure the effectiveness of a training course?
• Highlights target audience feedback gathered to measure how well a course worked?
• Identifies any issues such as non-completion of training or lack of engagement?

How can Eiger Regulatory Partners help you?

• Eiger Regulatory Partners can provide you with support in all aspects of the review, design and implementation of compliance training frameworks through its network of compliance training professionals. This includes:
  • provision of experienced compliance training professionals to support your current resources to focus on execution and delivery of your current training programme
  • independent reviews of existing compliance frameworks
  • the design and build of new or enhanced compliance training frameworks
  • design and delivery of course content.

This presentation and its content is copyright of Eiger Regulatory Partners 2020. All rights reserved. Any redistribution or reproduction of part or all of the contents in any form is prohibited other than the following: you may print or download to a local hard disk extracts for your personal and non-commercial use only and you may copy the content to individual third parties for their personal use, but only if you acknowledge the website / presentation as the source of the material. You may not, except with our express written permission, distribute or commercially exploit the content. Nor may you transmit it or store it in any other website or other form of electronic retrieval system.