Compliance training succeeds when you balance an organization’s legal responsibilities with the real needs of the employees who you hope will learn and change their behavior. In Fully Compliant, Travis Waugh challenges traditional compliance training that focuses only on the legal risk of failing to comply with a specific mandate. In this post, Waugh shares some insight on the nuts and bolts of compliance training.

What is compliance training? Does the term “compliance training” refer to something universal? How do training requirements apply to different industries?

Compliance training is any course or tutorial designed to comply with a legal mandate or mitigate a legal risk. The specific subjects can vary between industries—especially highly regulated industries like healthcare or finance—but virtually every modern organization has at least a few compliance subjects that they feel compelled to address, and probably a lot more than a few. At my institution, a brief survey revealed over 75 compliance training subjects. These training programs can vary by length, subject, format, and frequency, but there are certain qualities that seem to unite all compliance training, and those qualities generate the same predictable challenges, for employees and learning designers.

What are the qualities that unite all compliance training?

Compliance tutorials almost always tend to be comprehensive to anticipate and mitigate as many different legal risks as possible. But we know that good training needs to be concise and focused on a few specific objectives to be effective. Compliance tutorials tend to be required of everyone in an organization—again, to mitigate as much risk as possible—while we know good training needs to focus relevant content at specific audiences. The main sign of compliance training, unfortunately, is the sense that it was designed to meet the letter of the law, irrespective to the real needs of our audience. If you ask your employees why compliance courses exist, they might say they exist to cover the organization from legal liability or to check a box. Sadly, they're often right.

Given the complaints employees have about taking the time to do annual, required compliance courses on important subjects—such as sexual harassment, bullying, cyber security, workplace safety—are compliance courses a waste of time?

That depends on who you ask. Lawyers would tell you that compliance training has been very good at mitigating the costs of misconduct by protecting the organization from some legal liability. Saying “We told them not to do it,” it turns out, is a pretty good defense in a court of law, especially if you can prove it with a training transcript. But if you, as the employee, felt like the training was a waste of time, that suggests you may not have learned anything that you felt was worth learning or anything that could help you solve a real problem. As a learning professional, that makes it feel like a waste of time for me too.

Compliance training was nowhere 30 years ago and now it’s everywhere. How did this all change so fast?

There are several factors that have contributed to this massive, potentially unsustainable hike in compliance training over the last 30 years or so. Partly, I think you could argue that modern businesses see more value in good conduct and ethical decision making, and they’re increasingly baking these concepts into their mission, vision, and HR processes. They know how costly the wrong headline can be, and they still believe that traditional polices and training can keep them out of the paper. But it’s not just a PR calculation. People don’t separate their selves from their work quite like they did in previous generations, and they want to work at places that reflect their own values.

On a more cynical note, a lot of changes can be traced back to the U.S. sentencing guidelines for organizations, which first appeared in 1991. In addition to specifying the conditions under which an organization can be held accountable for the conduct of its employees, it provides judges with a list of mitigating factors that should be considered when determining a fair sentence. Training records are one of the factors listed that can reduce a sentence. That gives organizations a big incentive to cover as many conduct issues as possible in their training and to subject as many employees to that training as they can. That’s a proven recipe for legal success, and a proven receipt for bad learning experiences that feel like a waste of time to our employees.

Looking back 30 years, if you’ve ever watched the TV show Mad Men, for example, you know that ideas of acceptable behavior in the workplace have changed quite a bit. You’d never see Don Draper sent to a day-long compliance course on alcohol and illegal drugs in the workplace, or environmental sustainably, or sexual harassment. Most of the compliance training subjects you would recognize today only came into existence in the last two or three decades, but for many of us, they already feel like they’ve always been here. When so many of the people in our organizations have known compliance training for their entire career, it begins to feel like one of those unavoidable facts of life that we just have to accept, even when it doesn’t make sense.

Should organizations give up on compliance training? If bad people will sometimes do bad things and online tutorials are never going to stop them, should organizations continue going through the motions, wasting everyone’s time?

Organizations should not give up on compliance training! It would be irresponsible for any organization to forfeit the risk mitigation that a compliance training program provides. The alternative is to not even pretend to care about our employee’s behavior, which is even worse than box-checking. But it would also be wrong to say that traditional compliance training has only checked boxes. If you’ve ever gone to a construction site and seen people wearing a safety harness or a helmet, you can probably thank some combination of policies, enforcement, and training—in other words, the traditional compliance program. I just think we could be helping even more, and wasting less time, if we shift the balance a little more toward real learning. That means giving up on the idea that bad people just do bad things sometimes, and that there’s nothing we can really do to stop them.

Policies and enforcement are still needed to deal with bad actors like that. But as a learning professional, I’m more interested in the good people who sometimes do bad things. Well-intentioned people can account for a larger portion of corporate misconduct than we might think, and if we were ever going to make a real difference with compliance training, we should be aiming squarely at these people and their real needs. We need to examine the specific behaviors that pose the greatest risk and craft behavioral solutions.

Can an online tutorial or in-person compliance course really stop sexual harassment or keep someone from committing fraud?

Good training absolutely has the ability to change behavior. For example, pilots aren’t born knowing how to fly planes and surgeons aren’t born knowing how to remove a spleen. When we put our trust in professionals, we are putting our faith in learning and its ability to change behavior. We must start applying the same tools to compliance training as we do to other mission-critical skills and behavior—gap analysis, competency mapping, practice and evaluation. As people aren’t born knowing how or when to report sexual harassment or how to stand up to a manager who is asking them to commit fraud, organizations can provide training that makes a measurable difference in those cases, just by following proven instructional design models that already exist. In the language of my book, that means finding the right behavioral levers to pull to actually influence real behavior in the moment of need.

What are the levers that influence real behavior in the moment of need?

Context, habit, and internal motivation are the levers that influence real behavior. If we can use our training to change the context that elicits our employees’ instinctive reactions, or change the habits that guide their actions, or spark the intrinsic motivation needed to transcend habit and context, then we can make a difference. Traditional compliance training failed too often because it too rarely focused on these opportunities. Instead, it focused all its content on extrinsic motivations—do this or you will be fired, do that or you will be fined, just do it because we said so. Studies have shown that extrinsic motivation like that is one of the least reliable tools we have for achieving real, robust, resilient behavior change. If we really want to influence people, we need to think less like lawyers or lecturers and more like behavioral economists.

Fully Compliant makes some bold claims about what kind of conduct is good or bad, and why good people might sometimes do bad things. These are also big philosophical questions and could be considered an overreach to try to address those questions in a book about compliance training. As a trainer, a CEO, or a risk manager, you assume the authority to tell everybody else how to act. Are you intimidated by that responsibility?

In Fully Compliant, I do make some bold claims about conduct. As trainers, CEOs, and risk managers, we do assume the authority and the responsibility to set conduct. Every time we roll out a big compliance campaign, I do feel queasy because of the responsibility. I’m not a better person than anyone else, and as a facilitator who strives for two-way learning conversations, I hate the feeling of lecturing people that can come with traditional compliance. That's why this new approach to compliance can be so refreshing, for the learners and the designers. If we get this right, we aren't talking about preaching to the choir or lecturing with a wagging finger anymore. We're talking about spotting real problems that people want help with and providing that help. That feels a lot better.

What can be done to fix compliance training today? Do real-world constraints and our organizations’ need to manage legal risk mean that the compliance tutorials to date will be used for years to come?

I think that we need a wholesale revision in the way we think about compliance and organizational accountability if we really want to resolve some of these issues we've been discussing. But that will require legislators to change the way they write these expectations into law and business leaders to change the way they think about risk management. In the meantime, there are practical, concrete steps we can take to dramatically improve compliance training, even within our current constraints. The good news about compliance training, unfortunately, is that the bar has been set pretty low by years of check-the-box tutorials. “Text and next,” we call them in the industry. There is a lot that instructional designers can do to fix that perception, and we can start today. Even a few small steps in the right direction are worth taking for our learners. If we can make compliance training a little tighter, a little more tailored to individual audiences, and a little more focused on real opportunities for measurable behavior change, we can make a big difference.

What recommendations do you have for legislators and regulators who write compliance training requirements?

Recommendation for legislators: try not to micromanage. For creating meaningful regulation and real accountability, prescribing specific learning objectives or hour requirements is rarely the right approach to elicit real change. No two organizations are the same and no two learners are the same. If we want to solve these problems, we need to give our learning professionals some room to flex their approach. Instead of explaining exactly what training needs to be, stress what it needs to accomplish, and then hold organizations accountable for the results. It's pretty easy to differentiate between a good faith training effort and it's alternative, but if you try to make the distinction too objective, you're just creating more boxes to check.

What recommendations do you have for CEOs and senior business leaders who are concerned about the risk of inappropriate conduct at their organizations?

Recommendations for CEOs and senior business leaders: You don't have to choose between responsibly mitigating risk with traditional compliance training or avoiding risk in the first place by driving that training away from definitions and policies and toward behavior. By focusing a good-faith training effort on your employees' real needs, you have a chance to make a real difference while still checking the “required training” box. This is one of those rare cases where you really can have your cake and eat it too. Trust your learning professionals to do their jobs.

What recommendations do you have for learning and development professionals to help fix compliance training?

Recommendation for learning and development professionals: Don't give up the fight for preserving our learners time and attention, but also don't think it will be easy. There are reasons traditional compliance training has evolved into its current form, and those reasons aren't going away overnight. But if you anticipate pushback and organizational obstacles, they feel much less fatal to our cause. We won't win every debate, and we can't fix all this overnight; but if training professionals keep trying and keep making the most of the opportunities we're given, we can save our employees from countless wasted hours and win back some much-needed trust for our profession. Once people see what good compliance training looks like and what it can do, they'll want more.

To schedule an interview with Mr. Waugh, please contact Kay Hechler, ATD Press senior marketing manager, at [email protected].