Compliance Training Best Practices That Change Behavior
Compliance training best practices from DOJ, HHS-OIG and state rules: role-based paths, real scenarios, spacing, measurement, records and a real example.
Get a Free Quotation
Scoped proposal delivered within 48 hours
Compliance training best practices in short
Compliance training best practices come down to five habits: train by risk and role, teach real decisions through scenarios, keep modules short and repeat key points over time, give people a way to ask questions, and measure behavior, not just completion. The US Department of Justice asks about most of these when it judges a compliance program.
Need this built for your team? IKHYA designs custom compliance eLearning for L&D, HR and compliance teams.
Get a Free Quote →This guide is for the people who own mandatory training: compliance officers, HR leads and L&D managers. It turns what regulators and learning research actually say into practical steps you can apply to your next course. It is general information, not legal advice. Check your own obligations with your counsel.
What is compliance training, and why does it matter?
Compliance training teaches employees the laws, regulations and company policies that apply to their job, and what to do when a situation tests them. It matters because regulators judge an organization partly on it: the US Sentencing Guidelines count "effective training programs" as part of an effective compliance and ethics program.
The Guidelines ask organizations to communicate their standards "periodically and in a practical manner" to board members, leaders, employees and, where appropriate, agents (US Sentencing Guidelines §8B2.1(b)(4)). The US Department of Justice (DOJ) goes further. Its guide for prosecutors asks three questions about any compliance program: is it well designed, is it applied in good faith with enough resources, and does it work in practice (DOJ Criminal Division, Evaluation of Corporate Compliance Programs, updated September 2024).
The benefits of compliance training, in practical terms
Fewer violations and incidents, because people recognize risky situations and know who to ask.
A stronger position if something goes wrong. Prosecutors and regulators look at whether training was tailored, understood and measured.
Audit-ready evidence of who was trained, on what, and when.
Consistent behavior across sites and countries, instead of results that vary by branch or trainer.
Which compliance training is required by law?
Some compliance training is a legal requirement, and much more is expected by regulators' guidance. Which rules apply depends on your country, state, industry, company size and roles. The table shows real examples, read on the official text, so you can see how different the "who" and "how often" can be.
| Requirement | Who must be trained | What and how often | Official source |
|---|---|---|---|
| California: sexual harassment and abusive conduct prevention (Gov. Code 12950.1) | California-based employees of employers with 5 or more employees | 2 hours for supervisors, 1 hour for non-supervisory staff, every two years. New hires within six months of hire; new supervisors within six months of taking the role. Must be "effective interactive training": text-only courses do not count. | CA Civil Rights Department FAQ (October 2025) |
| New York State: sexual harassment prevention (Labor Law 201-g) | All employees | Every year, and the training must be interactive | NY Labor Law 201-g |
| HIPAA Privacy Rule (45 CFR 164.530(b)) | All workforce members of a covered entity | New members within a reasonable period after joining; affected staff within a reasonable period after a material policy change. The training must be documented. | 45 CFR 164.530 |
| OSHA bloodborne pathogens (29 CFR 1910.1030) | Employees with occupational exposure | At initial assignment, then at least annually (within one year of the previous training), during working hours at no cost to the employee | OSHA 2254, Training Requirements in OSHA Standards |
| OSHA hazard communication (29 CFR 1910.1200(h)) | Employees who work with hazardous chemicals | At initial assignment and whenever a new chemical hazard is introduced into their work area | OSHA 2254 |
| DOT / FMCSA supervisor training (49 CFR 382.603) | Everyone designated to supervise commercial drivers | At least 60 minutes on alcohol misuse plus 60 minutes on controlled substances use. Recurrent training is not required. | 49 CFR 382.603 |
| FTC Telemarketing Sales Rule: do-not-call (16 CFR 310.4(b)(3)) | Sellers and telemarketers that want the "safe harbor" | The safe harbor requires written do-not-call procedures and personnel trained in them | 16 CFR 310.4 |
| EU AI Act, Article 4: AI literacy | Staff of providers and deployers of AI systems | Measures to support staff AI literacy; applies since February 2, 2025. No certificate is required. | European Commission AI literacy Q&A |
Expected by guidance, even where no law sets a course
- The DOJ expects "periodic training and certification" for directors, officers, relevant employees and, where appropriate, agents and business partners.
- HHS Office of Inspector General (OIG) guidance for health care organizations says all board members, officers, employees, contractors and medical staff "should receive training at least annually" on the compliance program (HHS-OIG General Compliance Program Guidance, 2023). OIG calls this voluntary, nonbinding guidance.
If you train in health care, our page on healthcare eLearning solutions shows how we approach HIPAA and other compliance courses for health care teams.
How often should compliance training happen?
There is no single legal frequency. Some rules say annually (New York harassment, OSHA bloodborne pathogens), some every two years (California harassment), some only at hire or when something changes (HIPAA, OSHA hazard communication), and some once (DOT supervisors). A common, defensible pattern is a yearly core refresher plus event-driven training.
Train again when one of these happens:
A new hire or a role change, especially into a supervisory, approval or control role.
A new law, regulation or policy, or a material change to one.
An incident, investigation or audit finding. OIG says the annual training plan should address concerns found in audits and investigations, and the DOJ asks whether training covers lessons learned from prior incidents.
A new risk in your industry or region, such as a case at a competitor. The DOJ asks about this too.
OIG adds that education "should not be limited to annual formal training requirements." Short reminders through the year keep the topic alive between refreshers, which also fits the learning research in practice 5 below.
10 compliance training best practices
Each practice below says what to do, why (with the source), and how to apply it when you build the training as eLearning.
1. Start with a risk and audience analysis
The DOJ asks a blunt question: "What analysis has the company undertaken to determine who should be trained and on what subjects?" The Sentencing Guidelines also expect organizations to assess the risk of misconduct periodically and adjust the program.
How to apply it: list your top risks by function and location, map them to roles, and decide which roles need which topics. Keep this map: it becomes your training plan and your answer when an auditor asks why a group got a course.
2. Build role-based paths, not one course for everyone
The DOJ asks whether high-risk and control employees received tailored training, and whether supervisors received "different or supplementary training". OIG asks for targeted sessions based on each person's role and risks.
How to apply it: give everyone a short core module (code of conduct, how to speak up, non-retaliation), then add role modules: sanctions screening for onboarding teams, billing and coding for health care billing staff, approvals and red flags for managers and other gatekeepers.
3. Teach decisions with real scenarios
The DOJ notes that some companies give employees "practical advice or case studies to address real-life scenarios", and asks whether training covers lessons from the company's own past incidents and from other companies in the same industry or region.
How to apply it: replace rule summaries with short branching scenarios. The learner faces a realistic situation (a gift from a supplier, a customer who refuses ID, a manager asking to backdate a record), makes a choice and sees the consequence. Write scenarios from your own anonymized cases. Generic stock situations don't build judgment for your workplace.
4. Keep modules short and targeted
The DOJ observes that some companies "have invested in shorter, more targeted training sessions" so employees can spot and raise issues in time. California also allows its required harassment hours to be completed in segments, as long as the total is met within the two-year period.
How to apply it: split long annual courses into focused modules, each with one job (for example "recognize a red flag" or "escalate a concern"). Microlearning works well for refreshers and reminders; keep fuller modules for onboarding and major rule changes.
5. Space the learning out and test recall
Two well-known findings support this. A 2006 review of 317 experiments in Psychological Bulletin found that spaced study improved retention compared with massed study, and that the best gap between sessions grew with how long the material had to be remembered (Psychological Bulletin, 2006). A 2006 study in Psychological Science found that taking practice tests produced substantially better retention after two days and a week than restudying (Psychological Science, 2006).
How to apply it: follow the main course with short knowledge checks or scenario questions a few weeks later, rather than repeating the same full course once a year. Use questions that make people recall and apply the rule, not just recognize it.
6. Fit the form and language to the audience
The DOJ asks whether training has "been offered in the form and language appropriate for the audience". OIG notes that a culturally diverse staff may need materials in several languages.
How to apply it: translate and localize examples, not just the text: names, currencies, local rules and situations. Build courses to WCAG 2.1 AA, the W3C accessibility guideline, so employees with disabilities can complete them. Make sure the course works on the devices your frontline staff actually use.
7. Give people a way to ask questions
The DOJ asks whether there is "a process by which employees can ask questions arising out of the trainings", online or in person. OIG says the same for every format. In California, eLearning for the harassment requirement must tell learners how to contact a trainer who answers within two business days.
How to apply it: put a "Questions? Ask compliance" link or contact on every module and the final screen. Track the questions: they show where policies are unclear and feed the next update.
8. Involve leaders and managers
The DOJ asks what senior management has done to make the company's position on misconduct clear, and whether employees hear (anonymized) examples of the discipline that follows. The Sentencing Guidelines include the governing authority and high-level personnel in the training audience.
How to apply it: open the course with a short leadership message that explains why the topic matters to the business. Give managers their own module on how to respond when someone raises a concern, because that moment decides whether people speak up again.
9. Measure behavior, not just completion
The DOJ asks how the company measures training effectiveness, whether employees learned the subject, how it handles people who fail the test, and whether training changed "employee behavior or operations". Completion alone answers none of these.
| Level (Kirkpatrick) | What to measure | Example sources |
|---|---|---|
| 1. Reaction | Relevance and clarity rated by learners | Short end-of-course survey |
| 2. Learning | Scores on scenario questions; pre-test vs post-test; first-attempt pass rate | LMS reports (SCORM or xAPI data) |
| 3. Behavior | Questions to compliance, hotline use, policy exceptions, audit findings by team | Compliance, HR and audit records |
| 4. Results | Incidents, HR queries, losses or penalties over time | Business and risk data |
The four levels come from the Kirkpatrick Model. Decide before launch which metric at each level you will report, and agree a baseline.
10. Keep audit-ready records and review content yearly
HIPAA requires covered entities to document that training was given, and the DOJ asks for evidence that the program is understood in practice. OIG recommends reviewing the training plan at least annually against audits, monitoring results and rule changes.
How to apply it: publish courses in SCORM or xAPI so your LMS records completion, pass or fail and scores per person. SCORM is the standard that lets a course run and report in most LMSs; xAPI can also track activity outside the LMS. Keep the course version, date and content owner with each record, and set a yearly review date for every module. If you train customers or partners, the same records answer "who completed what" for them.
How to make compliance training engaging (not just "fun")
Engaging compliance training feels relevant, not entertaining. Learners stay with a course when it shows situations from their own job, lets them make choices and shows what happens next. Points and badges help only when they support that practice; they cannot rescue a course that is a list of rules.
What works in compliance courses
- Consequence-based scenarios: the learner chooses, then sees the realistic outcome for the customer, the colleague and the company.
- "Spot the risk" exercises: an email, invoice or conversation with hidden red flags to find.
- Short challenges with feedback: a few questions with an explanation for every answer, right or wrong.
- Real voices: a short message from a leader or a respected colleague instead of a narrator reading policy text.
- Light game elements, used carefully: a 2019 meta-analysis in Educational Psychology Review found that gamification had a positive effect on cognitive learning outcomes (g = .49), while motivational and behavioral effects were less stable (Springer). Use game elements to give practice and feedback, not as decoration.
How to develop a compliance training program: 6 steps
To develop or rebuild a corporate compliance training program, work from risk to evidence. These steps put the practices above in order.
- 01
Map requirements and risks.
List the laws, guidance and internal policies that apply, by role and location (practice 1).
- 02
Design the curriculum.
A core module for everyone plus role paths, with a frequency and trigger for each (practices 2 and 4).
- 03
Write scenarios from your own cases.
Agree learning objectives and the behavior you want to see (practice 3).
- 04
Build and test.
Accessible, localized, mobile-friendly modules that report to your LMS in SCORM or xAPI (practices 6 and 10).
- 05
Launch with leaders.
A leadership message, manager briefings and a clear way to ask questions (practices 7 and 8).
- 06
Measure and improve.
Report on all four levels, follow up with people who fail, and update the content at least yearly (practices 9 and 10).
5 costly compliance training pitfalls (and how to avoid them)
| Pitfall | Why it hurts | How to avoid it |
|---|---|---|
| One generic course for everyone | High-risk roles don't get what they need; the DOJ asks specifically about tailored training | Core module plus role paths (practice 2) |
| Reporting only completion rates | Shows activity, not understanding or behavior | Report learning, behavior and results too (practice 9) |
| Click-next slides of policy text | Little practice or judgment; a text-only course does not meet California's interactive training requirement | Scenarios and recall questions (practices 3 and 5) |
| Content that never changes | Misses new rules and your own incidents | Yearly review plus event triggers (practice 10) |
| Off-the-shelf content that doesn't match your policies | Employees learn someone else's rules; OIG notes that a course built for hospitals would not fit a home health agency | Customize examples and policies, or build custom where the risk is specific to you |
Off-the-shelf or custom? Be honest about it: off-the-shelf courses are often the right choice for general awareness topics. California even offers free online harassment courses that meet its requirement. Custom training pays off where your risks, policies, systems or incidents are specific to you, where scenarios must match real roles, or where you need proof of behavior change. Many organizations mix both.
Worked example: from 61% to 82%
Financial services
From 61% to 82%: scenario-based compliance training for 1,200 employees
- Client
- A financial services organization.
- Before
- Annual classroom compliance sessions, with different results by branch.
- What we built
- 6 SCORM modules that replaced the classroom sessions.
- Project details
- The client has branches in 6 countries. The modules covered AML basics, KYC, sanctions screening, suspicious-activity escalation, data protection and code of conduct, with branching scenarios based on the client's own escalation policy. Built in Articulate Storyline 360, 75 minutes in total, in 3 languages. The score was measured as the average of the post-training assessment in the first year, compared with the previous year's classroom test (client LMS reports).
This project applied practices 3 and 9: scenario-based decisions instead of classroom slides, one consistent course for every branch, and a measured result. See how we approach financial services eLearning and compliance eLearning projects. IKHYA is a custom eLearning development company that has delivered eLearning since 2010. Our 120+ specialists have completed 500+ projects for clients in 40+ countries, in 40+ languages.
Frequently asked questions
Compliance training is training that teaches employees the laws, regulations and internal policies that apply to their role, and how to act when a real situation tests them. It covers topics such as harassment prevention, data privacy, anti-bribery, safety and the code of conduct. More in What is compliance training, and why does it matter?
Some of it is. Specific laws require certain training, for example California and New York harassment prevention, HIPAA privacy training and several OSHA safety standards. Other training is expected by regulators' guidance rather than required by one law. See the table in Which compliance training is required by law?
It depends on the rule: annually for some (New York harassment, OSHA bloodborne pathogens), every two years for California harassment, and at hire or after changes for others such as HIPAA. A common pattern is a yearly refresher plus event-driven training. More in How often should compliance training happen?
Include the rules and policies that apply to the learner's role, realistic scenarios, how and where to raise concerns, non-retaliation, the consequences of misconduct, and a knowledge check. Health care organizations can also use OIG's list of program topics. See 10 compliance training best practices.
Yes, online training is a valid format for many requirements. California explicitly accepts individualized, interactive eLearning for its harassment requirement, and OIG lists computer-based training as an option. Check that the course is interactive, tracks completion and gives learners a way to ask questions.
Yes, for employers covered by the FMCSA drug and alcohol rules. Everyone designated to supervise drivers needs at least 60 minutes of training on alcohol misuse and 60 minutes on controlled substances. Recurrent training is not required by that rule.
Publish courses in SCORM or xAPI so your LMS records each person's completion, score and date, and keep the course version with the record. The same approach works for customers, partners and agents if they take courses in your LMS. More in practice 10.
Use off-the-shelf courses for general awareness topics. Build custom training where your risks, policies or systems are specific to you, or where you need scenarios that match real roles. See 5 costly compliance training pitfalls.
There is no single best tool. Articulate Rise 360 suits fast, responsive courses that adapt to phones and tablets; Articulate Storyline 360 suits detailed branching scenarios. IKHYA builds in both, and in Adobe Captivate, Lectora, iSpring Suite, dominKnow ONE and Elucidat. Read more about Articulate Rise for compliance training.
Yes. IKHYA builds courses in SCORM 1.2, SCORM 2004, xAPI and HTML5, and LMS platforms we have delivered courses to include Moodle, TalentLMS, Docebo and Cornerstone. We translate and localize into 40+ languages with human or AI voiceover. More in practice 6.
Need compliance training your people will actually use?
Tell us your topics, audience and LMS, and we will suggest the right mix of core and role-based modules.
