Table of Contents
Training in an internal compliance programme is a written element with a named owner, a defined population, a content standard, a frequency, a competence test and a record. Most programme documents give it two sentences. That is the gap a reviewer finds first. The element has to state who gets trained, on what, how often, how competence is checked, and where the proof sits.
Regulators publish the expectation at a very high level. Export control guidance says to train all employees whose responsibilities relate to exports, including support staff. It does not set a frequency, a depth, a pass standard or a record format. Those decisions are yours, and you have to be able to defend them.
Get them wrong and your programme document describes a regime you cannot evidence. Get them right and a compliance review turns into a filing exercise.
What the training element is actually for
It has three jobs, and they are separate.
The first is capability. People who classify goods, screen counterparties, sign declarations or agree contract terms need to be able to do those things correctly. The second is transmission. Your programme contains company-specific procedures, and nobody follows a procedure they have not been shown. The third is evidence. When a regulator, a customer audit or an internal review asks how you knew your staff were competent, the training record is the answer you hand over.
Programmes usually do the second job and forget the first and third. Everyone sits through the annual deck. Nobody can show that the person who signed last quarter’s declarations understood them. If the underlying programme is still being built, start with what trade compliance covers as a function.
Where training sits among the other elements
A written programme normally runs to a set of named elements: management commitment, risk assessment, written procedures, screening, training, record keeping, audit, reporting and escalation, and corrective action. Training is not a standalone. It is the element that makes the others work, and it takes an input from each of them.
- The risk assessment tells you which roles carry the exposure, so it sets your population.
- The written procedures supply the content. If a procedure changes, the training content changes.
- The audit element supplies your effectiveness signal. Audit findings by role should feed straight back into the curriculum.
- Corrective action supplies the trigger for remedial training after an error or an incident.
- Record keeping sets the retention rule for training files.
Write those five dependencies into the training element by name. It stops the annex drifting out of date, because every change to another element now has an obvious knock-on. It also stops the common failure where a procedure gets revised in March and the slide deck still describes the old process in November.
Attendance evidence and competence evidence are different
This is the distinction most programmes miss, and it is worth being blunt about it.
Attendance evidence proves delivery. A sign-in sheet, a learning system completion flag, a date stamp. It answers the question “did we run the training”. Competence evidence proves capability. A scored assessment, a reviewed work sample, a supervised sign-off, a certificate from an independent assessment. It answers the question “can this person do the task”.
Attendance evidence is cheap and weak on its own. If someone made a classification error in June and your only proof is that they sat through a session in February, you have shown the error happened despite training. Competence evidence is harder to produce and far more useful, because it lets you set a threshold for who is allowed to do what.
The practical rule: use attendance evidence for the awareness tier and competence evidence for anyone with authority. Nobody should be classifying, screening or approving contract terms on the strength of a sign-in sheet.
What your programme document should say about training
Scope and population
Name the tiers and define who falls into each by job function, not by job title. Titles change. Functions do not. A line like “anyone who selects or confirms a delivery term on a customer order” survives a reorganisation. “Export Sales Executive, Grade 4” does not.
Content standard per tier
List the topics each tier must cover, and say which internal procedure each topic maps to. Awareness content usually covers what the rules are for, the red flags to escalate, and who to call. Role content goes deep on the specific task: classification method, screening procedure, licence determination, document set, or the contract terms the role agrees to.
Frequency and triggers
Set a baseline interval and then list the event triggers that override it. Triggers that belong in the text: a regulatory change affecting a procedure you rely on, a move into a new market or product line, an internal or external audit finding, a near miss or a voluntary disclosure, a change of role, and a new hire joining a tier. Write the triggers down. A calendar-only rule leaves you training people eleven months after the thing they needed to know changed.
Assessment standard
State how competence is tested for each tier that needs it, and state what happens on a fail. This is where most annexes go silent. A test with no consequence is attendance evidence wearing a hat.
Ownership
One named role owns the element. One named role signs off the curriculum. Line managers own completion for their people. Put all three in writing, because shared ownership of training means nobody chases the stragglers. The compliance manager’s remit normally covers the first two.
| Training layer | Who it covers | What the programme text must fix | Evidence that proves it |
|---|---|---|---|
| Awareness | Everyone whose work touches an order, a shipment or a payment | Topic list, refresh interval, delivery format | Completion log with date and the version of the material used |
| Role specific | Sales, procurement, engineering, logistics, finance, contract owners | Topic map per function, depth, who approves the curriculum | Per-role curriculum document plus per-person completion record |
| Competence for authority | Anyone who classifies, screens, signs a declaration or approves terms | Assessment method, pass standard, consequence of a fail | Scored result, reviewed work sample, or an independent certificate on file |
| Management | Officers, department heads, budget holders | Liability, escalation routes, reporting lines, resourcing duty | Attendance record plus a signed acknowledgement of the policy |
| Third party | Contractors, temporary staff, agents, overseas affiliates | Whether they sit inside your programme or their own, and the contract clause | Clause reference plus the evidence the third party supplies |
The record fields that survive a review
A training record is a compliance record. Treat it the way you treat a customs file. For every session, keep the date, the audience tier, the topic list, the version reference of the material, the trainer or provider, and the list of attendees. For every person, keep the tier they sit in, every completion with its date, every assessment result, and the date their authority to perform a task was granted or withdrawn.
Version reference is the field people skip and regret. If you cannot show which version of the screening procedure was taught in a given session, you cannot show that the person who got it wrong had been taught the current process. Align retention for training files with the retention rule you already apply to your customs and export record set, rather than leaving it to the learning system’s default. The same logic that makes a good audit trail in a screening file applies here.
Where an external certification fits
An outside credential is competence evidence for a defined subject area. It is not a substitute for procedure training, and no programme should treat it as one. A certificate cannot tell anyone how your company classifies, which screening tool you use, or who signs off a licence determination. Only internal training does that.
Used properly, an external assessment is marked by someone with no interest in the result, tests a defined syllabus rather than whatever the trainer remembered to cover, and produces a dated artefact you can file against a named person.
Match the credential category to the gap. Government-issued licences cover a regulated activity and carry legal standing, and nothing substitutes for them. Association certificates signal broad familiarity across a field. Employer-run internal programmes prove knowledge of your own procedures and nothing beyond your walls. Independent subject assessments sit in between: narrower than a licence, but externally marked and specific.
If the gap in your programme is on the contract terms side, that is the specific scope of the Global Trade Contracts Specialist certification. It is an online exam of 60 questions in 60 minutes, with an 85% pass mark, one retake included. It is delivered and marked by ClassMarker, an independent online assessment service, and the result comes back with a topic-level breakdown you can file as competence evidence. It assesses eight domains: delivery terms and risk transfer, customs, classification and origin, trade compliance, sanctions and ethics, governing law and dispute resolution, payment and credit risk, risk allocation and remedies, title, documents and carriage, and tax, currency and pricing.
Be clear about what that does and does not give you. It is a contracts assessment. It is not a customs broker licence, not a government qualification, and not a general export compliance credential. If the gap in your programme is licence determination or screening procedure, a contracts exam will not close it, and you should say so in your own documentation. The detail of what the GTCS exam covers is worth reading against your own role map before you fund anything.
Contractors, temporary staff and affiliates
Your programme covers people, not payroll categories. A temporary worker raising export documents is inside the population. So is a contracted freight coordinator who selects a delivery term. So is an agent screening customers on your behalf in another country.
Two workable models. Bring them inside your training and record them as you record employees, or require evidence from their own programme through a contract clause and keep it on file. Pick one per relationship and write it into the annex. The failure mode is assuming the other side has it covered. Where screening is the outsourced activity, settle what can and cannot be outsourced first.
When someone fails or skips it
Write a ladder and follow it. A missed deadline gets a manager reminder at a stated interval. A repeat miss escalates to the department head. A failed assessment triggers a retake within a set window, with a second failure removing the person’s authority for the task until they pass, and the work reassigned in the meantime.
Removing authority sounds harsh and is the part that gives the element teeth. It also protects the individual. If a person has been performing a task without demonstrated competence and something goes wrong, the programme is what put them there. Practical design choices for compliance training matter here, because a badly written assessment produces failures that say nothing about capability.
Key takeaways
- Training is a named element of a written compliance programme, with an owner, a population, a content standard, a frequency, an assessment and a record.
- Export control guidance requires training for employees and support staff whose duties relate to exports, but sets no frequency, depth, pass standard or record format.
- Attendance evidence proves the session happened. Competence evidence proves the person can do the task. Authority to classify, screen or approve terms should rest on the second.
- Define the population by job function rather than job title, so the annex survives reorganisations.
- Keep a version reference for every session so you can show which procedure was taught and when.
- An external certification is competence evidence for a defined subject area and never replaces training on your own procedures.
- The GTCS certification introduction sets out a contracts-focused assessment: 60 questions, 60 minutes, 85% to pass, one retake included, marked by ClassMarker.
Frequently asked questions
Does an internal compliance programme have to include training?
Training appears as a core element in the compliance programme guidance published by export control and sanctions authorities. The expectation is that people whose work relates to controlled activity are trained, including support staff. A programme document that omits the element, or covers it in a single line with no population, frequency or record, is the kind of gap a reviewer flags quickly.
How often should the training element require refreshers?
No published rule sets a universal interval, so you set one and justify it by risk. A common shape is a baseline cycle for awareness, a shorter cycle for high-exposure functions, and event triggers that override both. Triggers include regulatory changes, audit findings, new markets or products, incidents, and role changes. Write the triggers into the annex rather than relying on a calendar alone.
What training records should we keep, and for how long?
Per session: date, audience, topics, material version, trainer, attendees. Per person: tier, completions with dates, assessment results, and the dates task authority was granted or withdrawn. Align retention with the period you already apply to your customs and export records, rather than accepting whatever default your learning system applies. Keep them retrievable by person and by date.
Can a certification replace internal compliance training?
No. A certification is externally marked evidence that someone knows a defined subject. It says nothing about your classification method, your screening tool, your escalation route or your approval matrix. Use it alongside procedure training, as competence evidence for named roles. A programme that swaps one for the other has removed the part that transmits its own procedures.
Who should own the training element?
One named compliance role owns the element and approves the curriculum. Line managers own completion for their own staff, because they control the diary and the workload. Senior management owns the resourcing. Naming all three in the document prevents the standard failure where training is technically everyone’s responsibility and therefore nobody’s.
How do we show the training element is working?
Completion rates only show delivery. Look instead at movement in the operational signals: classification corrections raised after the fact, screening alerts resolved incorrectly, documentary discrepancies on payment presentations, and audit findings repeating by function. Break those figures down by team and compare each team against its own earlier position.
If you are rewriting the training annex and want a second view on where competence evidence should sit, get in touch with the Globalior team.