How to design a compliance training course that passes an audit

Start with the outcome, not the content

Write the learning outcomes before you write a single slide. An outcome is a plain statement of what the learner will be able to do after the course, expressed with a verb an assessor can test, such as identify, apply, or report. Vague outcomes like understand or be aware of cannot be assessed, and an outcome that cannot be assessed cannot be evidenced, which is exactly what an auditor looks for.

For a compliance course this matters more than for most subjects, because the point is behaviour under a rule, not recall of the rule. An anti money laundering course whose outcome is knows the regulations is weak; one whose outcome is can identify and escalate a suspicious transaction is auditable, because you can set a task that tests it.

Map every outcome to the source it comes from

Tie each outcome to the specific obligation it exists to serve, and keep that map. Compliance content dates fast, so an auditor will ask where an outcome came from and when you last checked it. A course that cannot show its source is a course nobody can trust to be current, and any outcome that maps to no real obligation is padding you can cut.

Design the assessment at the same time as the outcome

Decide how each outcome will be assessed while you are still writing it, not after the content is built. If the outcome is can identify a suspicious transaction, the assessment is a scenario where the learner has to spot one, not a multiple choice question about the definition. Assessment that only tests recall will not survive scrutiny on a course that claims to change behaviour.

Write the marking criteria in the same breath, so an auditor can see that two assessors would reach the same decision on the same evidence.

Build the records before you deliver, not after

Decide what evidence each learner will generate and where it will live before the first cohort runs. The record is the part auditors actually inspect: who enrolled, what they were assessed on, what they scored, who signed it off, and when. A brilliant course with no retrievable records fails, and a modest course with clean records passes.

• Enrolment and identity, so the certificate belongs to a real, named person
• The assessment attempt and result, tied to the outcomes
• The assessor decision and date, with a name against it
• The version of the course the learner took, because content changes

Version and date everything

Put a version number and a review date on the course and on every assessment. When a regulator changes a rule, you need to show which learners took the old version and which took the new one, and you cannot do that without versioning. An undated compliance course is a liability the day the law moves, so build in a review trigger that checks the content on a set cadence and after any material change, and record each review.

Decide the recognition route before you sell it

Choose how the course will be recognised before you market it, because the claim you make has to be true. A course can be a regulated qualification, a credit rated qualification, CPD certified, or simply internal, and each carries a different promise. Selling a course as accredited when it only carries CPD certification is the fastest way to fail an audit and lose a client. If you want the course to carry a framework level, that decision shapes the design, so make it early. Our accreditation services page sets out the routes, and the course development service covers the build.

Common failure points, and how to avoid them

Most compliance courses that fail an audit fail for the same few reasons, and all of them are avoidable at the design stage.

• Outcomes that cannot be assessed, so nothing can be evidenced
• Assessment that tests recall when the outcome claims behaviour
• No version control, so you cannot prove who took what
• Records scattered across inboxes and spreadsheets rather than one system
• A recognition claim the course cannot actually support