Training that changes what people do

The annual video does not change behaviour

An hour of slides once a year, clicked through at speed, produces a completion record and very little else. The research on security awareness training is consistent on one point: knowledge transfer and behaviour change are different outcomes, and the first does not reliably produce the second.

The requirement asks for awareness training and for records of it, so the record matters for the assessment. Confusing the record with the purpose is how a supplier arrives at an assessment with a full training log and staff who put files on memory sticks.

Five characteristics

Role-specific. What a machinist needs to know is not what a buyer needs to know. Generic training is ignored by everybody because it is addressed to nobody.

Short and repeated. Ten minutes six times a year beats an hour once, and it is easier to schedule around production.

Tied to a real task. Delivered at the point somebody does the thing, not in a room in January.

Concrete about this company. Our files, our machines, our customers, our contract. Generic examples invite the conclusion that this is about somebody else.

With a way to respond. Training that ends in a question invites the reports that the entry on unworkable controls depends on.

Completion is not the measure

Measure behaviour: reports received, workarounds found, transfers made through the authorised route as a proportion of all transfers, incidents where somebody said something early.

Those numbers move when training works and do not move when a video was watched.

Useful, and easy to do badly

Simulation programmes are common and their effects are contested. What is clearer is how they go wrong: when clicking produces embarrassment or discipline, the result is that people stop reporting, which removes the only signal that mattered.

If you run one, say in advance that nobody is punished, report rates rather than click rates, and make reporting a real thing that produces a visible response.

Somebody who has been on the floor

Training delivered by a person who understands the work is heard differently from training delivered by a portal. Where the compliance owner came from quality or operations, this is one of the places that background pays.

An outside specialist is fine for the specialist content and should not be the only voice, because they will be asked practical questions they cannot answer.

Keep them properly, since you need them anyway

Who, what, when, and what the content was. Dated, retained, and retrievable without the person who ran the session.

This is a small administrative habit that costs minutes and is a recurring finding when it is absent, because the training genuinely happened and nobody can show it.

Before access, not within thirty days

The common arrangement is that a new person receives access on day one and training when the next session runs. Reversing that costs nothing: a short induction before the account is enabled, recorded at the same time.

Fit it to the shift, not to the calendar

Ten minutes at a shift handover, delivered by a supervisor, reaches people who will never attend a session in a meeting room. It also reaches all three shifts, which a daytime session does not.

Awareness training is itself a control

The standard requires that people are made aware of the risks associated with their activities and of the applicable policies, and that records exist. So the training is not optional and the record is not optional either.

Which is a reason to do it well rather than a reason to do it minimally: the same effort produces either a compliance artefact or a change in behaviour, and only one of those also protects you.

Elsewhere in people

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.