Clicks Are Not Competence: Auditing the Evidence Behind Perfect Compliance Training Scores

Every compliance function has seen the slide: a single line in a board pack reporting 100% completion of mandatory training. It is tidy, defensible on its face and usually produced from a learning management system export. It also tells the reader very little about whether the training changed anything.

For UK firms, the risk is not that completion data is worthless. The risk is that it is treated as the end of the assurance story rather than the beginning. When a regulator, auditor or board member asks what staff actually learned, a completion percentage cannot answer the question on its own.

A perfect score is a question, not an answer

Completion data measures whether someone was assigned a module and reached the end. It may also record a quiz score, a click-through acknowledgement or a certificate. Those are administrative indicators. They do not demonstrate that a employee can recognise a conflict of interest in a live transaction, escalate a suspicious payment, or explain why a particular customer file needs enhanced due diligence.

The audit question should therefore be framed carefully: not "did everyone complete the training?" but "what evidence supports the claim that the training produced the intended capability?" That distinction matters in regulated sectors, where training is often cited as part of the control environment for conduct, financial crime, data protection and operational resilience.

The evidence chain behind a training claim

A useful audit model treats training assurance as a chain rather than a single metric. The chain runs from the requirement, through delivery and completion, to understanding, application in decisions, observed behaviour and incident trends. Completion sits near the start. It is necessary but not sufficient.

If the file contains only the final percentage, the chain is broken. The auditor should identify which links are evidenced, which are assumed and which are missing. That gap analysis is often more valuable than a pass or fail rating.

Test one: sample real decisions, not quiz results

Select a proportionate sample of recent decisions or approvals within the scope of the training. Depending on the firm, this might include gifts and hospitality approvals, conflicts declarations, complaints handling, customer onboarding, outsourcing requests or employee use of AI tools.

For each item, ask the decision-maker to explain the relevant rule and how it applied to the file in front of them. Then compare that explanation with the file record. Does the record show reasoning consistent with the training? Can the person identify the escalation route without prompting? Would a reviewer reaching the same file understand why the decision was made?

The sample should include high-risk teams, new starters, temporary staff and anyone who completed the module some time ago. Results should be recorded as evidenced, partly evidenced or not evidenced. Aggregated themes, rather than individual scores, are usually more appropriate for board reporting.

Test two: use spot questions with practical scenarios

A short scenario-based spot check can test recall and application without turning the audit into a formal examination. Questions should be specific to the firm's procedures: what would you do next, who would you tell, what record would you create and where would you save it?

Compare the answers with the content of the training module. If the same misunderstandings appear across several teams, the issue may sit in the module design, the delivery method or the procedures themselves. A training completion record cannot resolve that ambiguity. The spot check can.

Test three: ask managers what they observe

Line managers are well placed to see whether training has altered day-to-day behaviour. A structured manager observation can ask for examples rather than opinions: where have staff escalated appropriately, where have they missed evidence, and where do they still rely on habit rather than procedure?

This test is particularly useful for detecting ritual compliance. Staff may complete the module and still say, in effect, that they do it because audit asks. That is a behavioural signal worth recording. It does not prove training failure, but it weakens any claim that completion equals capability.

Test four: read incident and near-miss data alongside training records

Incident logs, breach reports, complaints, quality assurance findings and whistleblowing themes can provide a reality check. If training covers fraud red flags and the same control failures continue to appear, the firm should ask whether the training was effective, whether the procedure is workable or whether the risk has changed.

Care is needed before drawing causal conclusions. A rise in reported incidents may reflect better awareness rather than worse behaviour. The audit should triangulate the data rather than claim a direct link. Even so, persistent themes that contradict the training message deserve explanation.

Building a defensible audit trail

The audit should define its scope, sample size, methodology and limitations before fieldwork begins. It should record who selected the sample and why, retain the evidence used and distinguish between direct evidence and management representation. A simple rating scale, supported by examples, is usually more credible than a binary pass or fail.

Remediation should follow the evidence. That might mean targeted refresher sessions, clearer decision aids, manager briefings, revised procedures or a re-test after a defined period. The completion dashboard can remain, but it should be paired with effectiveness indicators and a short narrative explaining what the firm now knows that it did not know before.

The honest conclusion may be that the training was adequate and the evidence supports it. That is a good outcome. The less comfortable conclusion is that everyone passed, the records are complete and nobody can show what changed. Where that happens, the priority is not another completion campaign. It is repairing the evidence chain.