Picture this: It’s 4:30 PM on a Tuesday. You’re just about to start winding down when an email lands in your inbox with the subject line "URGENT." IT found out that another department is using new software without approval, and now the demand is clear: "We need to train everyone on the procurement policy, like, yesterday."
If you’ve worked in compliance long enough, you’ve probably experienced a similar frantic request. A department becomes aware of a problem, and they insist on training because it feels like a tangible, visible, we're-doing-something-about-this solution. It's the corporate equivalent of putting a bandage on it.
But what happens when the bandage doesn't stick? What if the problem isn't a paper cut, but a low-level headache that just needs a couple ibuprofen? 🤕 Jumping straight to training without a quick diagnosis wastes time, and—worst of all—it’s likely that the exact same problem will crop up again in a few months.
Be the hero who asks the smart questions
Before you agree to do any training, take a deep breath, and diagnose the issue and solution by asking yourself these four questions.
🌟 Question 1: What do we actually want people to DO? (The "Behavior" Question)
Don’t get stuck on making sure people "understand the policy" or "are aware of the regulation." Nobody needs to be able to recite your policy manual from memory. Be specific. What’s the observable behavior you need to see (and measure)?
- Avoid the trap: "Train them on the T&E policy."
- Be strategic: "We need employees to upload an itemized receipt for any meal over $25."
This one shift changes everything. You’re no longer teaching a law class; you’re giving someone a clear, simple action to take. It's the difference between telling someone to "learn about basic automotive engineering" and showing them "here's how you change a flat tire."
Wait...why do I need to know all this again?
Audi via giphy.com
🛣️ Question 2: Could a guardrail fix this instead of a lesson? (The "Internal Control" Question)
Don’t assume the problem is that people don't know what to do. More often than not, they know... They just forgot. Or they're in a hurry. Or the right way is just plain harder than the wrong way. We're all human.
Now that you know the behavior you want to see, think about how to make the right thing the easy thing. Or better yet, make the wrong thing impossible. This is where internal controls come in. It's about building a guardrail on the side of the road instead of doubling down on driver's ed courses.
- Avoid the trap: “We need to train people to get approval before they buy software.”
- Be strategic: “I contacted our purchasing system vendor to add a required approval step for all new software purchases. That way, purchases can’t go through until a security review is completed.”
Problem solved. No training needed.
🏆 Question 3: How do we know if we've won? (The "Measurement" Question)
Again, focus on the behavior you want to see and document what people are doing now. If you don’t know where you are, you’ll never know if you got where you wanted to go.
- Avoid the trap: “All the key players are trained. Victory!”
- Be strategic: "Right now, IT is spending about 10 hours a month finding and remediating unapproved software. Our goal is to reduce that to zero. That way, their time can be reallocated to higher-value security projects."
Now you have a target. Every single thing you do—whether it’s training, a new control, or a simple checklist—should be aimed squarely at moving that number. It keeps the project focused and proves your work has a real impact.
🍊 Question 4: Is the juice worth the squeeze? (The "ROI" Question)
It's easy to think of training as a magical, cost-free solution, but it’s not. It costs money to create, sure, but the biggest cost is your employees' time. An hour spent in training is an hour they aren't spending on their actual jobs.
Do some quick, back-of-the-napkin math. What's the real cost of the problem versus the cost of the training? Sometimes, the risk is so massive that you have to do training, no matter what. But this calculation still helps you be smart about the solution.
- Avoid the trap: "IT is spending a ton of money monitoring for unapproved software. We need to deploy training quickly to save money and resources."
- Be strategic: "IT is spending an estimated $20k annually, and I calculate that a half-hour mandatory training for 500 people costs us $25k in lost productivity. I recommend trying a two-minute video and a software purchasing checklist first. That could solve most instances of the problem for a fraction of the cost."
This kind of thinking doesn't mean "do nothing." It means "do something smarter."
You deserve a royale with cheese for that insight.
Miramax Films, Pulp Fiction via giphy.com
From order-taker to problem-solver
By asking the right questions, you can move from being a reactive order-taker to a thoughtful compliance diagnostician. In the process, you’re freeing up your team’s time to focus on the things that are a better use of their talents.
To recap, before you start hurriedly sketching out a training course:
- Focus on what people need to do.
- See if a guardrail can keep them on track.
- Know what winning looks like before you start.
- Make sure the effort is worth the reward.
This way, the next time that "URGENT" training request comes in, you’ll be ready. You're not going to just throw some training at the issue and hope the problem goes away. Instead, you’ll strategically solve it by performing a diagnostic test—saving money for your company, time for your team, and sanity for yourself.