I’ve wanted to write about this for a while, but something always stopped me. I don’t know what exactly, but wading into a disagreement with regulators might be one of them. Stirring the pot has never really been my M.O.
So, why now, you ask? I guess I’ve just finally hit my limit of hearing, “You need to do X hours on Y topic.”
“Hi! Welcome to your training! This is super important and we really mean it, so you’re gonna sit here for the next two hours while I talk at you. Hope you used the bathroom!” | Source: YouTube, Britney Spears Baby One More Time Official video via Giphy.com
From my research, it seems that timing obligations for training typically start from a good place—someone sees a lack of understanding about a given (and usually bad) thing and decides that training on that topic will mitigate risks. And that’s all great! Policies, processes, rules, etc., should come from a place of wanting to solve a problem. Things go sideways when the solution implementation shifts from problem-solving in a way that can actually influence good behavior to a ‘check-the-box’ approach. ☑️👎
Here’s a simple example: Stop signs are super important because they help manage traffic and mitigate accidents. Before you took your driver’s test, did you have to sit in a room and contemplate a stop sign for two hours to understand that it’s important to stop when you see one? No, you didn’t. Did that minimize the stop sign’s importance during driver’s ed training? No, it didn’t.
So why do regulators* insist on a given amount of time on other topics?
Because they’ve lost sight of the goal.
(*I say “regulators” here because that’s generally where these time-based requirements come from… I’m not saying that an org never makes a similar decision, but that’s just not typically how this rolls.)
Training isn't the goal.
The goal is to make sure your org and the people in it comply with whatever law, policy, or ethical standard the compliance training is about. Training is just one possible way to get there.
Think of it this way: Is the point of training to document that someone took two hours of harassment training, four hours of anti-bribery training, and three hours of code training? Or is it to achieve a harassment-free workplace, less fraud and corruption, and a common understanding of where to go when questions arise? I think we can all agree, it’s the latter. 😉
But again, credit where credit is due: Laws with time-based requirements mean well, but end up focusing on the wrong thing. Exposing people to information for X hours rarely changes how they behave. Therefore, the act of doing the training doesn't matter. Achieving actual compliance matters.
That said, the frame of mind that "time = behavior" isn’t the only issue; there are bigger problems at work here.
- Time-based obligations perpetuate the fallacy that compliance is a check-the-box activity. ☑️ Those types of training sit outside of doing the actual job. They are separate tasks that employees have to do for a certain amount of time on a certain schedule, rather than a part of their normal operations.
- When used as part of corporate remediation, time requirements frame compliance training as a punishment. 🚽 I’ve literally had this issue impact my program, and it stinks. Our employees were never mad at the government for making them do a set amount of hours of training every year. They were mad at me and my team. And that made it that much harder for us to connect with them on risk issues that we really needed to mitigate.
- Time requirements give a false sense of risk mitigation 🚧 because the monotony of the perceived required task (sitting through training) obscures the value of the actual required task (doing something compliantly).
- And finally, the training itself is worse because it’s set up primarily to meet an arbitrary timing requirement. ⏳
Should time ever come into play?
Yeah, it should! Some things might need a little more time to impart, and it's up to you to determine what those things are, and how much time they should take. This is where the importance of you and your role at your org really shines. You know the risks. You know the triggers. And you know when and where they happen. (And if you don’t, go find out.) Then, based on what you know, you can craft training to mitigate the risks and catch the triggers before they happen.
Hint: Manager-led discussions are just one example of effective time-based training. There are others, but that's a post for another day!
Where do we go from here?
Regulators: Stop it.
Source: The Ellen Show on Warner Bros. Television via Giphy.com
The issues you want to tackle are important, but you’re not promoting compliance with time obligations. All you’re doing is perpetuating the check-the-box fallacy and signaling that all you really care about is optics. Oh, and you’re also perpetuating "paper programs"—which you spend a lot of time chastising us for!
If you want people to do X, then require them to show X—not talk about X for a set amount of time.
Compliance Pros: It depends. (The awesome, go-to legal answer, amirite!)
Source: Hikōnin Sentai Akibaranger, Episode 18, via Giphy.com
Actually, “it depends” is exactly what we want. We want to make an impact with our programs, and tackling risk mitigation with training, communications, messaging, and all the tools in our toolboxes is how to do it!
I’ll leave you with a final thought: If you don't have a legal requirement to do X hours of training, DON'T MAKE ONE UP or let your leadership bully you into one. If you do have a legal requirement, that stinks and I'm sorry. I’ve been there and am happy to commiserate anytime you need to vent.