On this page
The artefact at the centre of most mandatory training programmes is a completion report. A percentage, a date range, a green bar.
It proves one thing: that a course was delivered to a list of people. It does not prove the list was the right list, that the content was the version in force at the time, that anyone understood it, or that the people who did not complete were chased. Those four things are what an auditor samples.
So the gap most organisations find under audit is not a coverage gap. They almost always have the courses. It is an evidence gap, and it opens in the space between the system that knows who works here and the system that knows who was trained.
Consider a hospital group preparing for accreditation. Every mandatory module is assigned and the dashboard reads 98%. The assessor asks for training records covering everyone with access to patient data. That list includes agency nurses, a contracted radiology team and two vendor engineers with system credentials. None of them exists in the HR system, so none was ever enrolled, so none appears in the 98% or in the 2%. They are not late. They are invisible.
Why do industries have mandatory training?
Because in regulated work an employer's duty does not end at telling someone what the rule is. It extends to being able to show afterwards that the person was told, when, and by whom.
Four forces sit behind that.
- Statutory duty of care. Where work can injure someone, safety training is a condition of operating rather than a development activity, and the obligation runs to the employer whether or not the individual sought it out.
- Licence and accreditation conditions. Hospitals, banks, airlines and utilities hold permissions that are periodically reviewed. Training records form part of that review, so a documentation failure can put the permission itself at risk.
- Liability defence. When something goes wrong the question becomes what the employer did to prevent it. A dated, versioned, assessed training record is the difference between a defensible position and an indefensible one. A verbal briefing is not a defence.
- The obligation set keeps expanding. Requirements accumulate faster than they retire, and they now reach into new territory. Article 4 of the EU AI Act requires providers and deployers to take measures towards AI literacy among staff operating AI systems on their behalf, an obligation that has applied since February 2025. National market surveillance authorities began supervising and enforcing it in August 2026.
The fourth force changes the shape of the problem rather than just adding to it. A safety regulation applies to a defined population doing a defined task. An AI literacy obligation applies to whoever happens to be using an AI tool, which in most enterprises is a population nobody has mapped.
One distinction decides how you resource all of this. Mandatory training is compelled by statute, regulation or contract, and non-completion creates external liability. Everything else in the catalogue is expected, encouraged or internally required, and non-completion is a performance conversation. Organisations that blur the two defend a code-of-conduct refresher with the same energy as a lockout procedure, and under-resource both.
What trainings are mandatory in the workplace?
There is no universal list, and any article offering one is describing a jurisdiction rather than a rule. What is mandatory for you depends on where you operate, what sector you are in, what hazards or data you handle, and what your contracts commit you to.
The obligations most regulated enterprises encounter cluster into six groups.
- Health and safety. Hazard handling, equipment operation, emergency procedures, protective equipment. Usually the most prescriptive, often with defined refresher intervals.
- Data protection and privacy. Required wherever personal data is processed, with specifics set by the applicable regime rather than a global standard.
- Information security. Frequently a condition of a certification or a payment-scheme rule rather than a statute, which makes it contractual rather than legal, and no less binding.
- Sector conduct. Anti-money laundering and know-your-customer in financial services, clinical and infection control in healthcare, airworthiness and human factors in aviation.
- Workplace conduct. Harassment prevention and anti-discrimination, mandated in some jurisdictions and merely expected in others, which is why the mapping has to be done by location.
- Technology use. The newest category, and the one most catalogues have not caught up with.
Two things matter more than the list.
Scope is defined by exposure, not by employment status. If a contractor handles patient records, the privacy obligation attaches to that activity. Whether they sit on your payroll is a question about your enrolment system, not about your duty.
And the content version is part of the record. When a regulation changes the training changes, and the record has to show which version each person took. An employer who cannot demonstrate which version was in force when someone was trained holds a record that establishes attendance and nothing else.
What steps to do mandatory training
Six steps, and the order is the point. Most programmes start at step four.
- Build the obligation register before touching the catalogue For every site and jurisdiction, list the requirement, its legal or contractual source, the population it covers, the required frequency and the evidence it demands. Done honestly this is usually shorter than the catalogue currently being assigned, and it contains two or three things nobody was doing.
- Define each population by exposure, not by department Write the in-scope rule as a condition: anyone with access to production patient data, anyone entering the plant floor, anyone using an AI tool for customer-facing output. Then check whether your enrolment system can resolve that rule against real people. Where it cannot, that is your first finding, and you found it rather than an auditor.
- Version and date everything at the point of assignment Each assignment should carry the content version, the effective regulation date and the assessment used. Retrofitting this after a regulation changes is close to impossible, which is why it has to be a property of the assignment rather than a report generated later.
- Deliver in a format the population can actually use Site staff, shift workers and field teams do not complete desk-based modules, and a programme that quietly excludes them has a hole in it. Frontline delivery that works on a phone and offline is a compliance requirement in those settings rather than a convenience.
- Assess, do not just deliver A knowledge check turns a delivery record into evidence of comprehension. It is also the only mechanism that tells you a module is not working before an incident does.
- Run exceptions as a process, not a chase Escalation paths, deadlines, documented follow-up, and a record of what happened to each non-completer. Assessors sample exception handling specifically, because it shows whether the programme is managed or merely reported.
Steps one and two take longer than everything else combined and produce most of the risk reduction. Steps four and five are where organisations prefer to start, because they are visible and feel productive. A programme that is excellent at delivery and vague about scope will pass its own dashboard and fail an inspection.
HRM vs LMS software: which one is best for your workplace?
Framed as a choice, this is not one. The two systems answer different questions, and the interesting part is the gap between their answers.
| HR system | Learning platform | |
|---|---|---|
| Question it answers | Who works here, in what role, at which site | Who was trained, on what version, when, with what result |
| Source of truth for | Employment record, job code, location, reporting line | Assignment, completion, assessment, certification, expiry |
| Population it holds | Employees on payroll | Everyone assigned, including contractors and third parties if configured |
| What it gives an auditor | Proof someone was employed | Proof someone was trained and understood |
| Where it fails alone | Cannot evidence comprehension or content version | Cannot know a joiner exists without a feed |
Read the last row of both columns together and the answer follows. The HR system defines who exists. The learning platform defines who was trained. Compliance lives in the overlap and findings live in the difference.
Three consequences worth planning for. The integration matters more than either product's feature list, because a joiner, mover or leaver event that does not reach the learning platform within days produces an untrained person nobody is tracking. Non-employees break the model entirely, since contractors and vendor staff usually have no HR record, so enrolment has to be driven by something else, typically system or site access, and deciding what that something else is remains a governance decision rather than a technical one. And learning modules bolted onto an HR suite tend to report on the review cycle, which is fine for development and useless when a regulator asks who holds the current version of a procedure.
For the compliance-bound portion, compliance training delivered through a learning platform with a native audit trail is what produces the record, while the HR system stays the source of truth for who people are. If you are choosing between platforms rather than mapping obligations, our compliance training LMS guide covers selection criteria in detail.
How an LMS mandatory training dashboard looks in real time
Most compliance dashboards show a completion percentage and a list of overdue names. That is a delivery report. An audit-ready view answers a different set of questions, and it should be readable in the moment rather than assembled the week before an inspection.
What it needs to show, in the order an assessor asks:
| Column | The question it answers | Why the usual dashboard misses it |
|---|---|---|
| Population in scope | Who should have this, by exposure rule | Enrolment runs off the HR record, so non-employees never appear |
| Assigned against completed | Who has it and who does not | The only column most dashboards actually contain |
| Content version per person | Which version each individual took | Version is treated as a content property, not an assignment property |
| Assessment result | Whether they demonstrated understanding | Completion is recorded, comprehension is not |
| Expiry and next due | Who falls out of currency, and when | Certifications tracked at course level rather than per person |
| Exception status | What happened to each non-completer | Overdue lists show the problem, not the handling |
Two things separate a live view from a monthly export.
It has to be cut by the dimensions a regulator uses: site, jurisdiction, role band and system access, not department and cost centre. An inspector arriving at one plant wants that plant, and reconstructing it from a global report while they wait is not a good look.
And it has to update as the workforce changes. A joiner should appear as in-scope-not-yet-trained on their first day, and a role change should recalculate their obligations automatically. Where that runs on a monthly sync, there is a monthly window in which the dashboard is confidently wrong.
Learning analytics that produces those cuts on demand turns an audit from an exercise in reconstruction into a query. And when a regulation changes mid-cycle, Turo converting the revised procedure into updated microlearning in days rather than a quarter is what keeps the version column truthful, because a dashboard reporting currency against outdated content is worse than no dashboard at all.
The platform test is narrow enough to run in a demo. Ask for the full record of one named contractor with system access: scope rule, assignment, version, date, assessment result, exception history. Learning modules built inside an HR suite generally cannot produce it, because the person has no employee record to hang it on. Focused learning products return the completion but not the scope rule that put them in the population. The record has to be constructible for someone who is not on your payroll, because that is exactly who the finding will be about.
Mandatory training FAQs
What risk and L&D teams ask most often about mandatory training.
What is mandatory training for employees?
Mandatory training for employees is instruction an employer is legally or contractually required to deliver and to document. Its defining feature is that non-completion creates external liability rather than a performance issue, which is why records of scope, content version, comprehension and follow-up matter as much as the training itself.
Is mandatory training the same as compliance training?
Mandatory training and compliance training overlap heavily without being identical. Mandatory training is compelled by a specific statute, regulation or contract. Compliance training is often used more loosely to include internal policy and conduct material an organisation expects rather than a regulator requires, where non-completion is a performance matter.
Does mandatory training apply to contractors and temporary staff?
Mandatory training obligations generally attach to the activity and the exposure rather than to employment status, so contractors, agency staff and third parties with system or site access frequently fall in scope. Because they usually hold no record in the HR system that drives enrolment, they are the group most often missing from reporting.
How often should mandatory training be repeated?
Mandatory training frequency is usually fixed by the obligation rather than chosen by the employer, with many requirements specifying annual or biennial refreshers. Where no interval is prescribed, annual is a practical floor for regulatory content, while behavioural risks such as phishing awareness generally warrant shorter cycles.
What evidence do auditors ask for on mandatory training?
Auditors sample records rather than course catalogues. Expect requests for the population in scope and the rule defining it, the assignment and completion date per person, the content version each individual took, assessment results demonstrating comprehension, expiry dates, and documented follow-up for anyone who did not complete.
What happens if an employee does not complete mandatory training?
Non-completion of mandatory training becomes an evidence problem as well as a coverage one, because assessors examine how exceptions were handled. A defensible position needs a documented escalation path, a recorded deadline, evidence of follow-up, and a note of the outcome for each individual rather than an unexplained overdue list.
Before your next audit, check you can say this out loud
For any person in scope, on any date, we can show what they were required to complete, what they completed, which version, what they scored, and what we did if they did not.
Six things have to be true for that sentence to hold:
- The scope rule is written as an exposure condition, not a department list
- Contractors and third parties with access are enrolled by something other than the HR record
- Content version is stamped on the assignment, not just on the course
- There is an assessment, not only a completion flag
- Expiry is tracked per person
- Exception handling is documented, not remembered
If the sentence is uncomfortable today, the fix starts with the obligation register, not with a platform.
