The Training Completion That Wasn't
A regional bank rolled out mandatory anti-bribery training to 1,400 employees. The learning system shows 96 percent completion, which the compliance officer plans to report to the board as evidence of a strong culture. A routine audit sample of 40 records finds that 11 completions were logged by managers on behalf of their staff, a feature the vendor calls 'bulk attest.' In 6 of those 11 cases, the employee never opened the module. Two of the six work in the trade-finance unit that handles high-risk payments. The bank's policy says completion means the employee personally completed the module. The vendor confirms bulk attest is enabled by default and that most clients leave it on. The compliance officer argues that the 96 percent figure is still directionally accurate and that re-running training would disrupt business. The board packet is due in ten days.
1. How should the compliance officer characterize the 96 percent figure in the board report, and what should be done before the packet is finalized?
Read the worked answer
The 96 percent figure cannot be reported as personal completion. The policy defines completion as the employee personally completing the module, and at least 11 sampled records violate that definition, 6 of them with no module access at all. A sample rate of roughly 27 percent irregularity is too high to call the metric 'directionally accurate' without qualification. Directional accuracy is not the standard for a board representation; accuracy is.
Before the packet is finalized, the officer should do three things. First, pull system logs to identify every bulk-attested record, not just the sample, and separate those with no access from those where the employee may have completed the content another way. Second, disable bulk attest and require personal completion going forward. Third, report the corrected number with a clear note: personal completion is X percent, Y records were logged by managers, and remediation is underway for the subset with no evidence of completion.
The officer should resist the 'disruption' argument. Ten days is enough to disable the feature and start remediation; it is not enough to re-train 1,400 people, and the report should say so rather than overstate progress. Presenting a manager-attested figure as personal completion would itself be a misrepresentation to the board, which is a worse outcome than an honest lower number.
2. What should happen to the two trade-finance employees and the managers who attested for them, and how should the bank treat the vendor configuration issue?
Read the worked answer
The two trade-finance employees need immediate attention because their unit handles high-risk payments. The bank should determine whether they performed any function requiring anti-bribery knowledge during the gap, and if so, whether any transactions need review. They should complete the training promptly, and their managers should confirm in writing that the employees understand the content. Discipline depends on intent: if the employees asked managers to log completion, that is a policy violation warranting formal discipline; if managers acted unilaterally, the employees are not at fault for the logging but still owe personal completion.
The managers who attested for employees who never opened the module misrepresented completion. That is a conduct issue, not an administrative shortcut, and should be handled under the discipline framework with proportionate sanctions and a documented rationale. The bank should also ask whether managers were pressured by completion targets; if so, the targets are part of the root cause and should be redesigned so managers are not rewarded for logging rather than learning.
On the vendor, the bank should treat the default-on bulk attest as a configuration control failure. The contract should be reviewed to see whether the vendor disclosed the default, and the bank should require written confirmation that the feature is disabled and that future defaults cannot be changed without notice. The audit finding should be logged, tracked to closure, and reported to the board alongside the corrected metric.