Most organisations have mandatory learning: information security, health and safety, data protection, codes of conduct, industry regulation. It has to be done, it has to be tracked, and it is often the least loved learning in the catalogue.
The usual result is a long module that restates the policy, ends with a short quiz and is clicked through as quickly as possible. The organisation gets a completion record. Whether behaviour changes is far less certain.
Why compliance learning gets clicked through
- It is written from the policy outwards, so it explains rules rather than situations people recognise.
- It treats every role the same, even though a call-centre agent and a finance manager face very different risks.
- It is repeated annually with little change, so experienced staff learn to skip it.
- The assessment tests recall of wording rather than judgement in context.
Start with the decisions, not the document
Before writing any content, ask: what are the moments at work where this policy actually matters? For data protection, that might be sending a spreadsheet to the wrong recipient, discussing a customer’s details on a call, or deciding whether a request for information is legitimate.
Work with the policy owner and people who do the job to list these moments. Each one becomes a candidate for a short scenario. The policy becomes the reference that explains the right choice — not the script of the course.
Use scenarios with realistic consequences
Scenario-based learning places people in a situation, asks them to choose, and shows what happens next. Good scenarios are short, specific and a little uncomfortable — the wrong answer should look reasonable, because that is how mistakes happen in real life.
- Use names, settings and language from your own workplace.
- Make the consequences realistic rather than dramatic.
- Explain why each option is right or wrong, referencing the policy only where it helps.
- Branch where it adds value: a second decision after a first mistake is often where the learning happens.
Tailor by role and keep it short
Not everyone needs everything. A short core module for all staff, followed by role-specific scenarios, respects people’s time and increases relevance. Microlearning — short pieces released through the year — can also keep important topics visible without one long annual event.
Assess judgement, not memory
Replace questions such as “Which section of the policy covers…” with situations that require a decision. If someone can pass by recognising the wording of a correct answer, the assessment is measuring the wrong thing.
Track what matters
Completion records remain important for audit and governance, and your LMS should make them easy to produce. Where possible, look for additional signals: which scenarios are most often answered incorrectly, questions raised with compliance teams, or changes in reported incidents. These help you refine the content each year rather than simply reissuing it.