The future of compliance training

The future of compliance training

Table of contents Adaptive learning in compliance training: the hype, the reality, and the possibilities... Why change? Doesn t the current system work just fine?... 3 3 What s new?... 4 Defining compliance training and adaptive learning... Applying adaptive learning to compliance training... What does this mean in practice?... Where do we go from there in the medium term?... Putting ongoing adaptivity into practice... Summary & recommendations... 4 5 6 6 7 8 2 www.grcsolutions.com.au

Adaptive learning in compliance training: the hype, the reality, and the possibilities Over the last decade, technological advances have had a profound impact on the compliance function across industries. More powerful analytical tools, the arrival of Big Data, automated tracking and reporting, global risk databases, and other innovations have fundamentally changed how compliance works. Somehow surprisingly, compliance training has been one of the exceptions - in most firms, there is no meaningful difference between compliance e-learning used today and that used a decade ago. Things may be about to change, however, as the EdTech revolution makes its way across not only schools and universities, but also companies. Why change? Doesn t the current system work just fine? Perspectives vary, but few would argue that current compliance training methods work. Employees detest compliance training because it is repetitive and takes too long. Companies are frustrated because the process is expensive to manage, sometimes ineffective, and always extremely demanding on their staff s time. As a result, regulators get unfairly blamed although the rules often exist to protect the very employees who complain. In addition, two recent developments are making compliance training an even more important part of risk management for most companies. Firstly, countries around the world are passing an increasing number of new laws and regulations. Secondly, across industries, the number of high profile prosecutions involving significant fines and negative press attention keeps rising in both developed and emerging markets. Depending on jurisdiction and industry, the problems outlined above are more or less urgent, but there is certainly a growing consensus that there must be a better way. Why would such a better way suddenly exist now when it didn t a decade ago though? In two words: technological progress. 3 www.grcsolutions.com.au

What s new? How can technology help with compliance training? For the past few years, an EdTech revolution has been underway in many parts of the world, and in the United States in particular. Incumbents and start-ups alike have both been taking advantage of new technological possibilities to introduce better learning and teaching software to schools and universities. Investments by venture capital funds have followed, with $1.6bn invested into the space in the first half of 2015. As new learning technologies reshape our schools and universities, it is only natural to ask what will this mean for corporate training? May some of the advancements be applicable to the problems we deal with in this space? As it turns out, several such innovations are directly relevant to compliance training. After years of investment from the venture capital community, two key learning innovations in particular have finally been turned from promising ideas into market-ready, commercially viable technologies. These technologies are called adaptive learning and semantic courses. The former refers to learning software that emulates the best teaching method we know: 1-on-1 instruction by human tutors. The latter describes courses that model the structure of the underlying domain and the learner s progress therein, rather than being simple PowerPoint slides with questions. This means that the course explicitly encodes what a given topic consists of (sub-topics), and how can one tell whether the learner knows them or not. Remarkably, applying these two technologies to compliance training solves virtually all of the problems involved: dynamic personalisation to each employee, shorter time to competence, easier course creation and maintenance to keep up with changes in regulations, advanced reporting and analytics for executives, shareholders, and regulators, and even access from smartphones or tablets. Defining compliance training and adaptive learning To see why and how adaptive learning and semantic courses can improve compliance training, let s start with definitions. Compliance training is frequently defined as the process of educating employees on the laws, regulations, and company policies that apply to their day-to-day job responsibilities. In practice, however, compliance training often combines both training and certification. We see this in one of the informal definitions of compliance training as a system that needs to check that employees have certain knowledge and skills [certification] and make sure they learn them if not [training]. Adaptive learning is an educational method which uses computers as interactive teaching devices. Computers adapt the presentation of educational material according to students learning needs, as indicated by their responses to questions and tasks. How do adaptive learning products actually work? A good adaptive learning platform will independently model the knowledge of each concept for each person who takes a given course. 4 www.grcsolutions.com.au

Defining compliance training and adaptive learning This then allows the platform to dynamically, continuously adapt the material and assessment to each individual learner. This continuous teaching/ testing loop thus creates a fully tailored learning path through the content for each learner, reflecting their prior knowledge and learning speed. Applying adaptive learning to compliance training The vast majority of today s compliance e-learning courses are one-off sessions lasting between 15 minutes and 2 hours, typically taken by all staff every year or two, as prescribed either by the regulator or by the company itself. In these sessions, we then want to achieve both objectives: (i) certification, i.e. check that employees have certain knowledge and skills; and (ii) training, i.e. make sure they learn them if not. It is this combined certification/training process that can be significantly improved through adaptive learning s unique continuous teaching / testing loop. How does this work in practice? Today, some courses use the idea of a test out option. In such courses, the learner is presented with the choice to take the test upfront. If they pass (typically by scoring 80%+), their training is finished. If they fail, they have to go through the content, and then re-take the test. This model (test + content + test) is an improvement on the traditional way (content + test), but it is still a binary event that seems to make both learners and compliance staff uncomfortable. Importantly, in such tests, the content displayed afterwards bears no relation to the questions the learner struggled with. By using adaptive learning and in particular its point-in-time adaptivity variant, this binary branching model can be extended into a continuous loop where instead of having one large test for the entire course, we run a successive series of smaller assessments that drill into the sub-areas and identify those the learner struggles with. This pattern creates a much more natural learning experience that s closer to how a human instructor would teach; therefore, this also leads to higher learning retention. 5 www.grcsolutions.com.au

What does this mean in practice? Long-term members of staff can prove that they still know the material in a few minutes without having to revisit the entire course again and again. New joiners, on the other hand, are automatically taught what they need to know, with their understanding verified immediately afterwards. For those in between, i.e. staff who have forgotten one or two concepts, adaptive learning quickly identifies the gaps in their knowledge, then only teaches material for those particular areas, and then re-checks their understanding. Just as importantly, this improvement only requires minimum changes to business processes and is thus easy to implement. Other than replacing the learning software itself, everything stays the same the training is still run on the same periodic schedule, the staff still take their courses online, and the relevant stakeholders still receive regular (but more advanced and powerful) reports. Moving compliance training to adaptive learning systems brings major advantages for each stakeholder: Learners have a more personalised and adaptive learning experience which respects what they already know; this means they pay more attention and stop being frustrated with doing the same course again and again every year. Managers benefit from the reduced burden on employee s time; by recognizing what staff already know, adaptive learning frequently cuts the time to completion by 50%, and often up to 80%. Compliance departments get more advanced visualisations, dashboards, and analytics that allow them to report, assess, and mitigate risks more accurately and effectively. Given the benefits for all stakeholders, it seems inevitable that as companies start using adaptive learning technologies more broadly, a significant proportion of ethics and compliance training is going to move to such systems. Where do we go from there in the medium term? Introducing the point-in-time adaptive learning method described above would lead to a major improvement in the efficiency and effectiveness of compliance training. In the medium term, however, there is an even more powerful way of using technology to improve compliance training: ongoing adaptivity. Let s start from the beginning. Why do we run compliance training every year? Primarily, because we know that people forget. Importantly, however, they do so at vastly different speeds, depending on a number of factors: how much experience they have in a given area, how they learn, how good is their memory, whether they regularly come to contact with such policies in their daily work, or to what extent they find the topic interesting. When we re-run compliance training every year, we ignore these differences. Some people are therefore 6 www.grcsolutions.com.au

Where do we go from there in the medium term? trained too frequently (senior staff who have taken the same course each year for 15 years) while others are not trained enough (junior employees fresh on the job who just came from a different industry). What if instead we could model the probability of knowing something for each individual and each concept? How would we use this in compliance training? Compliance training is a form of risk management. We know that we can never expect all employees to know all policies with 100% certainty. As governments, regulators, companies, and individuals, we therefore make trade-offs and choices about what is or isn t acceptable. Depending on the domain and the risks involved, we then adjust the probability thresholds we are comfortable with. For example, a surgeon is expected to know key operating room protocols with nearly a 100% probability. On the other hand, few companies would require that staff know expense policies by heart even with much lower, say 70%, probability. Staying with this example, rather than running training annually, what a hospital manager would really want to do is to set goals based on probabilities, for example so that if I ask a random surgeon amongst my staff about this principle at any point in time, there is a 95%+ probability that he knows it. Similarly, a financial regulator might require that all client- facing staff constantly have knowledge such that there is a 95%+ probability that they know how to identify signs of a money laundering scheme. Putting ongoing adaptivity into practice How would this work in practice? The first time that employees take a course, its behavior would be very similar to that described in the point-in-time method. From then onwards, however, there would be no scheduled retrainings in a year or some other period. Depending on the employees performance during the initial lesson, the system would model how they forget things over time and when to optimally remind them. Once a sufficient block of material that needs to be revised across all of the courses the learner is signed up for has been accumulated (say, 10 minutes of revision), the system would notify the learner (for example, by email) that they need to come back and do some revision. Such knowledge models would update and selfcalibrate themselves over time using rigorously tested parameters. Typically, this means that a new graduate may have to complete the training when she starts, in 3 months, then perhaps another 6 months later, and then roughly every year, with the period slowly increasing to perhaps every two years if she can always answer all questions without any help. Of course, modelling how people forget is one of the many things adaptive learning can do. The systems do so by drawing on decades of research in psychology and instruction theory, for example in fields related to how humans memorize and forget things. The well-documented spacing effect, in particular, provides actionable algorithms that can be used to both model the probability of knowing something and to decide when to optimally revise things as they are being forgotten. 7 www.grcsolutions.com.au

Summary & recommendations Although ongoing adaptivity is an elegant concept, introducing it as a way to run compliance training unfortunately requires broader changes to compliance training processes, and in some instances, even laws. As such, it is truly a hope for the medium term rather than an actionable tactic. Point-in-time adaptivity, on the other hand, has already become a commercially viable technology on its way to widespread acceptance and adoption. To explore your options for using point-in-time adaptivity in your compliance training program, I recommend the following steps: 1. Define what works and what doesn t. Which parts of your training work well and where are your biggest pain points? Think about time required, learners attitudes, course updates and maintenance, mobility and cross-device compatibility, analytics, etc. That way, you can later accurately assess where adaptivity could help. 2. Engage a selection of vendors. Individual vendors have different perspectives on adaptive learning, whether it matters, and how it should be used. Software companies will often see things differently to firms primarily focused on content. Engage several firms and see whether their thinking about adaptive learning in compliance is aligned with yours. 3. Pick a suitable course and run a pilot. Once you ve chosen a vendor to potentially work with, run a small experiment. Pick a course that you think could be meaningfully improved through compliance training and work with the vendor on turning it into an adaptive course. They should be able to do this for a nominal fee and give you a chance to gather feedback on the new course from some internal stakeholders. 4. Come up with a roll-out strategy. If the feedback from internal stakeholders is positive and points towards using adaptive learning more broadly, start working on your strategy for how to move your compliance portfolio to adaptive learning over time. This strategy should cover issues such as who will provide the content, who will provide the technology, how are you going to test the new courses, over what period of time you want to move the entire portfolio over, etc. Adaptive learning has now begun making its way into the mainstream, but it is still a nascent industry. Arguably, however, it has already won over a broad range of evangelists in the compliance community who see its potential to solve many of the challenges they have been struggling with for the past decade. Introducing recent innovations into commercial practice is never an entirely smooth process. In this case, however, the benefits seem to outweigh both costs and risks by a meaningful margin. Thus, it seems likely that once a few early adopters have successfully rolled out adaptive compliance training across their firms, the method will spread fast and soon become the de-facto standard. 8 www.grcsolutions.com.au

About GRC Solutions GRC Solutions provides governance, risk and compliance solutions for organisations across the Asia Pacific. We specialise in helping organisations navigate complex legal and regulatory environments, mitigate risk and develop cultures of compliance. Through the implementation of our award-winning Salt Compliance online training and our integrated risk and policy management software GRCHub, GRC Solutions ensures your staff have access to up-to-date ethics, risk and compliance training, effective policies and all, whilst managing corporate risk. Find out more at www.grcsolutions.com.au Contact us contactus@grcsolutions.com.au Australia 1800 676 011 New Zealand 0800 629 691 Singapore 800 852 3070 Asia +65 2 6622 5654 International +61 2 8823 4100 USA +917 612 1366 9 www.grcsolutions.com.au