Purpose
Ensure personnel receive timely, role-appropriate training on AML/CFT/CPF, ABC, cybersecurity, ethics and other applicable responsibilities.
Steps
| # | Action | Details | Evidence |
|---|---|---|---|
| 1 | Maintain a role-based training matrix | Cover mandatory subjects (AML/CFT, ABC, Cybersecurity Awareness, and Code of Ethics) with audiences, due dates, refresh frequency and responsible content owners. | Training matrix |
| 2 | Assign onboarding training | Before or promptly after relevant access and responsibilities are granted; training ensures personnel recognize risks such as fraud, insider trading, or cyber threats. | Training assignment |
| 3 | Assign refresher and change-driven training | Annual refresher training and additional training after material policy, risk, product, role or regulatory change. | Refresher assignment |
| 4 | Record completion and assessment results | Record completion, assessment results and any required remediation; all employees must complete training on time and refresh it annually or as required. | Completion record |
| 5 | Remind and escalate overdue items | Remind personnel before due dates and escalate overdue items to the manager, Human Resources and Compliance. | Reminder and escalation log |
| 6 | Require retraining or remediation | Where competence is not demonstrated. | Remediation record |
| 7 | Review trends and report gaps | Review completion and overdue trends and report material gaps to management; training content and frequency should be proportional to each employee responsibilities and updated as the company grows. | Management report |
Exceptions and Escalation
Training deferrals require documented justification, an approved completion date and risk mitigation. Material or repeated non-completion shall be managed as a conduct issue.
Records
- Training matrix and assignments
- Attendance and completion evidence
- Assessment and retraining results
- Reminders, exceptions and escalations
- Management reporting
Relationships
- Policy: POL-EMP-001 Employee Handbook
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Control: CTRL-EMP-002 Ensure Mandatory Employee Training Is Completed
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Frequency: onboarding, annual and after material change
History
- 2026-07-26: Created from sections 2, 5 and 7 of the approved Employee Handbook.