Purpose
Maintain a complete, risk-based and approved training programme for every in-scope person and role.
Preconditions
- Current personnel, contractor, role, department and access populations are available.
- Applicable obligations, policies, incidents, findings and change information are available.
- Subject-matter owners are assigned for each training domain.
Steps
| # | Action | Details | Evidence |
|---|---|---|---|
| 1 | Reconcile in-scope population | Map personnel, contractors, roles, departments, access levels and risk exposure. | Population reconciliation record |
| 2 | Classify roles and define curriculum | Classify each role as foundational, functional or leadership; identify high-risk functions requiring semiannual training. Programme covers at minimum: AML/CTF/CPF and sanctions compliance; ethical conduct and anti-bribery/anti-corruption; client due diligence and escalation responsibilities; cybersecurity and information security awareness; safeguarding of client assets and sensitive information; complaints handling and client communication standards; operational resilience, incident reporting and business continuity awareness; and documentation, recordkeeping and internal control expectations. | Role classification and curriculum definition |
| 3 | Maintain training matrix | Matrix shows required modules, audience, owner, approved publication, frequency, due date, assessment method, pass or readiness criterion and evidence location. Apply proportional tiering: Tier 1 — Foundational (mandatory for all: AML/CFT, cybersecurity hygiene, Code of Ethics, whistleblowing, client asset safeguarding); Tier 2 — Functional (Compliance, Operations, IT — transaction monitoring, data security, risk management); Tier 3 — Leadership (governance, CBCS regulatory frameworks, decision-making ethics, oversight responsibilities). | Approved training matrix |
| 4 | Define delivery cadence | Include onboarding, annual all-employee refreshers, semiannual high-risk training, quarterly awareness and event-driven assignments. Set frequency by risk: high-risk functions semiannual, medium/low-risk functions annual or upon material policy changes. | Training calendar |
| 5 | Obtain approval | Compliance and subject-matter-owner review of content; management approval of the matrix and calendar. The Board approves the Training & Awareness Policy and ensures sufficient resources are allocated. | Content-owner and approval record |
| 6 | Version materials | Version materials and retire superseded content without deleting historical evidence. Use digital and hybrid delivery methods (e-learning, webinars, micro-learning sessions) for efficiency and accessibility. | Material versions and change log |
| 7 | Review matrix periodically | Review at least annually and after material legal, policy, role, product, system, incident or control change. The Compliance Officer and HR jointly review adequacy and cost-effectiveness annually. | Annual review record |
Exceptions and Escalation
Unclassified roles, missing content owners, unapproved material or scheduling conflicts shall be escalated to Compliance and the relevant Department Head. No person may be omitted from mandatory training merely because a role is new or temporary.
Records Created
- Population reconciliation and role-risk assessment
- Approved training matrix and calendar
- Content-owner and approval record
- Material versions and change log
- Exception and escalation record
Relationships
- Policy: POL-TRAIN-001 Training and Awareness Manual
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Control: CTRL-TRAIN-001 Ensure Training Needs Matrix and Calendar Are Complete
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Frequency: annual and after material change
History
- 2026-07-26: Created from sections 2, 3, 5 and 6 of the approved Training & Awareness Manual.