Purpose
Maintain a complete audit trail, report programme performance and improve training using evidence, feedback, incidents, findings and change.
Preconditions
- The approved population, matrix, materials, assignments and assessment criteria are available.
- Completion, readiness, awareness, remediation and exception evidence is captured.
- Management and Board reporting responsibilities are defined.
Steps
| # | Action | Details | Evidence |
|---|---|---|---|
| 1 | Maintain records | Maintain version-controlled materials and person-level assignment, attendance, completion, assessment, readiness, remediation and exception records. Bitkaya maintains a complete audit trail of training and awareness initiatives, including attendance sheets, completion certificates and test results; version-controlled training materials; and annual proportionality evaluations confirming adequacy and alignment with the company’s scale and risk exposure. | Training register and evidence index |
| 2 | Reconcile population quarterly | Reconcile the complete in-scope population to required and completed training at least quarterly. | Population-to-requirement reconciliation |
| 3 | Report programme performance | Report completion, overdue items, assessment outcomes, remediation, role-readiness restrictions and recurring themes to Compliance, HR and management. Oversight aligns with Bitkaya’s “three lines of defense” model, integrating compliance monitoring and internal audit validation of training adequacy. | Quarterly management reporting |
| 4 | Escalate persistent gaps | Escalate material or persistent gaps to the Board and record decisions and corrective action. | Board escalation and decision record |
| 5 | Review content after change | Review content and delivery after legal, policy, product, system, incident, audit or regulatory change. Where regulator findings or internal remediation require control changes, associated training materials and awareness communications shall be updated promptly. Training content and delivery methods shall be reviewed taking into account: changes in laws, regulations and supervisory expectations; updates to internal policies and procedures; incidents, near misses and lessons learned; internal audit, compliance testing and control review outcomes; employee feedback and identified knowledge gaps; and material changes to tools, systems, products, services or operating model. | Content review and update record |
| 6 | Perform annual effectiveness review | Perform an annual joint Compliance and HR effectiveness, proportionality and resource review using completion, assessment, quality, incident, survey and assurance information. Bitkaya’s training and awareness proportionality framework is designed for progressive scalability: Startup (lean structure, cross-role training, simplified awareness campaigns); Growth (dedicated modules for new departments and roles, LMS integration); Maturity (continuous professional development, external certifications and predictive learning analytics). The Compliance Officer and HR jointly review training effectiveness annually, incorporating feedback from internal audits, employee surveys and post-incident reviews. | Annual effectiveness and proportionality review |
| 7 | Retain evidence for audit | Retain evidence in the approved repository and provide complete records for audit or CBCS inspection. These records are stored in the compliance repository and reviewed during internal audits and CBCS inspections. | Evidence repository records |
Exceptions and Escalation
Missing, inconsistent or inaccessible evidence shall be treated as a control gap. Material population, overdue, pass-rate, readiness or remediation gaps require management escalation and tracked corrective action.
Records Created
- Training register and evidence index
- Population-to-requirement reconciliation
- Quarterly management and annual Board reporting
- Annual effectiveness and proportionality review
- Improvement plan, decisions and closure evidence
Relationships
- Policy: POL-TRAIN-001 Training and Awareness Manual
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Evidence repository: SYS-ECM-002 Compliance Reporting and Evidence Repository
- Control: CTRL-TRAIN-006 Ensure Training Records Reporting and Improvement Are Maintained
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Frequency: continuous records, quarterly reconciliation and reporting, annual effectiveness review
History
- 2026-07-26: Created from sections 5, 6.4, 6.5 and 6.6 of the approved Training & Awareness Manual.