Purpose
Provide assurance that training evidence is complete, retrievable, reported and used to improve the programme.
Objective
Ensure the training register reconciles the complete population to assignments, completion, assessment, readiness, remediation and exceptions and supports timely management, Board, audit and CBCS review.
Normative
Compliance and HR shall maintain a complete audit trail, reconcile it at least quarterly, report material gaps and complete an annual effectiveness and proportionality review.
Descriptive
The control distinguishes approved design from actual operation and uses completion, quality, incident, finding, feedback and assurance results to update content, frequency, methods and resources. Bitkaya maintains a complete audit trail of training and awareness initiatives, including attendance sheets, completion certificates, and test results; version-controlled training materials; and annual proportionality evaluations confirming adequacy and alignment with the company’s scale and risk exposure. These records are stored in the compliance repository and reviewed during internal audits and CBCS inspections. Oversight aligns with Bitkaya’s “three lines of defense” model, integrating compliance monitoring and internal audit validation of training adequacy. The proportionality framework is designed for progressive scalability: Startup (lean structure, cross-role training, simplified awareness campaigns); Growth (dedicated modules for new departments and roles, LMS integration); Maturity (continuous professional development, external certifications, and predictive learning analytics).
Evidence
- Expected evidence: Training register and evidence index
- Expected evidence: Quarterly population and completion reconciliation
- Expected evidence: Management and Board reports and decisions
- Expected evidence: Annual effectiveness and proportionality review
- Expected evidence: Material versions, remediation and improvement plan
- Evidence location: source evidence in SYS-ECM-001 Compliance Framework Library, SYS-ECM-002 Compliance Reporting and Evidence Repository; target Hermes assessment record in Odoo under ISS-HERMES-001.
- Retention: according to the applicable approved policy and Bitkaya record-retention requirements.
- Testing method: reconcile a sample from personnel records through assignment, completion, assessment and evidence retrieval and inspect quarterly and annual reporting
- Testing frequency: quarterly, with annual programme review
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Design status: implemented
Assurance Assertions
- Evidence is complete, version-controlled and retrievable.
- Population reconciliation occurs at least quarterly.
- Material gaps reach management and the Board.
- Annual review results in documented decisions and improvement actions.
Relationships
- Policy: POL-TRAIN-001 Training and Awareness Manual
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Procedure: PROC-TRAIN-006 Maintain Training Records Report and Improve
- Evidence repository: SYS-ECM-002 Compliance Reporting and Evidence Repository
History
- 2026-07-26: Normalized evidence metadata and separated design status from runtime effectiveness.
- 2026-07-26: Created from the approved Training & Awareness Manual version 1.1.