Templates and records · ISO 37301 · Clause 7.2.3
ISO 37301 compliance training plan template
Who receives which compliance training, how often and how you check it has worked, according to the risk of each role.
In one sentence
The compliance training plan assigns each role the training that matches its exposure to noncompliance risk, with its frequency and method of assessment, and records who received it; ISO 37301 calls for regular training tailored to the obligations and risks of the role and requires training records to be retained (7.2.3).
- Where the standard requires it
- ISO 37301 · Clause 7.2.3 Clauses follow ISO 37301:2021, the current edition, which replaced the ISO 19600 guidance standard.
- Type of information
- Mandatory record Training records to be retained (7.2.3)
- Who fills it in
- Compliance function With HR for logistics and records
- When
- On joining and periodically And after regulatory changes, new risks or breaches that reveal gaps
- How long it is kept
- Set by the organisation ISO 37301 sets no periods. In Spain it is wise to take into account the limitation periods of the offences the system aims to prevent, because the record is your evidence of due diligence.
What the standard requires
What ISO 37301 demands and what it leaves to your judgement
The standard asks for staff to be trained from the moment they join and at planned intervals, with content tailored to the obligations and risks of their role, and for the effectiveness of that training to be evaluated. Training records are retained.
It differs from the training in the ISO 9001 competence record in its criterion: the question here is not whether the person can do the job, but whether they know the obligations and the noncompliance risks their role creates.
The awareness required by 7.3 is the common base for all staff —policy, channel, consequences of noncompliance—; specific training is reserved for the most exposed roles.
Structure
Fields the template should include
- Role or group and its level of risk exposure
- Obligations and risks the training covers
- Content and format
- Frequency
- Attendees, date and duration
- Assessment: test, results
- Effectiveness measure: later incidents, queries to the channel
Example
Example: three groups at a distributor
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| All staff | Policy, code of ethics and use of the channel · online · on joining and every two years · 10-question test |
| Public-sector sales team | Gifts, hospitality and dealings with public buyers · in person · annual · case study |
| Procurement | Third-party due diligence and conflicts of interest · in person · annual |
| Sales team session | 18 June 2026 · 24 of 25 attended · average score 8.6 |
| Outstanding | 1 person on leave · will be trained on return |
| Effectiveness | Advance queries to the channel about invitations rise from 2 to 11 in the following six months |
At the audit
Mistakes auditors commonly flag
- The same generic training for all staff, regardless of the risk of each role.
- Attendance records with no content or assessment.
- Senior managers and the governing body receive no training.
- Not repeated after a breach that reveals a lack of knowledge.
In Kimobox
How this record is kept in Kimobox
- 1Each employee’s compliance training is recorded on the employee portal according to their risk level.
- 2Each session leaves a record of attendance and assessment.
- 3Training completion indicators are calculated from the records themselves.
Frequently asked questions
What people ask us before getting started
How often should training take place?
The standard asks for planned intervals, not a set frequency. Annual training for the most exposed roles and less frequent sessions for everyone else is sensible, with refreshers when things change.
Does online training count?
Yes, for general awareness. For the highest-risk roles, live case studies, in person or online, usually provide better evidence of effectiveness.
Keep your ISO 37301 records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
ISO 9001 training and competence record
How to demonstrate staff competence under ISO 9001: competence per role, training, experience, evaluation of…
Support
Support in compliance rests on two pillars: staff knowing their obligations, and a whistleblowing channel…
ISO 37301 compliance obligations register template
How to document the compliance obligations ISO 37301 asks for: mandatory requirements and voluntary…
ISO 37301 compliance risk matrix template
How to document an ISO 37301 compliance risk assessment: obligation, activity, causes, likelihood…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.