Compliance training platform: What distinguishes mandatory training from a click course

According to Section 130 OWiG, company management is personally liable if supervisory duties, which include employee training, are breached. Fines of up to 10 million euros according to Section 130 in conjunction with Section 30 OWiG are not a theoretical figure, but rather a real practice of public prosecutors and state supervisory authorities. Anyone who buys a training platform for compliance is therefore not buying a learning system in the sense of personnel development, but rather evidence for the day on which an incident raises the question: Was the affected employee demonstrably trained, did they understand the content, and can the evidence still be found unchanged three years later? Anyone who cannot answer this question within a few minutes risks personal liability for management.

This article addresses compliance officers who have to choose between 24 different LMS providers. He explains how you distinguish an audit-proof platform from a pure learning management system, which mandatory fields training must include according to the GDPR, AMLA, NIS-2 and LkSG and what the proof looks like in court. CIVAC is a compliance platform and officer-as-a-service that maintains training, appointment certificates, audit templates and reporting lines in one file structure. You'll end up with a clear set of procurement requirements, including questions you should ask any LMS provider before signing a contract.

A supervisory audit is interested in three questions: who was trained, when, and with what content. The fourth, often underestimated question is: Who confirmed the training as understood. Section 130 OWiG requires supervisory training, which is interpreted as an ongoing obligation, not as a one-time onboarding. A platform that only records the click on the completion button does not provide reliable evidence. In their interpretation and application of the AMLA, supervisory authorities such as BaFin have repeatedly emphasised that comprehension tests are a mandatory part of training.

The second aspect is timeliness. Compliance content changes with every amendment to the law and with every interpretation decision by the courts. Training that remains at the 2022 level while the HinSchG 2023 and the NIS 2 implementation in 2026 intervene does not have any protective effect. Audit-proof platforms must deliver their content with a version stamp so that it can be traced which legal status was applicable at the time of the training.

CIVAC structures training courses in the workspace with a version stamp, participant ID, comprehension check and audit-proof file. The appointment certificate, signed, filed, verifiable, also applies to training documents. The auditor calls, the evidence is ready. Anyone who operates the data protection officer role on one platform combines the officer function with the obligation to train employees without maintaining separate systems. It is precisely this coupling that separates a compliance training platform from a pure LMS. A classic LMS is optimised for learning effects, a compliance platform for evidence management, version control and audit-proof files. Both worlds only partially overlap. A supervisory examination takes evidence as a stricter criterion because it can be examined in court, while educational effectiveness remains an open question of evaluation. Procurement should therefore be thought of from the point of view of evidence, not from the didactic concept.

Not every training course is required by law, but the mandatory catalogues are more extensive than many companies assume. In data protection, Art. 39 Para. 1 lit. b GDPR expressly requires the awareness and training of all employees involved in processing operations. The supervisory authorities specify this in requirements that include at least an annual refresher, documented initial training during onboarding and topic-specific training in the event of significant changes to processing.

In money laundering law, Section 6 (2) No. 6 GwG regulates the training requirement for employees with regard to reportable transactions. In terms of occupational safety, Section 12 of the ArbSchG requires training before the start of work and in the event of significant changes, at least annually. In terms of whistleblower protection, Section 7 of the HinSchG prescribes training for the internal reporting office, with a minimum level of confidentiality. The NIS 2 Directive requires cybersecurity training for all employees in Article 21 Paragraph 2 Letter g. ISO/IEC 27001:2022 requires regular awareness training in Control A.6.3, with documented evidence for each employee.

A consolidated training portfolio covers at least these five areas: data protection, money laundering, occupational safety, information security and whistleblower protection. CIVAC bundles these mandatory catalogues in a platform with 25 representative roles and 490 ready-to-use audit templates. Licence the workspace for your internal representatives, or have our representatives order it. The training modules are linked to each other so that a common training plan is created across all legal areas, instead of five parallel isolated solutions with redundant participant management. By ordering a representative in the workspace, you can also see which compulsory training the respective representative has completed, including mandatory training for each role. In the case of supervisory inquiries, it can be proven within seconds that the representatives have demonstrated the specialist knowledge required for their function.

A training unit that meets supervisory requirements consists of at least five components. First: learning goal, formulated in writing and measurable. Second: content module with legal status versioning, ideally as a mixture of text and visualization. Third: practical examples that transfer the abstract norm to concrete activities of the target group. Fourth: Comprehension test with at least five questions, of which at least two are application questions instead of pure knowledge questions. Fifth: Final document with participant ID, date, content version and result of the comprehension check.

The most common deficiencies in practice concern the comprehension check. A multiple choice question with three answers, only one of which is obviously correct, is not considered an examination. Supervisors and courts expect a minimum threshold of 80% correct answers, with an obligation to repeat if not achieved. Anyone who does not technically anchor this threshold in the platform risks a formal lack of training in the process.

The second weak point is timeliness. Training on the GDPR that does not reflect the Schrems II ruling from 2020 or the new standard contractual clauses from 2021 is out of date. National implementation has been the benchmark for NIS 2 training since 2024. CIVAC audit templates are updated centrally with every legal change, including version stamps and an indication in the workspace of which employees require repeat training. Others run compliance like a filing cabinet. We run it like software. This versioning is the key difference between a static eLearning package and a dynamic compliance training platform. A supervisory auditor who sees a seven-month-old training document asks about the legal status at the time. Only if the platform shows this legal status with a version stamp is the evidence reliable. Otherwise, doubts remain in the proceedings as to whether the training actually met the requirements applicable at the time. This doubt is usually enough to invalidate the training certificate in the fine proceedings.

A training receipt is not a PDF certificate, but rather an audit-proof data record. Regulators typically require retention for three years after the employee's termination of employment, or longer in some areas. According to Section 257 of the German Commercial Code (HGB), ten years apply to training relevant to commercial law such as money laundering. The data record must contain at least: Unique participant ID, date of training, version number of the content, result of the comprehension check, signature of the person responsible for conducting the training.

Audit-proof means: cannot be changed subsequently. A platform that allows training entries to be edited during day-to-day operations does not meet this requirement. A practical solution is a solution that only allows changes as a traceable correction with a history, comparable to audit-proof accounting. The GoBD principles for the storage of digital documents apply accordingly to training certificates as soon as they are used as part of a supervisory audit.

CIVAC saves training documents in the workspace with hash-based version backup and EU data residency. The receipt can be accessed via the employee ID, the date or the training version. A supervisory request for a three-year-old training course can be answered in the workspace in under 60 seconds, with an audit-proof receipt printed out. The auditor calls, the evidence is ready. This speed of discovery is not only a convenience, but also a mitigating factor in the assessment of fines in many supervisory procedures because it proves a functioning compliance organisation. The supervisory authorities' fine guidelines expressly provide for mitigating factors for companies that can demonstrate that they have an effective training and documentation structure. However, anyone who first has to reconstruct training documents from PDFs on network drives signals the opposite. This perception effect is often underestimated in compliance procurement, but is regularly noticeable in the process. Experience has shown that quick findability is considered a critical factor from four to six weeks after the supervisory request.

A working student in accounting needs different data protection training than a board member. Supervisors expect a risk orientation that is reflected in the platform architecture. Section 4a (1) GwG requires risk-adjusted training, which in the area of ​​money laundering is classically represented in three groups: basic training for everyone, in-depth training for employees with customer relations, special training for money laundering officers and deputies.

A similar logic applies in data protection. Employees without access to personal data need awareness training, employees with processing activities need in-depth training, and IT administrators need special training on technical and organisational measures. A training platform that only provides standard training formally violates this risk orientation.

In practice, the differentiation can be mapped using role profiles. During onboarding, each employee is assigned a role profile and the platform plays out the appropriate modules. When there are changes within the company, such as transfers from sales to accounting, the role profile is updated and additional training is provided. CIVAC maps role profiles for 25 officer roles, including the Money Laundering Officer and the associated employee groups. The training plans are linked to the appointment certificates, creating a reporting line of ordering, training and incident reporting in a single platform. Licence the workspace for your internal representatives, or have our representatives order it. The risk orientation also means that the depth of training is based on the type of data and the potential for damage: processing special categories according to Art. 9 GDPR requires a different training intensity than pure address data. It is precisely this level of depth that can only be clearly documented if the platform links processing registers and training modules. An isolated training solution would otherwise create gaps between actual processing and the employees' proven level of knowledge.

Compliance training must be provided in a language that the employee understands sufficiently. For factories with a high proportion of international employees, German training alone is not sufficient. Labour courts have ruled on several occasions that training that is not understood in the national language does not constitute proof of training within the meaning of regulatory requirements. Minimum packages in German, English and the most relevant other corporate language, often Polish, Turkish, Spanish or French, are practical.

Localization has to do more than just word-for-word translation. References to national laws must be adapted, examples must be culturally viable, and the comprehension test must be valid in the respective language. A training platform that only offers a machine translation of the original German version creates more problems than it solves in the event of a conflict.

For corporations with locations in the DACH region, the multiple legal situation is added. An Austrian subsidiary needs the Austrian DSG legal status, a Swiss subsidiary needs the revDSG legal status. CIVAC bundles these localizations into a platform with separate version stamps for each jurisdiction. The reporting line to the group remains intact, local supervisory authorities receive the appropriate documentation. EU data residency is not a detail here, but rather a prerequisite for acceptance by French and Austrian supervisory authorities, which regularly ask US-hosted training platforms about data transfer to third countries. The deadline begins as soon as we become aware of it; this also applies to the processing of such inquiries. Another fact from experience: Plants and production locations with frequent shift changes need a mobile-friendly training interface because classic office computer training courses are neither time nor space-efficient there. Empirically, abandoning mobile training routes leads to significantly lower completion rates, which in turn weakens the evidence for supervision. Supervision checks quotas, not intentions, which is why 95% completion in shift and factory environments is practically only achievable via mobile interfaces.

A training platform without interfaces becomes an island. The most important interconnections concern three areas: HR systems for employee master data, audit systems for audit planning, reporting systems for management. If there is a change in employees, the training platform must automatically recognise that a new role profile is in effect. When you leave, training documents must be archived, but may no longer be displayed as an active obligation.

The second interface concerns audit planning. An internal audit department should be able to sample training documents from the platform, with filters based on role profile, location and training date. The third interface concerns the reporting line to management. Quarterly reports should automatically show the training quotas per role profile and per location, with reference to delinquent areas.

CIVAC combines these three interfaces in a platform with standardised APIs to common HR systems. The reporting line to management is automatically generated from the training data and the representatives' appointment documents, with links to incident reports and audit results. This creates a consistent file: order, training, incident, report. The auditor calls, the evidence is ready. The appointment certificate, signed, filed, verifiable, applies to the representative function as well as to the training documentation. This interlinking is the economic lever: a compliance training platform without connection to the representative structure creates duplication of work; an integrated platform avoids this. Corporations that connect their training platform to the SAP HR world or Workday via open interfaces typically reduce the maintenance effort in master data management by 60 to 80%. This efficiency has a direct impact on the rate of fully documented compulsory training, which is the toughest quantitative criterion in supervisory audits. Without these interfaces, master data breaks will occur, which can lead to false negative findings in the audit.

Building your own training platform does not primarily cost the licence, but rather the maintenance of the content. An average GDPR training course is updated two to three times per year, depending on the law and supervisory practices. With a portfolio of ten training topics, there are between 20 and 30 update cycles every year, each with research, module adaptation, comprehension check and translation. Extrapolated, the annual maintenance effort for your own platform is between 80,000 and 200,000 euros, depending on the number of languages ​​and the complexity of the modules.

A licensed platform with centrally maintained content shifts this maintenance effort to the provider. The price per employee per year is typically between 25 and 80 euros, depending on the scope of the module. With 500 employees, that's 12,500 to 40,000 euros, well below the cost of self-care. The threshold at which an in-house development could be economically viable is typically several thousand employees and a highly specific content requirement that is not covered by standard providers.

CIVAC offers both models: Workspace licence for internal representatives who conduct their training themselves using the 490 audit templates, or external order with full training implementation as Officer-as-a-Service. Licence the workspace for your internal representatives, or have our representatives order it. The platform architecture is identical in both cases, with EU data residency and audit-proof file management. A hybrid variant, in which certain compulsory training courses are obtained externally and company-specific training courses are created internally, is the most common constellation in practice in medium-sized companies. It allows mandatory regulatory catalogues to be covered externally at comparable costs while at the same time keeping company-specific content, such as your own data classification, internal. The only important thing is that both worlds come together in a single file so that the training certificate for supervision remains consistent.

A compliance training platform is not a learning system, but a means of evidence. The difference between an audit-proof training certificate and a pure click proof determines the amount of the fine and the personal liability of the management in accordance with Section 130 OWiG. A platform that meets this requirement combines versioned content, documented comprehension checks, audit-proof storage and a consistent interface to the officer structure.

CIVAC is a compliance platform and officer-as-a-service with 25 officer roles, 490 audit templates and EU data residency. The training function is not one module among others, but rather an integral part of the file consisting of the appointment certificate, training document, incident report and report. Licence the workspace for your internal representatives, or have our representatives order it. The platform is ready for use in two working days, pre-filled with the most important standard training courses.

Turn reading into a mandate. Write to info@civac.de or use the contact form on civac.de. We respond to inquiries within four hours on weekdays with a concrete proposal for the training architecture, including information on target groups, languages, module scope and reporting line. In a preliminary discussion, we will clarify whether your compliance organisation needs a workspace licence or external training. The appointment certificate, signed, filed, verifiable, valid from day one. The entire training and representative path can be connected to your existing HR and audit systems without you having to set up your own integration department. Anyone who first sets up the platform for a mandatory role such as data protection officer and then adds other officer roles in the second step avoids a big bang roll-out and gains early supervisory security without having to restructure the organisation in a week. Turn reading into an assignment, in the literal sense: an initial suggestion is available within 24 hours of the preliminary discussion, with calculated language and role coverage.