How often does compliance training need to be repeated?

Almost everyone asks this question hoping for a number. The honest answer is that Australian law rarely gives you one, and the organisations that do this well have stopped looking for it.

What the law says about frequency

Under the Work Health and Safety Act, a PCBU must ensure, so far as is reasonably practicable, the provision of information, training, instruction or supervision that is necessary to protect people from risks arising from the work. The WHS Regulations add that what is provided must be suitable and adequate having regard to the nature of the work and the nature of the risks, and must be provided in a way that is readily understandable.

Read those two duties again. They describe a standard, not a schedule. If your training was suitable and adequate three years ago and nothing has changed, the law has not automatically made it inadequate. If your work changed six months ago and the training did not, you have a problem regardless of when the last module was assigned.

The same logic runs through the discrimination side. The Australian Human Rights Commission's positive duty guidelines expect knowledge to be current and reinforced, and expect you to monitor whether your measures work. They do not hand you an interval either.

There are real exceptions. High risk work licences, first aid certifications, food safety supervisor requirements, financial services training standards, and a range of industry and contractual schemes do prescribe periods. Those are specific, and if one applies to you it will say so plainly. Do not generalise from them to your code of conduct module.

Why "annual" became the default anyway

Annual training is a convention, not a rule. It stuck for three sensible reasons and one bad one.

The sensible reasons: it lines up with performance and planning cycles, it produces a clean audit trail, and it is easy to administer. The bad reason: it lets an organisation demonstrate activity without demonstrating effect. A twelve-month cycle of the same module produces a completion rate and nothing else.

Annual is a reasonable default for high-risk topics and high-risk roles. It is often waste for everyone else, and waste has a cost: every hour of pointless training teaches your workforce that compliance training is pointless, which makes the training that matters harder to land.

A frequency model that holds up

Set the cycle by risk tier, then override it with triggers.

Tier 1, annually. Topics where the consequence of getting it wrong is severe, and the population is exposed regularly. Sexual harassment and respect at work in customer-facing or high-risk settings. Psychosocial hazards for managers. Anti-money laundering for reporting entities. Privacy for anyone handling sensitive personal information at volume. WHS for anyone supervising others.

Tier 2, every two years. Broad conduct topics for the general workforce. Code of conduct. Unconscious bias. General privacy awareness. Fraud and corruption awareness in lower-risk functions.

Tier 3, on induction plus refresh on change. Topics that are essentially rules-knowledge and do not decay quickly, where the population is small or the exposure is intermittent.

Always on induction. Everyone, every topic that applies to their role, before or shortly after they start. This is the single highest-value training you run and the one most often left to a "we'll get to it" queue.

Triggers beat the calendar

Retrain when something changes, not because a date arrived:

the law changes in a way that alters what a person must do
your policy, procedure or system changes
someone moves into a role with different obligations
an incident, near miss or complaint reveals a knowledge gap
audit, survey or reporting data shows a pattern
a regulator asks you to

Trigger-based retraining is targeted, short and credible. It also produces a far better record than a calendar cycle, because the record shows you responded to something real.

Prove it, or it did not happen

Whatever cycle you choose, the evidence has to survive being asked about years later. That means, for a named person: what they completed, on what date, on which version of the content, and what the assessment tested. Version tracking is the one people miss. "Completed Code of Conduct, 14 March 2024" is much weaker than the same line attached to a content version you can still produce.

If your current library cannot support tiered cycles and version-tracked records, the fix is usually the catalogue, not the calendar. You can talk to us about off-the-shelf compliance courses that come with proper versioning and reporting out of the box.

Write down why

The last step matters more than the cycle you pick. Document the reasoning: these roles are Tier 1 because of this exposure, these are Tier 2 because of this, here are the triggers, here is who reviews the model and when. A regulator can disagree with your interval. It is much harder for them to argue you never turned your mind to it.

Common questions

Is annual compliance training a legal requirement in Australia?

Not as a general rule. Annual training is a common convention and a defensible default, but for most topics no Australian statute prescribes a twelve-month cycle. Some specific licences, tickets and industry schemes do prescribe periods.

What does the law actually require?

Under WHS law, information, training and instruction must be suitable and adequate having regard to the nature of the work and the nature of the risks, and must be readily understandable. Nothing there names an interval.

What should trigger retraining outside the normal cycle?

A change in law, a change in your policy or procedure, a new system or role, an incident or near miss, a pattern in complaints or audit findings, and any regulator direction. Trigger-based retraining is usually more useful than the calendar.

Do I need to retrain everyone when the law changes?

Not always everyone. Retrain the people whose decisions or behaviour the change affects. A definitional change in a policy may only need a communication, while a change to a reporting obligation needs real training for the people who report.

How long should we keep training records?

Long enough to prove what a named person completed, when, and on which version of the content, across the period a regulator or a court might look at. Many organisations keep seven years by default, and longer where a claim could arise years later.