Off-the-shelf vs custom compliance training: how to choose

Most organisations get this decision backwards. They build custom content for obligations that are identical across every employer in the country, then run generic content for the one hazard that is genuinely peculiar to their business. The result is an expensive library that misses the thing most likely to hurt someone.

Here is a way to decide that does not depend on who is selling.

The only question that matters

Is the thing people need to know general, or is it yours?

Sex discrimination law is general. The definition of sexual harassment does not change because you run aged care rather than logistics. Privacy principles are general. Directors' duties are general. Bribery is general.

How a night-shift nurse escalates aggression from a patient's family member at 2am, using your escalation line and your duress process, is yours. Nobody else has that process. No catalogue contains it.

If the answer is "general", buy. If the answer is "ours", build. Most organisations need both, and the mix is usually closer to 80 per cent bought than people expect.

Buy off the shelf when

The obligation is standard and settled. Code of conduct, unconscious bias, privacy awareness, general WHS, modern slavery awareness, fraud awareness, respect at work at the awareness level. These are the same obligation for every Australian employer. There is no advantage in restating them in your own words, and a real disadvantage if your restatement is subtly wrong.

You need coverage now. A gap you can close in two weeks is worth more than a better module that lands in seven months. If an inspector or an auditor is already asking, deploy the catalogue course and start the custom work in parallel.

The population is small or spread thin. A 60-person organisation cannot amortise a custom build across enough learners for it to make sense. Neither can a 4,000-person organisation where only 30 people need a specific topic.

The content needs maintaining and you will not maintain it. This is the underrated one. Legislation moves. Codes of practice get remade. A good catalogue vendor updates content and reissues it as part of the licence. Your custom module, sitting in a folder, does not update itself, and the version people are completing in 2029 will be the one you wrote in 2026.

You do not yet know what your problem is. Deploy something reasonable, watch the assessment data and the incident data, and let the evidence tell you where the custom money should go.

If that describes you, get a quote on off-the-shelf compliance courses and put the saved budget into the part of the programme that is actually yours.

Build custom when

The hazard is specific to your operation. Lone workers in client homes. Remote crews with a two-hour response time. Cash handling in a retail footprint with a known aggression profile. Clinical handover. Generic scenarios teach these workforces that the training is about someone else, and once a worker decides that, nothing in the module lands.

Following your process is the point. If the failure mode is "she knew it was wrong but did not know who to tell", the training has to name your escalation path, your form, your timeframe and your people. No catalogue can do that.

Generic content already failed. You ran the standard course, completion was 97 per cent, and the incidents did not move. That is evidence, and it is the best possible business case for a custom build. Do not build custom on a hunch when you could build it on data.

The population is large enough that a small effect is worth real money. Custom pays for itself on volume. Across 5,000 people in a high-consequence setting, a modest improvement in one behaviour is worth far more than the build cost. Across 200 people in a low-consequence setting, it is not.

You need role-specific decisions, not awareness. Managers responding to a disclosure. Officers exercising due diligence. Frontline staff making a judgement call under pressure. Awareness content can tell people a rule exists. Practising the decision requires scenarios written from your situations.

If that is your situation, the custom compliance training conversation is the right one to have, and it should start with your incident data, not with a course list.

The mix most organisations should run

A defensible programme usually looks like this:

Bought: the broad baseline everyone completes. Code of conduct, privacy, general WHS, respect at work awareness, bias. Standard obligations, standard content, updated by the vendor.
Bought and configured: topics where a catalogue course carries the law and you add your policy links, your reporting channels and your contacts. This is the highest-value middle ground and it is far cheaper than a build.
Built: the two or three places where your operation creates a hazard nobody else has, plus the manager and officer layers where judgement matters more than knowledge.

If your library is more than about a quarter custom, check whether you are paying to re-author the Privacy Act.

Things that do not decide it

"Custom is more defensible." It is not, on its own. Defensibility comes from having identified your risks and matched training to them, then keeping records that prove who completed what and when. A good off-the-shelf course tied to a documented risk assessment beats a bespoke module built because someone liked the idea.

"Off-the-shelf looks generic." Some of it does. That is a quality problem, not a category problem, and you fix it by looking at the actual content before you buy rather than by commissioning a build.

"We want our branding." Branding is a configuration option on most catalogue products. It is not a reason to spend six figures.

A five-minute test

Ask three questions about the topic in front of you.

Would a competitor's version of this module be substantially the same? If yes, buy.
If a worker fails at this, will the failure be "did not know the rule" or "did not know our process"? Rule means buy. Process means build.
Who maintains it in three years, and have they agreed to? If the answer is unclear, buy, because unmaintained custom content is worse than a current catalogue course.

Three yeses to buying is not a compromise. It is the right call, and the money you keep is money available for the one thing in your organisation that genuinely needs building.

Common questions

Is off-the-shelf compliance training good enough to meet legal obligations?

Often, yes. WHS law requires training to be suitable and adequate for the nature of the work and the risks. For a standard obligation with general risk, well-built off-the-shelf content meets that standard and is defensible.

When is custom compliance training genuinely worth it?

When the hazard is specific to your operation, when workers have to follow your process rather than a general principle, when the population is large enough that a small behaviour change is worth real money, or when generic content has already failed.

Can we start off the shelf and go custom later?

Yes, and this is usually the smart order. Deploy off-the-shelf now to close the gap, gather data on where people actually go wrong, then build custom against evidence rather than assumption.

Is custom training more legally defensible?

Not automatically. Defensibility comes from matching training to identified risks and keeping good records. Custom content built without a risk assessment is no more defensible than a good off-the-shelf module.

What is the real cost difference?

Off-the-shelf is priced per learner or per licence and is available immediately. Custom is a project with design, build, review and maintenance costs, and it needs re-authoring when your process changes. The maintenance cost is the one people forget.