Fewer courses than most vendors imply, and different ones than most organisations are running. The genuinely mandatory list is usually short; the list that would actually protect you is longer and only partly overlaps. This page separates the two and shows you how to build a training matrix that reflects the difference.
What's on this page
"Mandatory" gets used loosely in this market. Separating the four sources is what turns a vague sense of obligation into a list you can defend and budget for.
Training a law or regulation requires you to deliver, sometimes with prescribed content, duration, and frequency. The smallest category by volume — and the only one where 'we did something similar' is not a defence.
Requirements that switch on at a headcount, a contract type, or a location. Organisations routinely cross these thresholds without noticing, most often when they hire into a new state or country.
Training your customers, funders, or insurers require by contract. Frequently stricter than the law, frequently forgotten, and usually discovered during an audit rather than before one.
Not required by anyone, but the training that evidences you took reasonable steps. This is where most genuine value sits, and it is the category most organisations under-invest in because nobody is demanding it.
A training matrix maps roles against obligations. It is the document that answers "why does this person need this course?" — and the one auditors ask for first.
STEP 01
List the roles, not the people
Group by what someone does rather than who they are. A matrix built on individuals is out of date the moment anyone moves; one built on roles survives reorganisation.
STEP 02
Map obligations to roles
For each role, work through the four sources above. Most organisations discover at this point that they have been training everyone on everything, which is expensive and dilutes the training that matters.
STEP 03
Set frequency deliberately
Annual is a default, not a requirement. Some training genuinely needs an annual refresh; much of it needs to happen on hire, on promotion into a management role, or when something material changes. Ask what the refresh is for before setting a cadence.
STEP 04
Define the completion record
Decide up front what evidence each item produces — who completed it, on what version, when, and with what result. Deciding this after the fact is how organisations end up unable to evidence training they genuinely delivered.
STEP 05
Set a review date for the matrix itself
The matrix is a live document. New jurisdictions, new contracts, and changes in law all invalidate parts of it, and an unreviewed matrix quietly becomes a record of what you used to be required to do.
Annual refresh is the industry convention because it is easy to administer and easy to sell, not because it reflects how people forget things. Four triggers usually serve better than a calendar.
On hire
Anything the person needs before they can do the job safely or lawfully. The highest-value moment for training and the most commonly rushed.
On change of role
Particularly on first promotion into people management, which changes someone's obligations more than any other transition and is very often missed entirely.
On material change
A change in law, a new jurisdiction, a new contract term, or a serious incident. This is genuine refresh — it has content behind it, rather than repetition for its own sake.
On a defined cycle
For the small set where a statute or contract prescribes a period, or where the skill genuinely degrades without practice. Set the period because you can justify it, not because it is a year.
On jurisdiction: which training is mandatory, who it applies to, and how often it must be repeated all vary by country and, in the US, by state — and prescribed content sometimes differs too. This page sets out how to reason about requirements; the specific obligations for your locations need to be confirmed against current sources.
Ordered by how often they turn out to be genuinely necessary rather than by how often they are sold.
The general employment-law obligations most organisations start with.
Usually triggered on promotion rather than annually.
Commonly contractual as well as risk-based.
Jurisdiction-triggered; check on every new hiring location.
Role-based — only those who may run one.
Risk-based, and the most commonly skipped.