Building the Business Case for Compliance Training in a Regulated Firm

Training in a regulated firm is not a discretionary spend, and the business case for it is not really about engagement scores or completion rates. It is about which specific obligations the organisation would be unable to evidence if the budget were cut, and what happens when a regulator asks.

This guide sets out how to build that case from the rules themselves, using the four regimes most likely to apply: CQC in health and social care, the FCA in financial services, the SRA in legal practice, and the Central Bank of Ireland.

Start from the obligation, not the course

Most training business cases open with a list of courses and a price. That framing invites the question “can we do less?” The stronger framing starts with what the organisation is legally required to demonstrate, because that converts the conversation from cost to exposure.

Four examples, each a direct requirement rather than good practice:

• CQC Regulation 18(2)(a) requires staff to “receive such appropriate support, training, professional development, supervision and appraisal” as is necessary to carry out their duties. CQC’s guidance expects completed and required training to be tracked, with action taken quickly where requirements are not met.
• FCA TC 3.1.1R requires appropriate records to demonstrate compliance with the whole Training and Competence sourcebook, retained for at least five years for MiFID business, three for non-MiFID, and indefinitely for pension transfer specialists.
• The SRA requires firms, under the Code of Conduct for Firms, to ensure managers and employees maintain their competence — and its April 2026 consultation proposes mandatory learning records and three hours a year of facilitated ethics discussion from the 2027/28 practising year.
• Ireland’s Minimum Competency Code sets hard annual hours: 15 for MiFID services and for insurance staff, 6 for certain mortgage credit board members, and 10 or 20 for crypto-asset staff depending on whether they inform or advise — with at least one hour on ethics and diversity modules explicitly not counting.

Each of those is a number or a duty a finance director can be shown. None is a preference.

Quantify the four costs that are actually measurable

1. The evidence gap. Count the obligations the organisation currently cannot evidence on demand. Not the training it has not done — the training it cannot prove. In most organisations this is the larger number, and it is the one a regulator tests. The questions worth running are specific: can we produce the training requirement for each role and the date it was last reviewed? The gap between required and completed? Evidence that someone acted on a gap? Current supervision status for staff not yet signed off to work unsupervised?

2. Remediation cost. Fixing records retrospectively is dramatically more expensive than keeping them. Reconstructing who was trained on what, two years after the fact, consumes senior compliance time at the point when that time is least available — during an inspection or a skilled person review.

3. Supervision drag. Where competence is not assessed and recorded, staff stay under supervision longer than necessary. That is a direct productivity cost with a payroll number attached, and it is usually invisible because nobody measures it.

4. Deadline exposure. Some obligations have fixed dates and no grandfathering route. Irish credit union staff must hold a recognised qualification by 1 October 2028. A defined population and a fixed date make this the easiest kind of cost to forecast and the hardest to argue with.

What not to claim

Three arguments weaken a training business case because they cannot be substantiated, and a sceptical finance director will find them.

Avoided fines. Unless you can point to a specific enforcement action against a comparable firm for a comparable failure, an avoided-penalty figure is a guess dressed as a forecast. If you do use enforcement data, cite the regulator’s own notice with its date.

Generic productivity uplift. Industry-average figures for the return on training spend are not evidence about your organisation and will not survive scrutiny.

Completion rates as an outcome. A 94% completion figure evidences neither the requirement it was measured against nor what was done about the 6%. CQC’s guidance asks for both. Presenting completion as the result concedes the point that the spend is about activity rather than compliance.

Structure the case around three questions

A business case that answers these tends to get approved, because each one has a factual answer rather than an opinion.

What are we required to demonstrate? List the obligations by regime and role, citing the rule. This is the section that makes the spend non-discretionary.

What can we demonstrate today? An honest gap analysis against that list. Resist the temptation to present this favourably — the gap is the business case, and understating it argues against your own proposal.

What changes if we do nothing? Name the next fixed date, the next inspection cycle, and the specific records that would be unavailable. “We would be unable to evidence supervision sign-off for 40 staff at the next inspection” is a sentence that gets budget. “Training is important” is not.

Where the records sit matters as much as the training

A business case for training that ignores how the evidence will be held is incomplete, because the obligations are evidential. Our guides to what CQC expects from a training records system and to FCA training and competence records set out what each regulator requires a system to produce — which is usually the part of a proposal that has not been costed. Our CPD course library covers the training itself.

Frequently asked questions

How do you put a number on compliance training?

By counting obligations you cannot currently evidence, the senior time required to reconstruct records retrospectively, the payroll cost of staff kept under supervision longer than necessary, and any population facing a fixed qualification deadline. Those are measurable; avoided fines generally are not.

Is completion rate a useful metric?

Not on its own. CQC’s guidance expects completed and required training to be tracked with action taken on gaps, so the useful metrics are the gap between the two and the evidence that it was addressed.

Which obligations carry fixed deadlines?

Among current examples, Irish credit union staff must hold a recognised qualification relevant to their function by 1 October 2028, with no grandfathering of previous experience. Fixed-date obligations are the strongest component of a business case because the population and the deadline are both known.

Should the business case include the records system?

Yes. Every regime discussed here is evidential — FCA TC 3.1.1R requires records demonstrating compliance, CQC requires training to be tracked and acted on, and the SRA has proposed mandatory learning records. Training delivered without retained evidence does not satisfy the obligation.