{"id":44315,"date":"2026-08-05T15:01:01","date_gmt":"2026-08-05T13:01:01","guid":{"rendered":"https:\/\/smartfense.com\/?p=44315"},"modified":"2026-08-05T15:01:12","modified_gmt":"2026-08-05T13:01:12","slug":"training-expiry-and-new-hires-compliance","status":"publish","type":"post","link":"https:\/\/smartfense.com\/en\/blog\/training-expiry-and-new-hires-compliance\/","title":{"rendered":"What happens to your compliance when training expires and new people join"},"content":{"rendered":"

What happens to your compliance when training expires and new people join<\/h1>\n

Closing the last gap in a standard feels a lot like crossing a finish line. The dashboard turns green, the evidence is filed, the report comes out clean. Four weeks later, with nobody touching the configuration, that same dashboard shows uncovered people again, because the training expiry<\/strong> date of several of them passed along the way.<\/p>\n

There is a simple explanation for that slide backwards. Coverage of a standard is a snapshot with a date on it, and that turns compliance into a moving target. What counts as covered today stops counting at some point, and while that happens the organisation keeps hiring people who never saw that content.<\/p>\n

When we introduced the Compliance Center<\/a> we showed what real-time compliance looks like, and when we explained how a compliance plan is set up<\/a> we went through what you decide before it starts. One question is still open. What does that plan do in the months that follow, when the ground moves on its own?<\/p>\n

What is training expiry?<\/h2>\n

Training expiry is the period during which a completed course still counts as valid evidence of compliance. Once that period ends, the person counts as a gap again, even if they passed the content at the time and even if the certificate is still filed away somewhere.<\/p>\n

This is not something platforms invented. Control 6.3 of ISO\/IEC 27001, which covers information security awareness, education and training, requires personnel to receive appropriate regular updates for their role. The word doing all the work there is regular<\/strong>. Training from two years ago does not meet that requirement, however thorough it was at the time.<\/p>\n

It is the mechanism that makes your programme\u2019s compliance fall apart in March<\/a> without anyone switching anything off. Coverage expires person by person, on different dates.<\/p>\n

Why compliance is never finished<\/h2>\n

Because three things move at the same time, and none of them waits until you have a free afternoon.<\/p>\n

The first one is the calendar. Every covered person carries their own expiry date, depending on when they completed the training. Across 500 employees that means 500 clocks that run in parallel<\/strong>, one per completion date. Whoever joined in January expires in January and whoever joined in August expires in August, so there is never a month when the dashboard sits still.<\/p>\n

The second one is the headcount itself. Every new hire falls within the scope of the standard from their first day, and every internal move can add an obligation they did not have before.<\/p>\n

The third one is the content. Repeating the same material every twelve months keeps the percentage up, but it stops teaching.<\/p>\n

How does this work with a spreadsheet?<\/h2>\n

By hand, all three are handled the same way. Someone opens the spreadsheet every so often, sorts by completion date, cross-checks the list against the latest directory export and puts together the batch of assignments that is due. That is enough to reach the audit, and the cost does not show up in the spreadsheet.<\/p>\n

It shows up in the interval. The spreadsheet describes the state of the day it was updated, not today\u2019s<\/strong>, and the gap between those two dates is exactly how long the organisation goes without knowing who is missing training. Someone who starts in September had no chance to complete the training you assigned in April and counts as a gap from day one, but only becomes visible once somebody updates the audience by hand. It is the same trap that makes your compliance percentage lie even at 100%<\/a>.<\/p>\n

Content works out much the same. Reassigning last year\u2019s module is the quick way out when the review is manual, so the second cycle repeats the material from the first. People recognise the screens, click through to the end and pass without reading. You satisfy the record and lose the effect that justified the record.<\/p>\n

What does the Compliance Center agent do differently?<\/h2>\n

The agent in SMARTFENSE\u2019s Compliance Center reviews compliance status every day and assigns training without waiting for anyone to open a spreadsheet. It works on those same three forces, one by one:<\/p>\n