Knowing that managers need whistleblowing training is one thing. Being able to demonstrate compliance to a tribunal, regulator or senior leadership that your organisation has met its training obligations is another.

For HR and compliance professionals, the gap between “we have done the training” and “we can demonstrate compliance” is where enforcement risk lives. This article sets out a practical framework for building and maintaining a defensible compliance record.

What “demonstrating compliance” actually means

Compliance with whistleblowing training requirements is assessed by three different audiences, each with different evidential expectations:

Employment tribunals

Tribunals assess whether an employer took all reasonable steps to prevent detriment to a whistleblower (Equality Act 2010 vicarious liability defence) or reasonable steps to prevent sexual harassment (Worker Protection Act 2023 positive duty). In both cases, the employer bears the burden of proof. Tribunals look at whether training existed, whether it was adequate for its purpose, whether it was current at the time of the incident, and whether the managers involved had actually received it.

Regulators

The EHRC, FCA, CQC and other sector regulators assess training as part of broader culture and conduct investigations. The standard they apply is not just whether training records exist, but whether the training was of sufficient quality to change manager behaviour – a higher bar that documented completion alone does not clear. The Fair Work Agency, launched under ERA 2025 in April 2026, adds a further enforcement body with proactive inspection powers.

Senior leadership and the C-suite

HR teams increasingly need to make the compliance case upward – demonstrating to board members and senior executives that the organisation’s training programme meets current legal requirements, is appropriately documented, and reduces the risk of regulatory or tribunal action. This internal audience wants a clear picture of coverage, currency and gaps, presented in terms of risk.

The four pillars of a demonstrable compliance record

1. A training needs analysis aligned to legal obligations

A compliance record begins with a documented assessment of which managers need which training and why. The training needs analysis should map legal obligations – PIDA, ERA 2025, WPA 2023, ACAS Code, sector-specific requirements – to manager roles and identify the training content required to meet each obligation. This document serves two purposes: it guides the training programme design, and it demonstrates to tribunals and regulators that the organisation understood its obligations before acting on them.

The needs analysis should be reviewed and updated following major legislative changes. The past 18 months have brought ERA 2025, the WPA 2023 positive duty coming into force, ECCTA’s failure to prevent fraud offence, and the FCA’s PS25/23. Any training needs analysis that predates these changes requires revision.

2. Completion records with sufficient detail

A record that shows a manager completed a training module on a given date is a starting point, not an endpoint. Tribunals and regulators will ask: what did the training cover? Who delivered it? Was it current at the time of delivery? Has it been refreshed since legislative changes took effect?

Completion records should capture: the course title and content summary; the delivery format (facilitated online, in-person, eLearning); the delivery date; the name of the trainer or provider; whether accreditation applies (CPD certification, for example); and whether a post-training assessment was conducted. SCORM-compliant eLearning that integrates with an LMS generates most of this automatically. Facilitated training requires a documented process for capturing equivalent data.

3. Evidence of content currency

A training record showing completion is only as strong as the content the training covered. HR teams should maintain a log of training content versions, with dates of last review and notes on what legislative changes triggered each review. Where training content was updated following the Worker Protection Act 2023 coming into force, or following ERA 2025’s first provisions taking effect in April 2026, that update should be documented – and managers should have records showing they received the updated content, not just the earlier version.

CPD-accredited training provides an independent quality marker that content was accurate and current at the point of delivery. The CPD Certification Service requires course providers to maintain content accuracy as a condition of accreditation – meaning CPD-certified training carries an implicit assurance of currency that unaccredited training does not.

4. A refresh and renewal schedule

Demonstrating compliance is not a one-time exercise. HR teams need a documented schedule for training refresh cycles – setting out when training will be renewed, what triggers an out-of-cycle review (legislative change, a significant tribunal decision, an internal incident), and how refresh completion is tracked. A schedule that has been followed and documented is far stronger evidence of a genuine compliance commitment than a one-off training exercise with no follow-up.

Building the business case for the C-suite

For HR teams presenting the compliance case upward, the most effective framing combines legal obligation with financial risk. The Worker Protection Act 2023 compensation uplift (up to 25% on uncapped discrimination awards), the ACAS Code uplift (up to 25% for procedural failures), and the ECCTA failure to prevent fraud offence (unlimited fines) together represent a material financial risk that senior leadership can quantify.

CIPD research from 2024 found that 81% of employers believed they were doing enough to address harassment and bullying, while only 36% of employees felt their concerns were being resolved. The Safecall Benchmark Report 2024 found that discrimination reports tripled (from 3% to 8% of cases) and bullying increased by 5% to 17% of cases year-on-year. These figures give HR teams a data-driven basis for the argument that the risk environment has changed – and that the organisation’s training programme needs to reflect that.

Practical steps: building the compliance record

HR teams building or auditing their whistleblowing training compliance record should work through the following:

• Audit existing records: establish what training has been delivered, to whom, when and on what content. Identify managers who have no training record, those whose training predates key legislative changes, and those in roles with sector-specific requirements that may not be covered
• Map gaps to obligations: cross-reference the audit findings against current legal requirements – PIDA as amended by ERA 2025, WPA 2023 positive duty, ECCTA, ACAS Code, sector regulation – and document the gaps
• Update training content: ensure training content reflects the current legal position. Content that predates October 2024 (WPA 2023 in force) or April 2026 (ERA 2025 first wave) should be reviewed
• Establish a documentation protocol: implement a consistent process for recording completion, content version, delivery format and accreditation status for all future training
• Set a refresh schedule: document when training will be renewed and what events trigger an out-of-cycle review
• Report to leadership: prepare a compliance summary that maps the training programme to legal obligations, identifies residual gaps and quantifies the risk of non-closure

eLearning, LMS integration and automated record-keeping

SCORM-compliant eLearning that integrates with an organisation’s LMS provides the most straightforward route to automated compliance record-keeping. Completion data, pass rates, time spent and version information are captured automatically and can be extracted for audit or reporting purposes. Where eLearning is supplemented by facilitated training – which is typically necessary for manager-level obligations that require more than awareness – the LMS record should be supplemented by manually captured attendance and completion data for the facilitated sessions.

eLearning alone is generally insufficient to satisfy the “all reasonable steps” standard for managers in the context of the Worker Protection Act positive duty or PIDA detriment obligations. Tribunals and regulators distinguish between awareness training that confirms a worker has read a policy and facilitated training that equips a manager to act correctly under pressure. The compliance record should reflect both, with the facilitated component documented to the same standard as the eLearning component.

Related resources

Legal Obligations for Manager Training in the UK (hub): https://www.safecall.co.uk/resource/legal-obligations-for-manager-training-in-the-uk/

What records should organisations keep of manager training for compliance purposes: https://www.safecall.co.uk/resource/legal-obligations-for-manager-training-in-the-uk/

How does CPD-accredited training support legal defensibility: https://www.safecall.co.uk/resource/how-does-cpd-accredited-training-support-legal-defensibility/

Whistleblowing Training for Managers: https://www.safecall.co.uk/training/

How Safecall supports HR compliance teams

Safecall’s CPD Certified facilitated training courses – Listen Up (Whistleblowing for Managers) and Tackling Sexual Harassment – A Guide for Managers – generate documented attendance records and completion certificates as standard. Training content is maintained to reflect current legislation, including ERA 2025 and the Worker Protection Act 2023 positive duty. SCORM-compliant eLearning courses can be hosted on clients’ own LMS for automated completion tracking. Bespoke tailoring is available for organisations needing training aligned to their own policies, sector requirements or compliance architecture.

Find out more about Safecall’s training courses at safecall.co.uk/service/compliance-training/ or contact the team at learning@safecall.co.uk | +44 (0) 191 516 7720

Sources and further reading

Worker Protection (Amendment of Equality Act 2010) Act 2023: legislation.gov.uk/ukpga/2023/51

Employment Rights Act 2025: legislation.gov.uk/ukpga/2025

Equality and Human Rights Commission – Employer guidance on preventing sexual harassment at work: equalityhumanrights.com/guidance/employer-guidance-preventing-sexual-harassment-work

ACAS – Code of Practice on Disciplinary and Grievance Procedures: acas.org.uk/acas-code-of-practice-for-disciplinary-and-grievance-procedures

CIPD – Harassment and Bullying at Work, 2024: cipd.org/uk/knowledge/reports/harassment-bullying-work/

Safecall Benchmark Report 2024: safecall.co.uk/resources/benchmark-report/

CPD Certification Service: cpduk.co.uk