Most mandatory training ends the same way: a slide deck, a box to tick and a report of who finished. The report is accurate and says little. It counts who reached the last slide, not who knows what to do when a supplier sends a gift.
A compliance training quiz can do more. It has two honest jobs: a record of what a named person answered, and a check that they can apply the policy to a situation. It cannot show what anyone will do next month.
EdProcto publishes this guide, and its page for corporates describes the product's part: a quiz from each policy and a re-test when the policy changes. Nothing below is legal advice or a statement of what any law or regulator requires.
What can a compliance training quiz honestly prove?
A compliance quiz proves two things: that a named person sat these questions on this date and answered them this way, and that on the day they could, or could not, apply the policy to the situations you wrote.
The first is a record, and it beats a tick box because it has content: what the person thought the policy meant. The second is a check of understanding, only as good as the questions.
Neither is evidence of conduct. Hauser (2020) describes a knowledge-practice gap: professionals who know the principles of responsible management and do not act on them from day to day. A pass sits on the knowledge side of that gap, so never describe the record as proof that the policy is followed.
Does mandatory compliance training change what people know and do?
It changes what people know much more reliably than what they do. The studies below cover harassment, ethics, safety and security training, each on its own, and none is about your company.
Roehling et al. (2022) pooled the research on sexual harassment training. The largest effect was on knowledge of the facts (an effect size of 1.06), then attitudes (0.41) and skills (0.39). The effect on transfer outcomes, meaning what carried over to the workplace, was 0.14.
Watts et al. (2017) pooled 66 studies of research ethics instruction in the sciences, with 10,069 participants. The largest effect was again on knowledge (0.78, against 0.48 overall), and mandatory programmes showed half the effect of voluntary ones (0.26 against 0.52).
Burke et al. (2006) pooled 95 studies of safety and health training, covering 20,991 workers in 15 countries. Knowledge gains rose with how much the method made the trainee do: 0.55 for lectures, pamphlets and videos, 0.74 for programmed instruction and feedback, and 1.46 for hands-on practice and behavioural modelling. Every method improved rated safety behaviour, by similar amounts.
So the picture is mixed. Knowledge gains are the consistent finding. Effects on behaviour run from solid in safety training to slight in harassment training and absent in the phishing trials below. We could not read a count of how many evaluations of compliance training measure conduct on the job, so we give none. For Watts, Burke and Lain we read the full text; for the other four sources, the published abstract.
Does click-through e-learning work?
We found no trial that set a click-through compliance module against a better one, so this is the weakest part of the evidence. The nearest finding is in Burke et al. (2006): the least active methods taught least, and computer-based instruction sat in the middle group, with the methods that give feedback. A deck with a Next button gives none.
Security awareness training, a well-studied case
Security awareness training is the case where behaviour is easiest to measure: send a simulated phishing email and count who clicks.
Lain et al. (2022) did that for 15 months with 14,733 employees of one company, each sent eight simulated emails. Half were assigned to see a training page whenever they fell for one, and nothing made them read it or take its quizzes. They did not become more careful: 801 of them clicked on two or more of the emails, against 647 in the half with no page. The authors note that they did not test mandatory training.
Ho et al. (2025) ran an eight-month randomised trial with more than 19,500 employees of a healthcare organisation. They report no significant relationship between having recently completed the annual awareness training and failing a simulated phishing email, and that most people spent minimal time on the embedded training material.
Reinheimer et al. (2020) show the fade. In a German public administration body with 409 employees, people were better at telling phishing from legitimate emails directly after an awareness programme and four months later. At six months the improvement was no longer significant.
None of these studies tested a quiz. What they support, in our reading, is three rules: make people do something with the policy, check again within months, and never read completion as a change in behaviour.
How do you write a compliance quiz nobody can pass without reading?
Write every question as a situation drawn from your own policy and your own incidents, and make every wrong option a shortcut that people really take.
- Mark the clauses that ask for an action. Report within a time, refuse, declare, lock, escalate.
- Collect your own incidents. Near misses, audit findings, the questions people bring to the compliance officer. Remove names and anything that identifies a person.
- Write situations, not definitions. "A supplier offers...", "A customer emails asking for...".
- Make the wrong options the tempting shortcuts: what a busy, well-meaning person does when the rule is inconvenient.
- Add two or three questions on where the rule lives and whom to tell. Nobody memorises a policy.
- Stop at eight to twelve questions. Fewer, and a lucky guess moves the result.
- Draft it in EdProcto. Paste the policy into the quiz maker on the home page. Procto AI writes the questions from that text and, if asked, only ones the text itself answers. Then edit every one.
- Write a twin for each question: the same clause in a new situation, for the retake and for next year.
- Give the quiz to someone who has not read the policy. Whatever they get right by common sense is answerable without reading. Rewrite it.
Let people keep the policy open while they answer. Finding the rule is part of the skill.
A definition question and a situation question
Suppose a gifts policy says: "Gifts from suppliers worth more than £50 are declined, or declared to the compliance officer within five working days." The clause is invented for this illustration.
Definition: Above what value must a gift from a supplier be declared?
Situation: A supplier whose contract you are renewing sends two match tickets, worth about £120 each, to your home. Your manager is on leave. What do you do? A. Keep them, because they came to your home and not to the office. B. Accept, and mention it to your manager when she is back in three weeks. C. Pass them to a colleague who has no part in the renewal. D. Return them, or declare them to the compliance officer this week.
The first is answered by finding a number. In the second, A, B and C are each what a reasonable person might do on a busy day, and the one a person picks tells you which belief to correct.
Two other shapes fit clauses that ask for more than a rule applied:
| What the clause asks | Shape in EdProcto |
|---|---|
| Judge between responses that each have a case | Best and worst, with a guide of its own |
| Handle an incident as it develops | Case study: one scenario across several questions |
What pass mark should you set, and what happens on a fail?
Set the pass mark before anyone sits the quiz, below 100% unless every question is critical, and decide in advance what a fail leads to.
A 100% pass mark with unlimited instant retakes defeats the purpose. The record then shows a perfect score for someone who clicked until the screen said passed.
A fail should lead somewhere useful:
- First fail: read the section again, then retake on the twin questions.
- Second fail: a conversation with the manager or the policy owner. Two fails may mean the policy is unclear, not that the person is careless.
- Never a public list. Who failed is between the person, their manager and the training's owner.
If one question is critical (whom to call when someone is hurt, say), treat a miss on it as a conversation whatever the score.
In EdProcto the pass mark is a percentage you set, and whole-quiz retakes are none, one, three or no limit. A retake is the same quiz again, in a new order when shuffling is on. A retake with different questions is done by hand: build the twins as a second quiz and send its code to whoever failed.
When should you retest?
Retest when the policy changes and at least once a year, with different questions each time.
The interval is a judgement. Reinheimer et al. (2020) found the gain gone at six months, in one organisation and on one skill. That is a reason not to trust an annual refresher to hold for a year where a lapse is costly, and no proof that six months suits your policy.
When a clause changes, test the changed clause. And never reuse last year's ten questions: people remember or keep the answers. Write new situations from the year's incidents.
EdProcto does not re-assign a quiz each year or chase people who have not sat it. The list of who is due, and the reminder, stay with you.
What should the record hold, and how long should you keep it?
The record should hold who, when, which version of the policy, the score and the answers. Keep it for as long as your own retention policy says, a period to set with whoever advises you.
EdProcto's record of an attempt holds:
- the name and the email address the person typed, which are not proof of who was at the keyboard;
- when they started and when they handed in;
- every answer, with the seconds spent on each question;
- the mark for each question and who made it: the rule, Procto AI or you;
- any events logged by the integrity measures you switched on.
It does not hold the policy's version. Put the version and date in the quiz title by hand ("Gifts policy v4, October 2026") and make a new quiz when the policy changes. Results stay on the server under your account for as long as you keep them, and copying them into an HR or training system is also done by hand.
What do the results say about the policy itself?
A question most people miss usually marks a clause that is unclear. Go through the results one question at a time before you look at any one person.
- Most people miss it. The clause is vague, buried, or contradicted by what people see done.
- Most choose the same wrong option. That shortcut is the custom. Tell the policy owner.
- One team misses what the others get. Local practice differs. Talk to that team's manager.
- Everyone gets it right, including the colleague who never read the policy. The question is too easy.
EdProcto's results list each question's difficulty, and the full analysis on Educator counts who took each wrong option. Item analysis for teachers explains the numbers.
How does EdProcto run a compliance quiz?
EdProcto is the best tool for a compliance quiz when the questions have to come from your own policy, because that is where it starts, and because its results show which clause people misread. A bank of general questions on data protection cannot tell you that your own fourth clause is unclear.
- Written from the policy. With answers checked against your material only, Procto AI is told to write only questions the pasted text answers and to say where each answer is. Read every one against the policy before it goes out.
- One code for the quiz, opened by each person on their own device. No answer key travels with the questions, and the marking is done by rule on the server.
- Settings that act: the pass mark, retakes, shuffled questions and options, and when answers and scores show. "An account is needed to take it" asks for a name and an email address.
- Integrity to fit the stakes. An open-policy quiz needs little monitoring. Each measure you switch on is named to the person before they begin, and a flag only records an event for you to weigh: see the integrity page.
On the Free plan a quiz takes thirty people, with ten quizzes and 20 Procto AI questions a month: one policy's ten questions and their twins. Tutor opens all 111 shapes, with 100 people a quiz and 50 written questions a month. Educator allows 500, has no monthly cap on writing, and adds the full analysis and a certificate on passing. A licence, arranged by a call, has no limit on candidates or staff: see the hiring page and pricing.
Two limits. A different set of questions for each person needs the Educator plan, where Procto AI writes each their own on the same clauses. And nothing here claims that using EdProcto meets any law, regulation or standard.
The same documents serve onboarding knowledge checks and product knowledge tests for hiring.
Which mistakes make a compliance quiz worthless?
Four mistakes do most of the damage.
- Questions answerable without reading. "Should you report a data breach? Yes or no." Step 9 catches these.
- A 100% pass mark with unlimited instant retakes. It records persistence.
- The same ten questions every year. The score comes to measure memory of the quiz.
- Treating a pass as proof of competence. A pass says that on one day a person could apply the policy on paper.
Quick questions
How many questions should a compliance training quiz have?
Eight to twelve, nearly all of them situations, with two or three on where the rule is and whom to tell.
What pass mark should a compliance training test have?
One set before anyone sits it and, for most policies, below 100%. Decide then what a fail leads to: the section again, a retake with different questions, a conversation.
Does passing a code of conduct quiz prove an employee is competent?
No. It shows that on that date the person could apply the policy to the situations asked. Roehling et al. (2022) found that harassment training moved knowledge far more than what carried over afterwards.
Can EdProcto build a policy quiz from our own documents?
Yes. Paste the policy and Procto AI writes the questions from it, for you to edit. EdProcto's page for corporates lists compliance beside onboarding and hiring.
References
- Burke, M. J., Sarpy, S. A., Smith-Crowe, K., Chan-Serafin, S., Salvador, R. O., & Islam, G. (2006). Relative effectiveness of worker safety and health training methods. American Journal of Public Health, 96(2), 315–324. https://doi.org/10.2105/AJPH.2004.059840
- Hauser, C. (2020). From preaching to behavioral change: Fostering ethics and compliance learning in the workplace. Journal of Business Ethics, 162(4), 835–855. https://doi.org/10.1007/s10551-019-04364-9
- Ho, G., Mirian, A., Luo, E., Tong, K., Lee, E., Liu, L., Longhurst, C. A., Dameff, C., Savage, S., & Voelker, G. M. (2025). Understanding the efficacy of phishing training in practice. In 2025 IEEE Symposium on Security and Privacy (SP) (pp. 37–54). IEEE. https://doi.org/10.1109/SP61157.2025.00076
- Lain, D., Kostiainen, K., & Čapkun, S. (2022). Phishing in organizations: Findings from a large-scale and long-term study. In 2022 IEEE Symposium on Security and Privacy (SP) (pp. 842–859). IEEE. https://doi.org/10.1109/SP46214.2022.9833766
- Reinheimer, B., Aldag, L., Mayer, P., Mossano, M., Duezguen, R., Lofthouse, B., von Landesberger, T., & Volkamer, M. (2020). An investigation of phishing awareness and education over time: When and how to best remind users. In Proceedings of the Sixteenth Symposium on Usable Privacy and Security (SOUPS 2020) (pp. 259–284). USENIX Association. https://www.usenix.org/conference/soups2020/presentation/reinheimer
- Roehling, M. V., Wu, D., Choi, M. G., & Dulebohn, J. H. (2022). The effects of sexual harassment training on proximal and transfer training outcomes: A meta-analytic investigation. Personnel Psychology, 75(1), 3–31. https://doi.org/10.1111/peps.12492
- Watts, L. L., Medeiros, K. E., Mulhearn, T. J., Steele, L. M., Connelly, S., & Mumford, M. D. (2017). Are ethics training programs improving? A meta-analytic review of past and present ethics instruction in the sciences. Ethics & Behavior, 27(5), 351–384. https://doi.org/10.1080/10508422.2016.1182025