Training completed. What has changed?

From the guide

Beyond the completion figure: behaviour, verification and leadership

Your board paper says cyber awareness training is complete. That shows participation in the programme. The next question is whether people can use what they have learned when the request is urgent, the sender seems familiar or a senior person is waiting. The full guide works through this in detail; here are the essentials.

The questions a board should ask

• What should people do differently because of this training? Ask for a specific behaviour in a situation that matters, and evidence that people can apply it.
• Can people pause, verify and report when urgency or seniority creates pressure? Ask how leadership behaviour, escalation routes and the working process support them.
• What have we changed because of what people reported or exercises revealed? Look for an accountable owner, a completed improvement and a check that it helped.

One useful request for the next paper: "Show us one example where someone applied the training, one where the process made it difficult, and what we learned from both."

The evidence to request

Ask management to bring a few relevant examples alongside the completion figure:

• Verification under pressure — examples or proportionate checks showing sensitive instructions and payment changes were independently verified, including requests involving senior people.
• Reporting and the response — whether people know how to report a concern, how quickly reports reach the right team, and whether early reporting is encouraged even after an honest mistake.
• Learning that leads to change — a weakness found through an exercise, incident or staff feedback, what changed, and how the improvement was checked.

Read the measures in context. A low simulation click rate alone does not establish that people will verify payment instructions or report a real concern — and more reports may reflect greater willingness to speak up, more suspicious activity, or both.

A practical scenario

Buck's interpretation

Leadership is part of the control. If leaders expect people to challenge suspicious requests, their response to that challenge matters — impatience, criticism or routine requests to bypass checks can undermine the behaviour the training is intended to encourage. The commitment needs to hold when a legitimate request is delayed too.

Keep responsibility shared. People will sometimes miss a convincing deception, so training sits alongside access controls, payment approvals and technical protections. The board should examine whether these safeguards work together and help limit the consequences of a mistake.

And a confident discussion is a starting point, not proof: record one assumption to check, an accountable owner and a date for reporting back.