If you're requiring everybody at the company to do training so you can show your auditors that everybody did the training, then you're missing the point.
The point of training is to equip people to do the right thing. If the training doesn't accomplish that, then making sure all the boxes are checked is worthless.
What problem is the training trying to solve? Is the training necessary and sufficient to solve it? If you're not answering these questions, you're doing it wrong.
#infosec #compliance