How do you choose a compliance training LMS?
By Embay Consulting Inc.
Choose a compliance LMS by testing the record it produces, not the features it lists. Ask what each completion stores and whether renewals run without an administrator. Then check content standards, data location, languages, and what the same headcount costs on each pricing model. Seven checks, in order, below.
Key facts
- The test that decides it
- Can a manager outside the training team produce one person's dated history, unaided, in a few minutes?
- Minimum record fields
- Who, what, when, how completion was established, and who attests to it.
- Recurrence
- Expiry on the interval the obligation sets, automatic reassignment, escalation to the manager.
- Standards to ask for
- SCORM 1.2 and 2004 at minimum, and cmi5 or xAPI if your content is moving there.
- Residency, in writing
- A named cloud region, the current sub-processor list, and every flow that leaves the region.
- Price comparison
- Same headcount, same monthly training schedule, in Canadian dollars, with the billable user defined.
The steps
- Inventory the obligations. List every training program and the statute, regulator or policy behind it. The obligation decides the record, the recurrence and the retention period, not the platform.
- Define the record. Write down the fields every completion must carry, then ask each vendor to show one completion that has all of them.
- Test recurrence. Ask for a certificate that expires, reassigns the learner and escalates to the manager without an administrator. Watch it happen in a demo tenant rather than reading about it.
- Check the standards. Upload one of your own SCORM packages. Confirm which versions run, and whether cmi5 or xAPI are available if your content is moving there.
- Get residency in writing. Ask for the named cloud region, the current sub-processor list and every flow that leaves the region. Treat a claim with no carve-outs as unverified.
- Check the language. Open the learner interface in English and in Canadian French, and check that a French course does not fall back to English chrome.
- Normalize the price. Give every vendor the same headcount and the same monthly training schedule, in Canadian dollars, and ask how a billable user is defined.
What should a compliance LMS record for every completion?
Five fields, and a vendor should be able to show all five on one screen. The identity of the learner as a durable identifier, not a display name. The identity of the content with a version marker. The original completion date, which must survive an import from a previous system. How completion was established: a score, a pass mark, an observed assessment or an attendance confirmation. And who attests to it, the system or a named person.
Two more are worth asking about even if nobody has required them yet: the expiry or next-due date where the training recurs, and the language the training was delivered in.
The practical test is the one the audit-ready records page describes. Ask a manager outside the training function to produce, unaided, the completion history for one named person and one named course, with dates. If that takes more than a few minutes or needs a specialist, the evidence exists but the process around it does not.
How should recurring training and recertification work?
Most compliance training recurs. Hazardous products refreshers, professional-order reference periods and policy acknowledgements all come back on a schedule the obligation sets, not the platform. The system has to carry that schedule so that nobody has to remember it.
Ask for three things to happen without an administrator. The completion expires on the interval you set. The learner is re-enrolled and reminded. The manager is notified when the deadline passes. Then ask to see it happen in a demo tenant, because a feature list that says "recertification" can mean anything from all three to a report someone reads once a quarter.
Ask separately what happens to the record when the person leaves. A completion that disappears with a deactivated account is a gap in the audit trail exactly when the trail matters.
Which content standards should a compliance LMS run?
SCORM 1.2 and SCORM 2004 at minimum. Most safety and compliance content from providers ships in one of those two, and the difference between them matters for compliance: SCORM 2004 records completion and success as two separate fields, so a course can be finished and failed. SCORM 1.2 collapses them into one status.
Ask whether cmi5 and xAPI are available, and on which plan. They matter if your content is moving to those formats or if you want statements from more than one system in one record store. Ask whether the engine is the vendor's own or licensed, since that decides who fixes a package that will not play.
The test is simple. Upload one of your own packages during the evaluation, run it to the end as a learner, and read the record it produced.
What should you ask about data residency and language?
Residency first. Ask for the named cloud region rather than the country, the current sub-processor list with each party's role and location, and every flow that leaves the region with the reason. A vendor whose residency claim has no carve-outs at all has usually not looked. Transactional email, support access and telemetry commonly cross a border even when the core claim is honest.
Residency is not sovereignty. Where the disk sits is verifiable; which government can compel access to it depends on where the operator is incorporated, and that is a question for your counsel, not for a vendor page.
Language second, if you have workers in Quebec or anywhere the training must be delivered in French. Open the learner interface in both English and Canadian French. Check that a course delivered in French does not sit inside English navigation, and that the French is written for Quebec rather than translated from France French. Ask which plan includes the second language, because some vendors gate it.
How do you compare compliance LMS prices fairly?
Normalize before you compare. Give every vendor the same four inputs in writing: the price in Canadian dollars with taxes and the billing cycle stated, the exact definition of a billable user, every cap that forces a plan change, and the cost of leaving with your records in a standard format.
Then run your own training schedule through each quote. A 500-person organization rarely has 500 people training in the same month. Per seat licensing charges for the right to have an account. Active user billing charges for use of the account. The same headcount prices very differently under each, and the lowest list price is not always the cheapest year.
How does EmbayLMS fit these checks?
EmbayLMS records completions with their original dates and preserves them through imports and after account deactivation. Certificates carry expiry dates that trigger re-certification and reassignment. SCORM 1.2 and 2004 run on every plan on an engine built in house. Learning data is stored at rest in AWS ca-central-1, with the carve-outs published, and the learner interface ships in English and Canadian French on every plan. Pricing is per active user, in Canadian dollars, with the definition of an active user stated on the pricing page.
What EmbayLMS does not do is decide your retention period or tell you which obligation a course answers to. Those come from the inventory in the first step, and they are yours.
Related questions
- What should a compliance LMS record for every completion?
- Five fields, and a vendor should be able to show all five on one screen. The identity of the learner as a durable identifier, not a display name. The identity of the content with a version marker. The original completion date, which must survive an import from a previous system. How completion was established: a score, a pass mark, an observed assessment or an attendance confirmation. And who attests to it, the system or a named person.
- How should recurring training and recertification work?
- Most compliance training recurs. Hazardous products refreshers, professional-order reference periods and policy acknowledgements all come back on a schedule the obligation sets, not the platform. The system has to carry that schedule so that nobody has to remember it.
- Which content standards should a compliance LMS run?
- SCORM 1.2 and SCORM 2004 at minimum. Most safety and compliance content from providers ships in one of those two, and the difference between them matters for compliance: SCORM 2004 records completion and success as two separate fields, so a course can be finished and failed. SCORM 1.2 collapses them into one status.
- What should you ask about data residency and language?
- Residency first. Ask for the named cloud region rather than the country, the current sub-processor list with each party's role and location, and every flow that leaves the region with the reason. A vendor whose residency claim has no carve-outs at all has usually not looked. Transactional email, support access and telemetry commonly cross a border even when the core claim is honest.
- How do you compare compliance LMS prices fairly?
- Normalize before you compare. Give every vendor the same four inputs in writing: the price in Canadian dollars with taxes and the billing cycle stated, the exact definition of a billable user, every cap that forces a plan change, and the cost of leaving with your records in a standard format.
Sources
- What makes a training record audit ready — EmbayLMS, accessed September 10, 2026
- Canadian data residency for training systems — EmbayLMS, accessed September 10, 2026
- SCORM explained — Rustici Software, accessed September 10, 2026
- LMS pricing in Canada, explained — EmbayLMS, accessed September 10, 2026