# Control 2.14: Training and Awareness Program

**Control ID:** 2.14<br>
**Pillar:** Management<br>
**Regulatory Reference:** FINRA Rule 3110(a)(7), FINRA RN 24-09, SOX Section 404, GLBA Section 501(b), OCC Bulletin 2026-13 (formerly OCC Bulletin 2011-12)<br>
**Last UI Verified:** April 2026<br>
**Governance Levels:** Baseline / Recommended / Regulated

---

## Objective

Establish comprehensive training and awareness programs for AI agent governance so that personnel involved in agent creation, approval, supervision, and oversight can develop the knowledge and skills that support regulatory compliance objectives.

---

## Why This Matters for FSI

- **FINRA Rule 3110(a)(7):** Supervisory systems require annual compliance meetings and substantive training for personnel involved in oversight functions, including those overseeing AI-assisted activity.
- **FINRA RN 24-09 / Rule 3110 / 2026 Annual Regulatory Oversight Report (GenAI section):** Firms are expected to deliver substantive, recurring AI-specific training that addresses model capabilities, limitations, bias, hallucination risk, and escalation paths — beyond a "check-the-box" exercise.
- **SOX Section 404:** Internal control over financial reporting requires evidence of personnel competency where AI agents touch financial workflows.
- **GLBA Safeguards Rule (16 CFR 314.4) / Section 501(b):** Written information security programs must include training tailored to the risks each role presents to customer information.
- **OCC Bulletin 2026-13 (formerly OCC Bulletin 2011-12) (Model Risk Management) and Federal Reserve SR 26-2 (formerly SR 11-7):** Model owners, validators, and users require documented competency proportionate to model criticality.

---

!!! info "No companion solution by design"
    Not all controls have a companion solution in [FSI-AgentGov-Solutions](https://github.com/judeper/FSI-AgentGov-Solutions); solution mapping is selective by design. This control is operated via native Microsoft admin surfaces (Microsoft Viva Learning or a third-party LMS plus an organization-specific curriculum) and verified by the framework's assessment-engine collectors. See the [Solutions Index](../../reference/solutions-index.md#coverage-scope) for the catalog and coverage scope.


## Control Description

This control establishes training through:

1. **Role-Based Curricula** - Define training requirements per role (maker, approver, supervisor, admin)
2. **Core Competencies** - Establish minimum knowledge requirements for AI governance
3. **Certification Requirements** - Define certification for critical roles
4. **Delivery Mechanisms** - Implement training via LMS, SharePoint, or Viva Learning
5. **Competency Assessment** - Verify understanding through assessments
6. **Ongoing Education** - Annual refresher and updates for policy changes

---

## Key Configuration Points

- Define training personas: Agent Maker, Agent Approver, Agent Supervisor (FINRA 3110), Platform Admin, End User
- Author role-based curricula covering AI capabilities, limitations, bias, hallucination, escalation, and firm policy
- Configure delivery platform — Microsoft Viva Learning (set up in the **Teams admin center**) with SharePoint and/or supported LMS (Cornerstone, Saba, SuccessFactors, Workday) as content sources
- Assign the **Knowledge Admin** Entra role to staff managing Viva Learning content sources
- Establish assessment criteria and a documented passing threshold (commonly 80%); record the rationale for the threshold
- Track completion status in the LMS or Viva Learning system of record; export evidence on a defined cadence
- Configure reminders for initial assignment, annual refresher, and policy-change attestations
- Retain training completion evidence per the firm's record-retention schedule (see Control 2.13); for SEC 17a-4(f)-impacting roles, retain in WORM-compliant storage

---

## Zone-Specific Requirements

| Zone | Requirement | Rationale |
|------|-------------|-----------|
| **Zone 1** (Personal) | Basic governance awareness; annual refresher; self-paced | Low risk, foundational knowledge sufficient |
| **Zone 2** (Team) | Role-specific training; completion tracking; assessment required | Shared agents warrant demonstrated competency |
| **Zone 3** (Enterprise) | Comprehensive certification; quarterly updates; competency verification; regulatory focus | Customer-facing requires maximum training rigor |

---

## Roles & Responsibilities

| Role | Responsibility |
|------|----------------|
| AI Administrator | Sponsor curriculum scope for Microsoft 365 Copilot and agent governance; coordinate with compliance on AI-specific content |
| Knowledge Admin (Entra) | Configure Viva Learning content sources (SharePoint, LMS connectors) and manage the learning catalog |
| Power Platform Admin | Provide maker-track content for Microsoft Copilot Studio and Power Platform; align training prerequisites to environment provisioning |
| Purview Compliance Admin | Approve regulatory training content; validate alignment with FINRA / SEC / GLBA obligations; own retention of training records |
| Business Manager (non-admin) | Ensure team completion, address competency gaps, attest to readiness for FINRA-supervised activity |

---

## Related Controls

| Control | Relationship |
|---------|--------------|
| [2.12 - Supervision](2.12-supervision-and-oversight-finra-rule-3110.md) | Supervisors require specific training |
| [2.8 - Access Control](2.8-access-control-and-segregation-of-duties.md) | Role assignments align with training completion |
| [2.11 - Bias Testing](2.11-bias-testing-and-fairness-assessment.md) | Bias awareness included in training |
| [2.13 - Documentation](2.13-documentation-and-record-keeping.md) | Training records maintained per retention requirements |

---

## Implementation Playbooks

!!! info "Step-by-Step Implementation"

    This control has detailed playbooks for implementation, automation, testing, and troubleshooting:

    - [Portal Walkthrough](../../playbooks/control-implementations/2.14/portal-walkthrough.md) — Step-by-step portal configuration
    - [PowerShell Setup](../../playbooks/control-implementations/2.14/powershell-setup.md) — Automation scripts
    - [Verification & Testing](../../playbooks/control-implementations/2.14/verification-testing.md) — Test cases and evidence collection
    - [Troubleshooting](../../playbooks/control-implementations/2.14/troubleshooting.md) — Common issues and resolutions

---

## Verification Criteria

Confirm control effectiveness by verifying:

1. Role-based training curricula documented for all AI governance roles
2. Training delivery platform configured with courses and assessments
3. Completion tracking shows personnel have completed required training
4. Assessment records demonstrate competency (passing scores)
5. Annual refresher schedule established with automated reminders

---

## Additional Resources

- [Microsoft Learn: Viva Learning Overview](https://learn.microsoft.com/en-us/viva/learning/overview-viva-learning)
- [Microsoft Learn: Set up Viva Learning in the Teams admin center](https://learn.microsoft.com/en-us/viva/learning/set-up-viva-learning)
- [Microsoft Learn: Add SharePoint as a content source for Viva Learning](https://learn.microsoft.com/en-us/viva/learning/configure-sharepoint-content-source)
- [Microsoft Learn: Add learning management systems for Viva Learning](https://learn.microsoft.com/en-us/viva/learning/configure-lms)
- [FINRA Rule 3110: Supervision](https://www.finra.org/rules-guidance/rulebooks/finra-rules/3110)
- [FINRA Regulatory Notice 24-09 — Generative AI guidance (June 2024)](https://www.finra.org/rules-guidance/notices/24-09)
- [FINRA 2026 Annual Regulatory Oversight Report — GenAI](https://www.finra.org/rules-guidance/guidance/reports/2026-finra-annual-regulatory-oversight-report/gen-ai)
- [OCC Bulletin 2026-13: Model Risk Management (formerly OCC Bulletin 2011-12)](https://www.occ.gov/news-issuances/bulletins/2011/bulletin-2011-12.html)
- [Federal Reserve SR 26-2 (formerly SR 11-7): Guidance on Model Risk Management](https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm)

---

!!! note "Implementation Note"
    Organizations should verify that their implementation meets their specific regulatory obligations. This control supports compliance efforts but requires proper configuration and ongoing validation.

*Updated: May 2026 | Version: v1.6.2 | UI Verification Status: Current*
