A staff member who refuses mandatory security training is a compliance and HR problem before it is a security one: the manager documents the refusal, applies the graduated process in the workplace policy (reminder, written notice, escalation to HR), and never leaves the refusal as an open question going into an audit. The platform's job is to make refusal rare and visible - which is exactly why the process below starts with the training design rather than the disciplinary policy.
TL;DR
- Most refusals are friction, not defiance: overdue emails, forgotten logins and long courses cause the majority of non-completion.
- Respond in three tiers: automated reminders, a direct manager conversation, then formal escalation under your policy.
- Document every step; the record matters for insurers and auditors as much as for HR.
- Staff data from training stays inside the employment relationship for private-sector employers under the employee-records rules (OAIC, Employment).
- Make training short and story-based so compliance is the easy path - the refusal process exists for the last few percent, not the middle of the bell curve.
Why this matters in 2026
Cybercrime keeps moving money out of Australian businesses: the average self-reported cost per report for businesses rose 50 percent overall to $80,850 in 2024-25, and small business reported an average of $56,600 (ASD, Annual Cyber Threat Report 2024-25). ASD's own baseline advice - MFA, strong passwords, software updates, alertness to phishing, regular backups - is behaviour-based, which means every member of staff either practises it or does not. A training program only works if it reaches everyone; that is what makes refusal worth taking seriously rather than shrugging at.
There is also a compliance angle. Insurers and clients increasingly ask for evidence that staff training actually completed, and a gap assessment flags missing coverage regardless of why a person did not finish. An organisation with a documented process for refusals can answer that question in one sentence; one without it redoes its audit.
Is security training mandatory?
In most Australian organisations it is made mandatory by internal policy rather than by a specific statute: the employer's own IT, HR or safety policy requires completion, and that policy is part of the employment relationship. Government agencies and regulated industries generally have explicit framework requirements on top. What matters operationally is the same either way - if your policy says training is mandatory, the platform and the process have to be able to prove completion and handle non-completion, because an unenforced mandate quietly becomes optional for everyone.
How to handle a staff member who refuses training
Work through the tiers in order. Escalation before the first two are done is usually a mistake - it spends your disciplinary capital on what is most often a fixable friction problem.
| Tier | Action | When |
|---|---|---|
| 1. Automate | Reminder emails on due and overdue cadence, set once | The default for everyone |
| 2. Converse | Direct manager conversation, documented | After a second overdue notice |
| 3. Escalate | Formal notice under the workplace policy | After the conversation fails |
Tier 1: fix the friction first. Look at the data before assuming intent. In most programs the biggest refusal-adjacent pattern is not people saying no - it is people ignoring overdue emails because the course takes too long or the login fails. Short, story-driven lessons with quizzes assigned monthly (the format behind awareness training) shrink the surface where friction lives: a course a person can finish in minutes is much harder to refuse on workload grounds.
Tier 2: make it a manager conversation, not an email. A direct, brief conversation between the staff member and their line manager resolves most genuine holdouts - it moves the request from "the system says" to "your manager is asking", and it surfaces the real objection (accessibility, workload, content quality). Keep it factual and documented: what was asked, what was agreed, by when.
Tier 3: escalate under the policy, not ad hoc. If the conversation does not move it, follow the process your workplace policy already defines for mandatory compliance training - written notice, involvement of HR, and consequences consistent with how the organisation treats any other policy breach. The critical rule is consistency: the same refusal gets the same process whether the refuser is a new hire or a senior manager.
Document everything - the record is the point
Every tier leaves a record, and the record is what you show three places:
- Auditors and framework evidence. Gap assessments and Essential Eight-style controls check that staff completed training. A documented refusal trail shows the control operated; silence does not.
- Insurers. Cyber insurance applications increasingly ask about staff training coverage and processes.
- HR. If a refusal ever becomes a disciplinary matter, the sequence - reminder, conversation, notice - is what makes it defensible.
Privacy is part of this too. For private-sector employers, training completion records and simulation outcomes for staff sit inside the employee-records exemption when handling stays directly related to the employment relationship - so keep training records in HR and risk contexts, not repurposed elsewhere. Public-sector employers get no such exemption, so their training data handling must meet the Australian Privacy Principles outright.
What good program design removes from this problem
The refusal conversation gets much shorter when the platform does four things:
- Reminders that run themselves. Due and overdue emails fire on a schedule the admin set once, so the manager conversation is about the person, not the nagging.
- A risk score that makes the gap visible. A per-learner Human Risk Score built from overdue courses, failed quizzes and phishing clicks (human risk reporting) turns "they never finished it" into a number with a trend line - and it climbs on its own when work goes overdue.
- Coaching rather than shaming on phishing clicks. Anyone who clicks a simulation is auto-enrolled into the failed-phishing course (phishing simulations); the people most likely to resist training often get brought in through the simulation route instead.
- Per-learner visibility without public blame. Learners see their own score only, which keeps the conversation with a holdout private.
Common mistakes
- Escalating on the first miss. The first overdue notice is usually a workload or email problem; escalation there trains staff to treat the program as an antagonist.
- Leaving exceptions undocumented. A role that genuinely cannot complete (no email account, leave, accessibility needs) needs an approved, recorded exception - the same rule Essential Eight applies to technical exceptions.
- Treating completion as the only metric. A person who clicks every simulated email while completing every course needs a different intervention than a refuser - the phishing click data shows that.
- Running the process inconsistently. Senior-manager exceptions destroy the mandate faster than any single refusal.
FAQ
Can an employer discipline staff for refusing security training? If the workplace policy makes training mandatory, refusal is a policy breach like any other, and the employer responds through its normal policy process. The documented sequence - reminders, conversation, written notice - is what makes any disciplinary outcome defensible.
Is the training data usable in a disciplinary process? Completion records and simulation outcomes for your own staff are records directly related to the employment relationship for private-sector employers, and workplace-law or policy processes can use them. Keep the handling inside employment purposes.
Do we have to tell staff the training is mandatory? Yes - mandate with a policy you have actually communicated. A mandate nobody was told about fails both operationally and in HR terms.
What about staff on leave or without email accounts? Handle them as documented exceptions with an agreed catch-up date, not as refusals. The difference is a record, not the outcome.
Where does a gap assessment fit? A structured gap assessment shows where training coverage stands against frameworks like Essential 8 or SMB1001 - and an undocumented refusal shows up as a coverage gap unless the process trail exists.
One last thing
The hardest refuser to handle is not the person who says no to your face - it is the one who never says anything and quietly never completes. That is why the program's own reporting matters more than the escalation policy: a per-learner score that moves when work goes overdue surfaces the quiet refusers months before an audit does.