Risk, Compliance, Ethics, and Sustainable Logistics

Introduction

Training coordination is often treated as an administrative activity: reserving rooms, arranging technology, confirming participants, and monitoring attendance. At graduate level, however, training logistics should be understood as a governance system. Every logistical decision creates exposures involving safety, privacy, cybersecurity, intellectual property, employment law, accessibility, fairness, continuity, cost, and environmental impact.

A training event may fail even when the instructional content is excellent. A participant may be injured in an unsafe venue; confidential employee data may be exposed through an insecure registration platform; a vendor may use copyrighted material without permission; a disabled participant may be unable to access the learning environment; or a weather disruption may prevent delivery. These are not isolated administrative inconveniences. They can produce legal liability, financial loss, reputational damage, employee distrust, and strategic interruption.

This chapter presents a risk-based approach to training logistics. It explains how to construct risk registers, design continuity plans, manage compliance and ethical responsibilities, protect information and intellectual property, promote accessibility and fairness, retain records appropriately, and reduce the environmental impact of learning delivery.

Learning Objectives

By the end of this chapter, readers should be able to:

1. Explain why training logistics is a strategic risk and governance function.
2. Identify, assess, prioritize, and monitor logistical risks.
3. Develop a practical risk register and business continuity plan.
4. Apply principles of health and safety, privacy, cybersecurity, intellectual property, labor compliance, accessibility, and fairness.
5. Design appropriate records-retention and documentation controls.
6. Evaluate environmental and social sustainability in training delivery.
7. Critically assess the use of vendors, technology, and artificial intelligence in training operations.
8. Integrate compliance, ethics, resilience, and sustainability into managerial decision-making.

1. Training Logistics as a Governance System

Training logistics connects organizational strategy with operational execution. It coordinates people, facilities, suppliers, information, technology, time, and money. Because these resources are interdependent, a failure in one domain can propagate through the system. For example, a last-minute venue change may create accessibility barriers, increase travel emissions, invalidate safety checks, and expose participant information to an unapproved supplier.

Three ideas are central.

Risk is the effect of uncertainty on objectives. Risk may involve threats, opportunities, or both. In training logistics, objectives may include safe participation, lawful processing of data, uninterrupted delivery, equitable access, cost control, and achievement of learning outcomes.

Compliance concerns conformity with applicable laws, regulations, contractual obligations, organizational policies, and recognized standards. Compliance is a minimum obligation, not the complete meaning of responsible management.

Ethics concerns what ought to be done, including duties of care, respect, fairness, transparency, confidentiality, and avoidance of harm. An action may be technically legal but ethically unacceptable—for example, collecting extensive behavioral data merely because a platform permits it.

Sustainability concerns the long-term environmental, social, and economic consequences of logistical choices. Sustainable training asks not only whether an event can be delivered, but whether it can be delivered without unnecessary emissions, waste, exclusion, or depletion of organizational resources.

A mature logistics function integrates these concerns rather than managing them as separate checklists.

2. Risk Identification and the Risk Register

A risk register is a controlled record of material risks, their causes, consequences, owners, responses, and monitoring arrangements. It should be developed collaboratively with HR, learning and development, information security, procurement, facilities, legal advisers, health and safety specialists, accessibility representatives, and relevant business units.

2.1 Categories of training-logistics risk

Common categories include:

• Strategic risk: training does not support business priorities or critical capabilities.
• Operational risk: scheduling, staffing, venue, transport, catering, or technology failure.
• Safety risk: injury, illness, emergency evacuation failure, or unsafe equipment.
• Legal and regulatory risk: breach of labor, equality, privacy, health and safety, procurement, or records obligations.
• Information risk: unauthorized access, disclosure, loss, alteration, or unavailability of data.
• Vendor risk: supplier failure, inadequate insurance, subcontracting, conflicts of interest, or weak controls.
• Reputational risk: public criticism arising from exclusion, misconduct, environmental harm, or poor crisis response.
• Sustainability risk: excessive travel, waste, energy use, or inequitable access.

Risk identification methods include process mapping, interviews, historical incident review, scenario analysis, supplier due diligence, legal review, and participant consultation. A useful question is: “What must be true for this training activity to be safe, lawful, accessible, resilient, and effective?”

2.2 Risk analysis and prioritization

A qualitative risk score commonly combines likelihood and impact. If a numerical scale is used, it must be defined consistently rather than treated as objective truth.

Here, R is the inherent risk score, L is the likelihood rating, and I is the impact rating. Both ratings may be assigned on a defined ordinal scale, such as 1 to 5. The multiplication is a prioritization convention, not a probability law; it assumes that the organization accepts the chosen scales as sufficiently comparable for screening purposes. It should not be interpreted as a precise estimate of expected monetary loss.

Where reliable probability and loss estimates exist, expected loss can be modeled as:

EL is expected loss, p is the probability of an event over a specified period, and C is the consequence or loss if the event occurs. p must range from 0 to 1, and C must use a defined monetary or impact unit. This model is limited when losses are catastrophic, highly uncertain, interdependent, or difficult to monetize.

Risk scoring should distinguish inherent risk, before controls; residual risk, after controls; and target risk, the level management is willing to accept after further treatment. Organizations should document scoring criteria, escalation thresholds, and who has authority to accept residual risk.

2.3 Risk responses

Four standard responses are useful:

1. Avoid: change or cancel the activity so the risk source is removed.
2. Reduce: introduce controls that lower likelihood or impact.
3. Transfer or share: use insurance, contractual allocation, or specialist suppliers, while recognizing that legal and ethical responsibility cannot always be transferred.
4. Accept: knowingly retain the risk within approved tolerance, with monitoring and contingency arrangements.

A control should have an owner, timing, evidence of completion, and a method for testing effectiveness. “Staff will be careful” is not a control. “The coordinator verifies evacuation routes against the final room layout 24 hours before delivery and records the inspection” is a stronger control.

2.4 Model risk-register fields

3. Business Continuity and Incident Management

A continuity plan enables essential training functions to continue, recover, or be safely suspended during disruption. It differs from a risk register: the register identifies exposures, whereas the continuity plan specifies actions before, during, and after an incident.

A practical continuity process includes:

1. Business impact analysis: identify critical programs, time-sensitive qualifications, dependent employees, and maximum tolerable disruption.
2. Resource analysis: identify people, systems, suppliers, facilities, content, data, and decision rights required for continuation.
3. Scenario planning: consider cyberattack, severe weather, public-health event, venue loss, trainer incapacity, transport failure, industrial action, power outage, and supplier insolvency.
4. Strategy selection: use remote delivery, relocation, postponement, modular delivery, cross-trained staff, alternate suppliers, or controlled cancellation.
5. Communication planning: define who communicates, through which channels, with what approved message.
6. Recovery and learning: restore normal operations, document decisions, and conduct a post-incident review.

Continuity planning should protect people before schedules. A session should be postponed rather than delivered when conditions are unsafe. Plans should also address accessibility during transition; moving an in-person course online does not automatically preserve captioning, screen-reader compatibility, or equitable participation.

A continuity plan should include contact trees, emergency authority, backup systems, alternate venues, accessible communications, data backups, vendor contacts, participant welfare arrangements, and decision criteria for cancellation. Testing is essential. Tabletop exercises can reveal unclear authority, incompatible systems, and unrealistic assumptions without creating the cost of a live disruption.

4. Health, Safety, and Duty of Care

Training organizers owe participants a duty of care appropriate to the context. Responsibilities may arise from law, employment relationships, contracts, venue rules, and organizational policy. A risk assessment should consider the physical environment, equipment, travel, food, psychological safety, fatigue, lone working, hazardous demonstrations, and emergency response.

Basic controls include:

• selecting competent and appropriately insured venues and suppliers;
• inspecting rooms, exits, lighting, ventilation, furniture, electrical equipment, and emergency signage;
• maintaining safe occupancy levels and unobstructed evacuation routes;
• communicating emergency procedures in accessible formats;
• managing allergens and food hygiene;
• assessing travel and off-site activities;
• providing first-aid and incident-reporting arrangements;
• controlling recordings, photography, and participant identification;
• addressing harassment, violence, and psychologically unsafe conduct.

Health and safety obligations may vary by jurisdiction. The coordinator must therefore identify the governing legal regime rather than assume that a generic policy is sufficient. Occupational health and safety should also include psychosocial hazards, such as humiliating exercises, coercive disclosure, discriminatory examples, excessive workload, or unsafe power dynamics between managers and subordinate participants.

5. Privacy and Cybersecurity

Training operations often process names, contact details, job roles, attendance, assessment results, accessibility needs, travel information, recordings, and sometimes health or disciplinary information. Privacy governance begins with purpose limitation: collect only what is necessary for a specified legitimate purpose, communicate that purpose clearly, restrict access, protect the information, and delete or anonymize it when no longer required.

A privacy review should ask:

• What data is collected, and why?
• What legal or organizational authority supports collection?
• Who can access it?
• Where is it stored and processed?
• Is it transferred across jurisdictions?
• How long is it retained?
• What happens if a participant withdraws consent or requests access, correction, or deletion where applicable?
• Has the supplier agreed to appropriate security and breach notification requirements?

Cybersecurity controls should include strong authentication, role-based access, encryption where appropriate, secure configuration, patching, backups, phishing awareness, tested recovery, and controlled sharing links. Attendance spreadsheets should not be circulated broadly when a restricted system is available. Meeting recordings should be disabled by default unless there is a documented purpose and appropriate notice.

Generative artificial intelligence introduces additional concerns. Prompts may contain personal, confidential, proprietary, or copyrighted information. Training organizations should prohibit uploading protected information to unapproved tools, require human review of generated content, test outputs for bias and inaccuracy, and preserve accountability for decisions. An AI-generated risk assessment is an input, not a substitute for professional judgment or consultation with affected participants.

6. Intellectual Property and Contractual Control

Training materials may contain copyrights, trademarks, trade secrets, licensed databases, photographs, software, assessment instruments, and confidential organizational knowledge. Ownership may depend on employment contracts, commissioning arrangements, licenses, and local law.

Before delivery, the coordinator should establish:

• who owns or licenses each major resource;
• whether copying, adaptation, recording, translation, and online distribution are permitted;
• whether licenses cover the number and location of participants;
• how third-party content will be attributed;
• whether participants may retain or redistribute materials;
• how confidential information will be protected;
• what happens to materials when a vendor contract ends.

Contracts should address deliverables, ownership, permitted uses, confidentiality, data processing, accessibility standards, subcontractors, security incidents, insurance, audit rights, service levels, termination, and records return or destruction. A low price does not compensate for unclear rights that prevent future use or expose the organization to infringement claims.

7. Labor Requirements, Accessibility, and Fairness

Training logistics intersects with labor standards concerning working time, breaks, overtime, travel time, minimum notice, consultation, protected leave, collective agreements, contractor classification, and compensation. Requirements differ across jurisdictions and worker categories. Managers should consult legal or employee-relations specialists where training is mandatory, scheduled outside normal hours, linked to promotion, or required for continued employment.

Accessibility is both a legal and ethical requirement. It involves physical access, communication access, digital usability, sensory needs, cognitive differences, language, and reasonable adjustments. Accessibility should be designed into procurement and delivery rather than added after a participant discloses a problem.

Examples include accessible routes and seating, captioning, transcripts, sign-language interpretation where required, screen-reader-compatible documents, sufficient color contrast, keyboard navigation, flexible breaks, plain-language instructions, accessible assessment formats, and alternative participation methods. Confidential adjustment information should be shared only with those who need it to implement the adjustment.

Fairness requires more than treating everyone identically. Equality of treatment may produce unequal outcomes when participants have different barriers. A fair process uses transparent selection criteria, consistent eligibility rules, conflict-of-interest controls, and documented exceptions. It also examines whether location, timing, language, technology, or manager approval systematically excludes particular groups.

Algorithmic tools used to nominate participants, predict completion, or prioritize development require special scrutiny. Historical data may encode prior discrimination. Managers should test outcomes across relevant groups, explain decisions, provide review or appeal mechanisms, and avoid using sensitive attributes or proxies without a lawful and ethically defensible basis.

8. Records Retention and Evidence

Records support accountability, evaluation, legal defense, financial control, and organizational learning. Relevant records may include approvals, risk assessments, accessibility arrangements, attendance, completion evidence, invoices, contracts, incident reports, privacy notices, consent records, evaluation data, and corrective actions.

Retention should follow a documented schedule based on legal requirements, limitation periods, accreditation rules, operational needs, and privacy principles. Retaining everything forever increases exposure; deleting too early can undermine rights and accountability. A retention schedule should identify the record owner, system of record, retention period or trigger, access restrictions, legal holds, disposal method, and review authority.

Records should be accurate, complete, attributable, retrievable, and protected against unauthorized alteration. Sensitive records should be segregated where possible. When a legal hold, investigation, audit, or access request applies, routine deletion may need to be suspended. Disposal should be secure and documented, including deletion from relevant backups where feasible and lawful.

9. Sustainable Training Logistics

Sustainable logistics considers the full delivery system: participant travel, trainer travel, venue energy, digital infrastructure, printed materials, catering, accommodation, equipment, waste, and inclusion. Virtual delivery may reduce travel but can increase energy use, digital exclusion, screen fatigue, and inequity. Therefore, “online” is not automatically sustainable.

A sustainability decision should consider:

• whether the learning objective genuinely requires physical presence;
• participant travel distance and available low-carbon transport;
• venue energy performance and accessibility;
• local and seasonal catering, food waste, and dietary inclusion;
• reusable signage, materials, and equipment;
• procurement of durable, repairable, and responsibly sourced goods;
• accessibility and digital inclusion;
• supplier environmental practices and credible evidence;
• total lifecycle effects rather than one visible feature.

A simple activity-based estimate of travel emissions can be used when reliable emissions factors are available:

E is estimated emissions, d is distance traveled per person, n is the number of passenger journeys or participants, and f is an emissions factor per passenger-distance unit. Units must be consistent—for example, kilometers and kilograms of carbon-dioxide equivalent per passenger-kilometer. The estimate must state whether the distance is one-way or round-trip and should not imply precision beyond the quality of the emissions factor. Different transport modes, occupancy, geography, and accounting boundaries can materially change results.

Sustainability metrics should be balanced with learning quality, accessibility, cost, and resilience. Useful indicators include travel avoided, waste per participant, proportion of reusable materials, energy use where measurable, supplier performance, accessibility completion, and participant outcomes. Avoid unsupported “carbon-neutral” claims; distinguish measured reductions from purchased offsets and communicate assumptions transparently.

10. An Integrated Decision Framework

A defensible logistics decision can follow this sequence:

1. Define the learning and organizational objective.
2. Identify affected people, rights, dependencies, and stakeholders.
3. Map hazards, legal obligations, information flows, suppliers, and environmental impacts.
4. Assess likelihood, impact, uncertainty, and distributional effects.
5. Design controls using prevention before detection and recovery.
6. Consult affected groups, especially accessibility and worker representatives.
7. Document the decision, owner, evidence, and residual risk.
8. Test continuity arrangements and communicate responsibilities.
9. Monitor indicators, incidents, complaints, and near misses.
10. Review lessons and improve the system.

This framework discourages “compliance theater,” in which forms are completed without changing unsafe or unfair conditions. It also prevents sustainability from becoming a purely reputational exercise. The central question is whether the system produces a responsible outcome for participants, the organization, suppliers, and wider society.

Applied Case: The Regional Leadership Academy

Background

The following is an illustrative case. A multinational organization plans a three-day leadership academy for 180 managers from six countries. The initial plan uses a central hotel, printed workbooks, a third-party registration platform, recorded plenary sessions, and a catered dinner. The program includes confidential case discussions involving organizational restructuring.

Problem

Two weeks before delivery, the coordinator discovers that the hotel has limited step-free access, the registration platform stores data outside the organization’s approved processing regions, and the recording vendor intends to retain footage indefinitely. The event also requires substantial air travel. A severe-weather warning creates a credible risk of transport disruption.

Analysis

The risk team identifies high-priority risks involving accessibility, cross-border data processing, confidentiality, recording consent, continuity, and emissions. A simple 1–5 likelihood-impact scale gives the privacy risk a high priority because the data transfer is likely enough to require immediate control and the consequence could include regulatory action and loss of trust. The team also identifies an ethical issue: cancelling the event would disadvantage managers who had already arranged care responsibilities, while proceeding without accessible facilities would directly exclude participants.

Approach and solution

The organization takes the following actions:

• verifies a different accessible venue and obtains written evidence of emergency and accessibility arrangements;
• limits registration data to necessary fields and moves processing to an approved platform;
• prohibits recording of confidential discussions and obtains specific notice and permission for any recorded plenary;
• includes confidentiality clauses and data-processing obligations in vendor contracts;
• replaces most printed workbooks with accessible digital materials while providing accessible alternatives for participants who need them;
• offers a hybrid contingency option with captioning and technical support;
• creates cancellation thresholds based on official travel and safety information;
• reduces travel by allowing regional groups to attend synchronized local hubs;
• assigns risk owners and conducts a tabletop exercise 72 hours before delivery.

Outcome

The academy proceeds with a smaller central event and regional hubs. No participant is denied access because of a disability, confidential discussions remain unrecorded, and the organization has documented evidence for its privacy and procurement decisions. Travel emissions and printing are reduced, although digital support costs increase. The post-event review concludes that earlier supplier due diligence would have prevented the most urgent problems.

Learning points

The case demonstrates that risk controls are interconnected. Venue selection affects safety, accessibility, continuity, and emissions. Recording decisions affect privacy, intellectual property, confidentiality, and trust. Sustainable logistics may require additional investment in accessibility and technology. Finally, a continuity plan is strongest when designed before the crisis rather than improvised during it.

Challenges and Limitations

Risk registers can create false confidence when ratings are subjective, risks are listed without owners, or low-probability catastrophic events are averaged into moderate scores. Compliance checklists may ignore power relationships and participant experience. Sustainability calculations may be distorted by incomplete emissions data. Privacy controls may become so restrictive that they prevent legitimate learning evaluation, while excessive data collection may be justified in the name of improvement.

Organizations also face conflicting objectives. A highly accessible venue may cost more or be farther from public transport. A fully remote program may lower travel emissions but intensify digital inequality. A strict retention period may conflict with accreditation evidence. These tensions require transparent judgment, consultation, proportionality, and documented escalation—not simplistic optimization.

Contemporary Developments and Best Practice

Current practice is moving toward integrated enterprise risk management, privacy-by-design, accessibility-by-design, supplier transparency, hybrid resilience, and evidence-based sustainability reporting. Training functions increasingly use centralized vendor assurance, automated access controls, digital credentialing, and analytics. These tools can improve control but also create surveillance, bias, and dependency risks.

Best practice includes:

• appointing clear owners for operational, information, safety, and sustainability risks;
• involving affected participants in design and testing;
• embedding requirements in contracts and procurement specifications;
• using the least data and least privilege necessary;
• testing emergency and cyber-continuity plans;
• recording near misses as well as actual incidents;
• applying human review to automated decisions;
• measuring outcomes rather than merely counting policies;
• reviewing legal requirements by jurisdiction;
• linking risk, compliance, ethics, and sustainability reporting to executive governance.

Chapter Summary

Training logistics is a strategic governance function because delivery decisions affect safety, rights, continuity, organizational trust, cost, and environmental impact. A risk register identifies events, causes, consequences, controls, owners, and residual exposure. Likelihood-impact scoring is useful for prioritization but is not a precise probability model. Continuity planning translates identified risks into decisions and actions for disruption, recovery, and learning.

Responsible logistics requires duty of care, privacy and cybersecurity controls, intellectual-property compliance, lawful labor practices, accessibility, fair selection, secure records management, and ethical use of technology and artificial intelligence. Sustainable delivery evaluates travel, venues, materials, energy, suppliers, digital inclusion, and lifecycle effects. Effective governance integrates these dimensions through consultation, documented controls, testing, monitoring, and continuous improvement.

Key Terms

Risk: The effect of uncertainty on objectives.

Risk register: A controlled record of risks, controls, owners, and monitoring actions.

Inherent risk: Exposure before controls are applied.

Residual risk: Exposure remaining after controls are applied.

Risk appetite: The amount and type of risk an organization is willing to pursue or retain.

Business continuity: The capability to continue or recover essential activities during disruption.

Duty of care: The responsibility to take reasonable steps to prevent foreseeable harm.

Privacy by design: Integrating privacy protections into systems and processes from the outset.

Data minimization: Collecting and retaining only data necessary for a defined purpose.

Cybersecurity: Protection of information and systems from unauthorized access, disruption, alteration, or destruction.

Intellectual property: Legally protected creations, works, inventions, marks, and confidential knowledge.

Accessibility: Design that enables people with diverse abilities to participate effectively.

Reasonable adjustment: A modification that enables participation without imposing disproportionate difficulty or cost under applicable law.

Fairness: Equitable and non-discriminatory treatment in processes and outcomes.

Records retention: Controlled preservation and disposal of organizational records.

Sustainability: Meeting present needs while protecting long-term environmental, social, and economic capacity.

Residual risk owner: The person accountable for monitoring and accepting remaining exposure.

Near miss: An event that could have caused harm but did not.

Review Questions

Short Answer Questions

1. What is the difference between inherent risk and residual risk?
2. Why is a risk register not a substitute for a continuity plan?
3. Identify four categories of information commonly processed during training delivery.
4. What does data minimization require of a training coordinator?
5. Give three examples of accessibility controls for a hybrid program.

Long Answer Questions

1. Explain how health and safety, privacy, accessibility, and sustainability decisions can interact in the design of one training event.
2. Describe the stages of developing and testing a business continuity plan for a mandatory leadership program.
3. Critically evaluate the strengths and limitations of using a likelihood-impact matrix.
4. Discuss the contractual provisions that should be included when outsourcing training logistics to a technology vendor.
5. Explain why legal compliance is necessary but insufficient for ethical training logistics.

Analytical / Application Questions

1. A vendor proposes recording every training session and retaining recordings indefinitely “for quality assurance.” Analyze the privacy, intellectual-property, cybersecurity, labor, and ethical issues, then recommend controls.
2. A company must choose between a central face-to-face event requiring extensive air travel and a distributed hybrid model requiring additional technology expenditure. Develop a decision framework that balances learning quality, accessibility, continuity, cost, and environmental impact.
3. Construct a risk-register entry for a scenario in which a severe-weather event prevents participants from reaching a training venue. Include the objective affected, causes, consequences, ratings, controls, owner, trigger, and continuity response.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes a risk register from a business continuity plan?

A. A risk register identifies and monitors exposure, while a continuity plan specifies responses to disruption.

B. A risk register is used only for financial risks, while a continuity plan is used only for safety risks.

C. A risk register replaces the need for emergency procedures, while a continuity plan records attendance.

D. A risk register is created after an incident, while a continuity plan is created only after legal review.

Correct Answer: A. A risk register identifies and monitors exposure, while a continuity plan specifies responses to disruption.

Question 2

In the prioritization convention R = L × I, what do L and I represent?

A. Loss and insurance

B. Likelihood and impact

C. Labor and inclusion

D. Location and implementation

Correct Answer: B. Likelihood and impact

Question 3

Which action best reflects the principle of data minimization?

A. Collecting all available participant data in case it becomes useful later

B. Retaining recordings permanently for convenience

C. Collecting only information necessary for a defined training purpose

D. Sharing attendance data with every supplier involved in the event

Correct Answer: C. Collecting only information necessary for a defined training purpose

Question 4

Which is the strongest example of a logistical control?

A. Staff should be careful when checking the room

B. The coordinator verifies emergency exits against the final room layout and records the inspection

C. The venue is assumed to be safe because it is expensive

D. Participants are expected to report hazards after the event

Correct Answer: B. The coordinator verifies emergency exits against the final room layout and records the inspection

Question 5

Why should an organization avoid treating virtual delivery as automatically sustainable?

A. Virtual delivery always costs more than in-person delivery

B. Virtual delivery may create digital exclusion, energy use, and accessibility challenges

C. Virtual delivery cannot support any learning objective

D. Virtual delivery eliminates the need for continuity planning

Correct Answer: B. Virtual delivery may create digital exclusion, energy use, and accessibility challenges

Question 6

Which contractual provision is most directly related to protection of participant information?

A. A requirement for decorative event branding

B. A data-processing and breach-notification obligation

C. A guarantee that all participants will receive printed books

D. A clause permitting unrestricted subcontracting

Correct Answer: B. A data-processing and breach-notification obligation

Question 7

A training algorithm prioritizes participants using historical promotion data. What is the primary governance concern?

A. Historical data may reproduce prior discrimination or bias

B. Algorithms cannot process numerical data

C. Promotion data is never relevant to training decisions

D. Automated systems eliminate the need for documentation

Correct Answer: A. Historical data may reproduce prior discrimination or bias

Question 8

In the travel-emissions estimate E = d × n × f, what does f represent?

A. The number of training facilities

B. The financial cost per participant

C. The emissions factor per passenger-distance unit

D. The frequency of risk reviews

Correct Answer: C. The emissions factor per passenger-distance unit

Question 9

Which action best supports records governance?

A. Keeping every record indefinitely

B. Deleting all records immediately after delivery

C. Using a retention schedule with owners, access controls, triggers, and secure disposal

D. Allowing each employee to retain records in personal accounts

Correct Answer: C. Using a retention schedule with owners, access controls, triggers, and secure disposal

Question 10

Which response removes the source of a training-logistics risk?

A. Accepting the risk without monitoring

B. Avoiding the activity or changing it so the risk source no longer exists

C. Transferring every responsibility to a supplier

D. Recording the risk after the event has occurred

Correct Answer: B. Avoiding the activity or changing it so the risk source no longer exists