Last reviewed 3 November 2026 against the sources linked in this post.
It is the last day of the month, and an email lands in the accounts inbox, apparently from the CEO: a supplier has new bank details, and the payment must go today. Whether anyone stops to check depends on what the team has been trained to do. That is what finance compliance training is for. The ACFE's Occupational Fraud 2026 report, drawn from 2,402 real fraud cases in 143 countries, associates the presence of anti-fraud controls with lower fraud losses and quicker detection.
Finance teams own the controls and are a frequent target of payment scams, so this list focuses on both. You get 9 ready-made courses in 3 groups, what each one fixes and how to roll them out. Each group ends with an Our pick. The legal points describe US federal rules, so use this as a syllabus, not a ruling.
All 9 courses at a glance
| Course | What it covers | Length | Law behind it? |
|---|---|---|---|
| Records retention & internal controls (SOX) | Key controls, retention schedules, legal holds and escalation | 35 min | Yes (US federal law) |
| AI in finance, audit and accounting | Controls over AI-assisted close and reporting | 40 min | No |
| Insider trading & confidential information | Material nonpublic information, blackout and tipping | 30 min | Yes (US federal law) |
| Social engineering, fraud and deepfakes | Payment, phone and impersonation scams | 35 min | No |
| Phishing & social engineering | Red flags, verification and reporting | 30 min | No |
| Data classification & handling | Classifying and handling sensitive information | 25 min | No |
| Code of conduct | A decision test, grey areas and speaking up | 35 min | No |
| Conflicts of interest | Disclosing and deciding on conflicts | 25 min | No |
| Anti-bribery & corruption (FCPA) | Gifts, third parties and facilitation payments | 40 min | Yes (US federal law) |
The law sets rules for how organisations behave. The laws above do not name a training course, so check with your counsel what applies to you; a course is how a team shows its people know the rules.
Controls, reporting and insider information
Records retention & internal controls (SOX)
Controllers own the controls that auditors test. US law makes it a crime to alter, destroy or falsify a record to obstruct a federal investigation, with up to 20 years in prison. This 35-minute course explains why SOX exists and what sections 302 and 404 require, then covers key controls, the control owner's role, retention schedules and legal holds. A case-practice lesson asks learners when and how to escalate a concern, including whistleblower protections.
AI in finance, audit and accounting: controls, accuracy and accountability
Finance teams are starting to let AI draft commentary and reconcile accounts, and a plausible but invented driver can reach the board. This 40-minute course shows where AI helps and where it fails, then teaches four control steps, segregation of duties and the evidence an auditor will ask for. In the sorting lesson, learners decide which finance tasks suit AI, which makes a natural Pick Answer round.
Insider trading & confidential information
Finance staff see results before the market does. The SEC's investor education site says illegal insider trading refers generally to trading in breach of a fiduciary duty or other relationship of trust and confidence on the basis of material, nonpublic information, and that tipping such information can also be a violation. This 30-minute course teaches how to judge whether information is material and nonpublic, then applies blackout, pre-clearance and tipping rules. It also covers 2023 Rule 10b5-1 plan conditions.
Our pick: Records retention & internal controls (SOX). Controls are what the ACFE links to lower losses, and this is the one course that teaches the people who run them what a failure looks like.
Fraud and cyber risk
Social engineering, fraud and deepfakes: phone, payment and impersonation scams
This is the course for the month-end email. It opens with a convincing request for new bank details and asks learners what was missing, then teaches the tactics, verifying money requests with a known number, and how voices and video can be faked. The 35-minute course includes a grey-areas lesson on why people comply with seniority, politeness and secrecy. A Word Cloud captures those pressures quickly in a live session.
Phishing & social engineering
Phishing against finance aims at credentials and payment approvals. This 30-minute course traces a business email compromise, teaches red flags across email, text, voice, QR codes and AI deepfakes, and ends with a 12-question final check. Run a spot-the-red-flags round as a Pick Answer quiz and compare how finance and non-finance colleagues score.
Data classification & handling
Payroll, bank details and unreleased results should reach only the people who need them. This 25-minute course covers classification levels, what is allowed and not allowed at each, red flags and how to escalate a misclassification. In the case-practice round, learners report a misclassification or mishandled data.
Our pick: Social engineering, fraud and deepfakes. It trains the exact moment a payment is released, which is where a scam turns into a loss.
Ethics and bribery
Code of conduct
Finance has to model integrity because it controls the money. This 35-minute course gives teams a four-question decision test and works through grey areas on common topics and speaking up, ending with a 10-question final check at 80% to pass. A scenario round in which learners vote before the policy answer is shown suits a finance team meeting.
Conflicts of interest
Supplier relationships are the classic finance conflict, and they need declaring before approvals, not after. This 25-minute course defines actual, potential and perceived conflicts, teaches "disclose, then decide" and has learners complete and update a conflict disclosure. A Rating Scale asking how confident people feel about when to disclose shows where coaching is needed.
Anti-bribery & corruption (FCPA)
Finance approves the payments that can disguise bribes. The US Department of Justice says the FCPA's anti-bribery provisions prohibit corruptly offering or paying anything of value to a foreign official to influence them, and that its accounting provisions require covered companies to keep accurate books and records and a system of internal accounting controls. This 40-minute course covers gifts, travel and hospitality, third-party red flags and a 10-question final check.
Our pick: Anti-bribery & corruption (FCPA). Its books-and-records duty falls on finance by name, so no other team needs the red flags more.
How to roll the plan out
Start with the people who release money. The ACFE links anti-fraud controls to lower losses and faster detection, and controls only work if the people running them know the scams.
- At onboarding: the code of conduct, conflicts of interest, and social engineering and deepfakes, before anyone gets payment access.
- Within the first quarter: phishing, data classification, records retention and internal controls, and insider trading for anyone who sees results before release. Add the FCPA course if you pay suppliers abroad.
- Each year: a refresher quiz on each course, plus the AI course whenever the team adopts a new AI tool for close or reporting.
- After an incident: a short live session on whatever just happened, such as a near-miss payment request.
Add your own state or country rules where your teams work, and ask your lawyer or the regulator what applies. For a wider programme view, see our guide to compliance officer training, and for the team that tests your controls, internal auditor training.
Ways to run these courses on AhaSlides
You can build any of these as a self-paced course with the AhaSlides course creator, run them as a live Q&A session deck, or both, with a post-course survey and a 30-day check-in to see what changed.
- Pick Answer: show four payment requests and ask which one is the scam, or which finance task is safe to give to AI.
- Word Cloud: ask "Why would someone pay an urgent invoice without checking?" The biggest words show which pressure to train against.
- Rating Scale: before and after, ask "How confident are you that you would spot a fake bank-detail change?" from 1 to 5.
- Open Ended: collect anonymous near-misses at the end of a live session, so risks surface that never reach a report.
FAQ
What training do finance teams need?
Finance teams need internal controls, fraud awareness, anti-bribery and data security training. The nine courses above cover those, plus insider trading and AI. They do not teach bank regulation, so banks and credit unions should add their regulator's own programme.
What is business email compromise?
It is typically a scam where criminals impersonate a supplier or executive to trick staff into sending payments. The phishing and the social engineering and deepfakes courses both walk through an example.
How do finance teams prevent payment fraud?
Verify bank-detail changes through a second channel and consider requiring dual approval for large payments. The social engineering course teaches verifying money requests with a number you already know.
Is SOX training required?
The SOX sections the course covers, 302 and 404, do not name a training course. They concern officer certifications and internal control over financial reporting. Training is how a team shows its people know their controls. Ask your counsel or the SEC what applies to you.
This post is general information, not legal advice. For a decision about your own workplace, speak to a qualified lawyer or the regulator.
