Refresher training is the part of compliance most NZ businesses underdo. The induction is solid. The first round of training lands. Then twelve, eighteen, twenty-four months pass and nobody has refreshed anything. When something goes wrong, the question that follows is the same: when did this person last re-certify?
This post sets out the practical refresher cadence by topic, what WorkSafe NZ, the Privacy Commissioner, and sector regulators actually expect, and how to evidence currency without forcing everyone through the same modules every year.
---
Why Refreshers Matter Legally
The Health and Safety at Work Act, the Privacy Act 2020, and most sector frameworks share a common position on training. Training must be appropriate, sufficient, and current. "Current" is the word that catches most businesses out. A worker trained on manual handling four years ago and never refreshed is, by most standards, not currently competent for that hazard.
The legal exposure shows up in two places. First, in the regulator's response to an incident — the inspector asks for training records and the gap is visible. Second, in the insurer's response to a claim — currency of training is a routine question on cyber, professional indemnity, and statutory liability claims.
The Working Cadence by Topic
There is no single "refresher every year" rule across NZ. The defensible cadence by topic:
- General H&S awareness — annually
- Manual handling and ergonomics — every 12 to 24 months, plus on role change
- Working at heights, confined spaces, hot work — annually, plus every time the controls change
- First aid certification — every 2 years for First Aid Level 1, with the refresher set by NZQA-accredited providers
- Fire warden training — annually
- Privacy Act and information handling — annually
- Cyber security awareness — annually as the floor, with phishing simulations more often
- Anti-money laundering (where applicable) — annually with role-specific top-ups
- Sexual harassment and respectful workplace — every 1 to 2 years, with onboarding for new starters
- Drug and alcohol policy — every 2 years with policy reissue
- Specific equipment competency — at the interval the equipment supplier and your risk assessment specify
The pattern: higher consequence and higher rate of regulatory change pull the cadence shorter.
What Triggers a Refresher Outside the Schedule
Time on the calendar is one trigger. The others worth tracking:
- A near-miss, incident, or audit finding involving the topic
- A change to the procedure, equipment, or layout the training covered
- A new piece of legislation or regulator guidance — Privacy Act 2020, Health and Safety at Work Act amendments, Cyber Security and Resilience Bill
- A change of role that brings new hazards or new information access
- An extended absence from the role — six months or more is the common threshold
- A pattern of errors or behaviour suggesting the training did not stick
Each of these justifies an out-of-cycle refresher and should be documented as such.
Currency, Not Repetition
The most common refresher mistake is making everyone redo the original module verbatim. It does not retain attention, it does not reinforce, and it does not demonstrate currency in any useful way.
What works:
- A short refresher module — 10 to 15 minutes — that focuses on what has changed and what people get wrong
- A scenario-based assessment that tests application, not recall
- A spot-check or observation in the workplace tied to the training topic
- A toolbox talk in the same week that reinforces the message
The combination evidences currency more credibly than another viewing of the original deck.
Tracking and Evidence
The records that hold up under audit:
- Training matrix listing every staff member, every role, and every required topic
- Completion dates and assessment results for each topic
- Expiry dates calculated from the cadence and surfaced before they hit
- Automated reminders to staff and managers ahead of expiry
- Sign-off by manager or supervisor where competency assessment is part of the topic
- Audit history showing when records were verified and by whom
The matrix is easier in an LMS than a spreadsheet, but the spreadsheet works for under 30 staff. The breakpoint usually comes around 50 staff or three sites — at that scale a spreadsheet becomes the audit risk. The cost side of skipping this is covered in the true cost of ignoring compliance training.
Sector-Specific Notes
Some NZ sectors have specific refresher rules embedded in regulation or industry standard:
- Construction — Site Safe passport renewals on a published cycle, plus operator competency for plant
- Healthcare — annual H&S, infection control, privacy, and Code of Health and Disability Services Consumers' Rights training
- Financial services — AML annual training plus role-specific top-ups under the AML/CFT Act
- Aviation — CAA-specified intervals for safety-critical roles
- Maritime — Maritime NZ certification cycles for licensed roles
- Education — Vulnerable Children Act and Code of Professional Responsibility refreshers
Where a sector has a published cycle, that becomes the floor — the business can train more often, not less.
Risk-Based Adjustments
Two staff in the same role do not always need the same cadence. Adjustments worth making:
- New starters — short follow-up at 90 days, regardless of induction completion
- High-risk roles — shorter cycles tied to the consequence of error
- Staff returning from extended leave — full refresh on return
- Staff with recent near-miss or assessment failure — out-of-cycle refresh and observation
These adjustments need to be policy-driven, not ad hoc, so they are defensible.
Practical Takeaway
- Document the refresher cadence by topic in policy
- Build a training matrix that tracks every staff member against every required topic
- Use expiry dates and automated reminders, not memory
- Differentiate refresher content from initial training — focus on changes and weak points
- Treat near-misses, role changes, and extended absences as out-of-cycle triggers
- Audit your own training records quarterly
- Surface gaps to the executive team — this is governance information, not just HR data
Start your free WyzAZ trial to track refresher cycles, automate reminders, and run currency reports in one place.
External references: