Learning Management Systems: A Regulatory Race to the Bottom

Two workers hold identical training records. Same course name, same passing score, same completion date, same tidy PDF certificate. One of them can actually do the job safely. The other never opened a module — a coworker took the course on their login, or a browser AI plugin quietly answered every quiz question while the tab sat in the background. Nothing in either record tells you which is which — and that isn't a bug in the learning management system. It's the product working exactly as the market built it to work.

This is the quiet story of how safety and compliance training got cheap. Not cheaper in a good way — cheaper as in worth less. The learning management system (LMS) made training frictionless, and in doing so it redefined what "training" even means: from a person became knowledgeable and we can prove it was them to a course was assigned and a box got ticked. Once that box became the deliverable, every vendor in the market started competing to produce it faster and cheaper than the last. That competition has a direction, and it points down. Its finish line is training fraud — not as an abuse of the system, but as the logical end state of a system that certifies completion instead of competence and never checks who was at the keyboard.

How compliance training became a race to the bottom

Start with what the regulator actually says, because the gap between that and what the market sells is the whole story.

Canadian occupational health and safety law is deliberately outcome-based. Alberta's OHS framework, for example, defines a competent worker as one who is "adequately qualified, suitably trained and with enough experience to safely perform work without supervision or with only a small amount of supervision." WHMIS rules require worker education and training. The Transportation of Dangerous Goods Regulations require that a person be "adequately trained." None of these ask for a specific number of hours, a specific platform, or a completion certificate. They ask for an outcome: a person who is genuinely competent, and an employer who took every reasonably practicable step to get them there.

Here is where the race starts. Regulators specified an outcome but, in practice, enforcement and audits mostly inspect a record. So the market did what markets do with any cost-affected outcome that's judged by a cheap proxy: it optimized for the proxy. The LMS is the machine that manufactures the proxy at scale. It turns "this person is competent, and it's provably them" into "this account reached the completion screen" — and then sells that transformation by the seat, as cheaply as possible.

Now put yourself in the shoes of the person buying. A safety manager or an HR lead needs to check a box for a hundred workers by month-end. Every course on the page looks the same: same topics, same certificate, same claim of compliance. When two products look identical and you can't see the difference in quality from the outside, the only visible lever is price. So price wins. And because price wins, the next vendor strips out whatever costs money to keep the price lower — the real assessment, the identity check, the human oversight — because none of it shows up on the certificate anyway. Round after round, the market competes away exactly the things that made the training worth anything. That's the race to the bottom, and it isn't caused by bad people. It's caused by a market where buyers can't see quality and sellers are punished for paying for it.

What the law actually asked for — and it wasn't a completion box

The uncomfortable part is that the completion box was never what any regulator wanted. It's a stand-in that everyone quietly agreed to treat as good enough.

"Adequately trained." "Competent worker." "Reasonably practicable." Read those words again with fresh eyes and notice what they're pointing at: a real human being who can do a real job safely, and an employer who can show they did what was reasonable to make that true. The reasonably practicable standard specifically asks an employer to weigh the risk against the time, trouble, and cost of reducing it — and to take the reasonable steps that are actually available. When the only tools available were classroom sessions and paper sign-in sheets, "we ran everyone through the module" was a fair-faith attempt at that standard. The proxy was rough, but it was roughly honest.

What changed is that the proxy stopped tracking the outcome at all. A modern LMS can generate a perfect completion record for a person who learned nothing, wasn't in the room, or doesn't exist. The document got better-looking as the thing it was supposed to represent got hollower. That's the divergence that turns a reasonable shortcut into a liability: the record now says "competent, verified" while the system underneath can only honestly say "an account clicked next."

The bottom of the race is training fraud

Follow the incentives all the way down and you don't arrive at "slightly worse training." You arrive at fraud — because a system that rewards the cheapest acceptable-looking record eventually produces records with nothing behind them at all.

We told the extreme version of this story in Catch Me If You Can: a pug, a fake airline captain, and the online training fraud your LMS won't talk about — a dog that earned professional certifications online, a man who flew hundreds of commercial flights on a licence he never legitimately held. Those cases feel absurd until you realize they're just the race to the bottom crossing its own finish line. If the certificate only certifies that an account reached a screen, then a pug with a credit card can hold one. The absurd cases aren't outliers from the normal system. They're what the normal system looks like with the guardrails finally gone.

The everyday version is quieter and far more common. The account holder hands the login to a coworker who "knows this stuff already." Someone runs the modules in a muted tab while doing something else, then has a friend take the quiz. A whole crew's worth of certificates gets generated the afternoon before an audit. No one involved thinks of it as fraud. They think of it as getting the box ticked, which is precisely what the market taught them the training was for. This is the same rot underneath our buyer's guides for WHMIS and TDG: from the outside the courses look identical, and the only thing that separates them is whether the certificate can prove a specific, named person actually earned it.

Compliance, in other words, is not competence. A dashboard full of green ticks offers reassurance, but it can hide exactly the gaps in judgment and skill that get someone hurt. The certificate protects the employer legally, right up until the moment it doesn't — the incident, the inspection, the claim — at which point "we bought everyone the online course" turns out to mean a great deal less than it looked like it did.

Why the market raced down instead of up

It's worth being precise about why this market bent toward the bottom, because the mechanism tells you how to climb back out.

Training is what economists call a credence good — like a mechanic's diagnosis or a vitamin, you can't easily verify its quality even after you've consumed it. The worker "passed," so it must have worked, right? When buyers can't distinguish good from bad, the good gets driven out, because the only thing left to compete on is the thing buyers can see. Price. It's the classic market-for-lemons dynamic, and safety training walked straight into it. The honest provider who spends money on a genuine assessment and a real identity check shows up on the same list, at a higher price, with a certificate that looks identical to the cheap one. The buyer, unable to see the difference, picks the cheaper one. The honest provider either cuts corners to survive or leaves. The lemons win.

Break that down and the escape route becomes obvious. A race to the bottom only continues as long as buyers can't tell the difference between a real credential and a hollow one. Make the difference visible — make quality legible again — and the incentive flips. Suddenly there's something to compete on other than price.

The correction is already here — the standard moved first

The most important thing happening in safety training right now is that the recognized standard for training quality quietly closed the loophole the whole race depended on.

ANSI/ASSP Z490.1-2024 — Criteria for Accepted Practices in Safety, Health, and Environmental Training, the benchmark for how EHS training should be built — was revised in 2024 to consolidate its guidance for in-person and online training into a single expectation: no matter how training is delivered, the provider must verify the identity of the learner, confirm the learner's participation, prevent unauthorized assistance (human or AI), and communicate results properly. In plain terms, the standard now says out loud what the market spent two decades pretending didn't matter: a username and password don't confirm who actually completed the training, or whether they were even there. "We assigned the module" is no longer a defensible claim of trained-ness under the standard that defines credible EHS training.

That reconnects the record to the outcome the regulator wanted all along. If a defensible training program now has to authenticate the learner, then verifying who was trained stops being an optional extra and becomes one of those reasonably practicable steps an employer is expected to take — because the tool exists, the standard calls for it, and "the cheap course didn't include it" gets much harder to defend. The floor of the race just moved up. Not by new legislation, but by the professional standard redefining what "acceptable-looking" is allowed to mean.

What climbing back up actually looks like

Opting out of the race to the bottom isn't complicated, and it isn't about surveillance. It's about re-coupling three things the LMS pulled apart: the learning, the person, and the proof.

The first move is to certify on demonstrated competency rather than time-in-seat. Because the law asks for a sound knowledge of the job and not a fixed run of videos, a genuine assessment that tests the actual duties is better evidence of "adequately trained" than any completion screen — and it respects the experienced worker, who can demonstrate what they already know instead of being marched through content they've seen a dozen times. Completion measures attendance. Assessment measures competence. Only one of those is what the regulator asked for.

The second move is to verify who did the assessment. This is the step the entire race was built to skip, and it's smaller than its reputation suggests. It does not mean a webcam staring at someone for two hours or AI flagging every glance away from the screen. It means confirming, at the moment that actually matters — the graded assessment — that the person earning the certificate is the person named on it. Purpose-built tools like Asgard Authenticate do exactly that: verify a learner's identity in real time at the point of assessment, so impersonation is caught before a certificate is ever issued, without turning the whole course into an ordeal.

The third move is to make the proof portable and tamper-evident, so quality is finally visible from the outside. When a credential is issued as a verifiable digital record — the model behind platforms like CredentialVault, built on open W3C Verifiable Credentials — an auditor, a client, or a hiring manager can confirm it on the spot instead of taking a PDF on faith. That's the piece that ends the lemons problem: once anyone can instantly tell a real credential from a hollow one, the hollow one stops being worth buying, and price stops being the only thing to compete on.

Put those three together — competency-first assessment, identity verified at the point of assessment, a credential anyone can check — and you have training that answers the regulator's actual question: this named person is genuinely competent, and here's the proof it was them. That's the model Gardril was built around, precisely because the race to the bottom left a market full of certificates that can't stand behind their own names.

What to do as a buyer

You don't have to reform the whole market to opt your own organization out of the race. Before you renew or buy safety and compliance training, confirm it:

• Certifies on a real assessment tied to the work your people actually do — not a completion screen that only proves an account reached the end.
• Verifies who completed that assessment, so the name on the certificate means the person, not just the login.
• Issues a credential you can verify — a tamper-evident digital record an auditor or client can check — rather than a static PDF that proves nothing about who earned it.
• Meets the current recognized standard for training quality (ANSI/ASSP Z490.1-2024), including learner authentication.
• Is priced like it's doing real work, because a free or near-free certificate is cheap for exactly one reason: there's nothing standing behind the name.

The completion box was always the easy part. Proving the right person is genuinely competent — and being able to show it when it counts — is the part the race to the bottom threw away. Buying it back is how you climb out.

Frequently asked questions

What does "a race to the bottom" mean in safety and compliance training?

It describes what happens when buyers can't see the difference between good and bad training from the outside, so the only thing left to compete on is price. Each round, vendors strip out whatever costs money — genuine assessment, identity verification, human oversight — because none of it shows up on the certificate. The result is a market drifting toward the cheapest possible product that still generates an acceptable-looking completion record, regardless of whether anyone actually learned or the right person did the training.

Did learning management systems cause training fraud?

Not directly — but they industrialized the conditions for it. An LMS turns the regulator's real requirement ("a competent, verifiable worker") into a cheap proxy ("a completed module"), and can generate a flawless completion record for someone who learned nothing or wasn't even there. Fraud is just the far end of a market that rewards the cheapest acceptable-looking record. The technology isn't the villain; the incentive structure built around it is.

Isn't a completion certificate enough to be compliant in Canada?

It can look like it is, right up until it's tested. Canadian OHS law asks for outcomes — a "competent worker," someone "adequately trained," and an employer taking "reasonably practicable" steps — not a completion box. A certificate that can't show the right person genuinely demonstrated competence is a receipt, not proof, and that distinction is exactly what an inspector, auditor, or lawyer probes after an incident.

What is ANSI/ASSP Z490.1-2024 and why does it matter here?

It's the recognized benchmark for how safety, health, and environmental training should be built. Its 2024 revision consolidated in-person and online expectations into one: providers must verify the learner's identity, confirm participation, prevent unauthorized assistance, and communicate results properly. That effectively closes the loophole the race to the bottom depended on — a username and password confirming nothing about who actually did the work — and makes learner authentication part of a defensible, current-standard training record.

Does identity verification mean I'll be watched on webcam for the whole course?

No. That heavyweight kind of proctoring is one option, but it's overkill for most safety training. Effective identity verification confirms who completed the graded assessment — the moment that actually matters — rather than surveilling the entire course. Done well, it's a light touch for the learner and a strong anchor for the record.

How do I choose training that isn't part of the race to the bottom?

Look for three things the race was built to skip: certification on a genuine competency assessment rather than time-in-seat, verification of who actually completed that assessment, and a credential anyone can verify rather than a static PDF. If a course has all three and is built to ANSI/ASSP Z490.1-2024, you're buying proof of competence. If it's free and instant, you're buying a receipt for a login.