Compliance training games: how to build one people actually replay
How to turn your own policies into short compliance training games: which rules are worth a game, which formats fit, how to write questions that test behaviour, and how the game sits next to your formal training record.
The Arcadedo team, Gametize
9 min read
Compliance training games are short games that make staff practise your rules instead of skimming them: a quiz race, a swipe-to-judge drill or a match-3 refresher built from your own policies. Use them for practice and refreshers between formal courses, keep the official record in your LMS, and track which questions people miss.
Most writing about compliance games is either a catalogue of off-the-shelf modules or a case study of a custom serious game that took months to build. This guide covers the middle ground most compliance and L&D teams actually need: turning the rules you already have into a two-minute game this week, without pretending the game replaces your formal course. The examples use Arcadedo templates you can play in your browser before building anything.
What are compliance training games?
Compliance training games are short, replayable games built around the rules employees must follow, such as data protection, anti-bribery, conflicts of interest or reporting procedures. Instead of reading a policy and ticking "done", players answer questions or make quick judgements inside a game, and see an explanation after every answer.
They come in two broad kinds:
- Off-the-shelf modules on generic topics (GDPR basics, gifts and hospitality), usually sold as a library with an LMS package.
- Games built from your own content: your policy, your thresholds, your reporting channel, your real incidents. These take more of your time but test what your staff actually need to know.
This guide is about the second kind. If you are new to the idea, our guide to gamification in employee training covers the wider picture.
Do games work for compliance training?
Games work for compliance when they make people retrieve the rules from memory, repeatedly, with feedback. That is the mechanism the research supports, not points or badges on their own. A short game that people replay a few times gives far more retrieval practice than a module they click through once a year.
The evidence behind that:
- Testing beats re-reading. In a well-known experiment, Roediger and Karpicke (2006) found that students who were tested on a passage remembered more a week later than students who studied it again (Psychological Science). The study used students and short texts, so treat it as support for the principle, not a forecast for your programme.
- Spacing holds up at work. A study of more than 10,000 employees doing workplace training found the spacing effect in real-world data: the further away the test, the more the gaps between practice sessions mattered (Kim et al., 2019, Behavior Research Methods).
- Regulators ask about effectiveness, not attendance. The US Department of Justice's guidance to prosecutors, Evaluation of Corporate Compliance Programs (updated September 2024), asks "How has the company measured the effectiveness of the training?" and whether employees have learned the covered subject matter (DOJ Criminal Division).
A game does not answer that question on its own, but per-question results give you something better to show than a completion tick.
Which compliance topics suit a game?
Topics with clear rules and recognisable situations suit games best: what to do when a gift arrives, how to spot a phishing email, who to tell about a data breach and how fast. Topics that need judgement on long, nuanced cases are better handled in a workshop or a written scenario, with a game as the refresher afterwards.
| Topic | What staff should be able to do | Format that fits |
|---|---|---|
| Data protection | Report a breach to the right person, in time | Quiz race (Turbo Quiz Racer) |
| Anti-bribery, gifts and hospitality | Know the limit and when to declare | Quiz race or highway quiz (Checkpoint Rush) |
| Phishing and fraud | Tell a genuine request from a scam in seconds | Swipe to judge (Real or Fake) |
| Code of conduct | Recall the key commitments and where to raise concerns | Match-3 refresher (Star Match) |
| Health and safety | Pick the right first action in an incident | Action quiz (Outpost Defense) |
| Policy awareness campaigns | Pick up short facts, no testing | Fact maze (Mini Maze) |
Pick one outcome per game. "Staff can name the three steps for reporting a data breach" makes a focused five-question game; "know the code of conduct" makes a vague one.
Which game formats work for compliance?
Use a quiz-based format that shows an explanation after every answer. Turbo Quiz Racer is the safest default: players answer at each checkpoint to move their car, and a wrong answer costs a life and shows why. For yes-or-no judgements, Real or Fake's swipe drill is faster; for light refreshers, Star Match hides questions inside a match-3 board.
Quiz race (Turbo Quiz Racer). Each correct answer moves the player's car toward the finish; each wrong one costs a life and barely moves it. Lives, timers and a pass score are all adjustable, so you can make it forgiving for a first run.
Highway quiz (Checkpoint Rush). Players weave through traffic and, at quiz checkpoints, the lanes become answers. Drive into the wrong lane and the right answer appears straight away, with your explanation.
Swipe to judge (Real or Fake). Each card is a message, request or claim; players swipe right for real and left for fake. It suits fraud, phishing and "is this allowed?" drills. Our guide to cyber security awareness games covers how to write the deck.
Match-3 refresher (Star Match) and wave defence (Outpost Defense) put questions between bursts of play, which suits a quick top-up after the main course. Our guide to choosing a game template compares every format.
How do you build a compliance game, step by step?
Pick a quiz template, add five to ten questions from your policy (by hand or drafted by AI from the document), add a one-line explanation to each, brand it, set a pass score and publish. In Arcadedo this takes under an hour and no code, and the link plays on any phone or laptop.
- Choose the outcome. One behaviour per game, agreed with the policy owner.
- Open a template. Go to the game templates, click Preview & Play to try one, then Use This Template.
- Add the questions. In the Content step, write them yourself, or click Generate with AI and upload the policy as a PDF, Word or text file up to 5 MB. Generating costs 5 credits per batch, refunded if it fails. See Add questions or facts.
- Review every question. Check each answer against the current policy and delete trivia such as clause numbers and dates.
- Write the explanations. One sentence per question saying why the right answer is right. This is where most of the teaching happens.
- Brand it. Add your logo and colours so it is clearly an official exercise, not a suspicious link. See Brand your game.
- Set the pass score and publish. A pass mark around 70 to 80 percent is a sensible start. Publish from the Go step, then share the link or embed it in Gametize.
If your starting point is a long policy document, our step-by-step guide to turn a PDF policy into a quiz game covers preparing the file and checking AI-drafted questions in detail.
How do you write compliance questions that test behaviour?
Ask what the person should do, not what the policy says. "A supplier offers you concert tickets during a tender. What do you do?" tests the rule the way staff will meet it; "What is the gift limit in section 4.2?" tests memory for a number. Write wrong answers from the mistakes people really make.
A few rules that make the difference:
- Use scenarios from real incidents, anonymised. They are what your people actually face.
- Avoid "which of the following is NOT". It trips up people who know the rule.
- Make every wrong answer plausible. "Accept the tickets and tell nobody" teaches nothing if it is obviously wrong; "Accept, then declare it next month" does.
- Point the explanation at the rule. "Declare any gift during a live tender before accepting it" beats "Correct!".
Can a game count as your compliance training record?
Treat the game as practice, not as the record. Arcadedo's analytics are anonymous totals: plays, completion rate, pass rate and the questions players miss most. They do not record which named employee passed. Keep formal completion and assessment in your LMS or course, and use the game before and after it.
That split plays to each tool's strengths:
| Job | Where it lives |
|---|---|
| Teach the rules | Your existing course, video or session |
| Practise and refresh | A short compliance game, replayable for a week or two |
| Formal assessment and the audit record | Your LMS quiz or course completion |
| Find the rules that have not landed | The game's most-missed questions |
If a result must go on someone's record, a plain quiz with no lives or timers is also easier to defend. Our comparison of a quiz or a game as a knowledge check goes through the trade-offs.
How do you roll out and measure a compliance game?
Launch the game alongside the formal course, send it again two to four weeks later, and repeat before the next annual cycle. Then read three numbers in the game's analytics: completion rate, pass rate and the most-missed questions. The most-missed questions tell you which rules to re-teach or rewrite.
A simple cadence:
- Week 0: the formal course, with the game linked at the end as optional practice.
- Weeks 2 to 4: a reminder with the game link. Short runs invite replays, and each replay is more practice.
- Quarterly: swap in a few new scenario questions from recent incidents. A published game keeps the same link, so players see the changes without a new invitation.
What to read afterwards:
- Completion rate: how many started rounds were finished. A low number usually means the game is too long or too hard.
- Pass rate: how many finished rounds reached the pass score.
- Most-missed questions: the rules that have not landed. Rewrite the question if it is unclear; re-teach the rule if it is not.
Players are counted by browser, so treat the numbers as a signal about the content, not a headcount.
Frequently asked questions
Are compliance training games suitable for serious topics?
Yes, if the game is short and the questions are taken seriously. Use a calm format such as a quiz race, write scenarios from real situations, and add an explanation to every answer. Avoid jokey prizes or leaderboards for sensitive topics like harassment.
How many questions should a compliance game have?
Five to ten per game, covering one outcome. A long policy is better split into several short games than one long one, because short runs get replayed and replays are where the practice happens.
Can AI write compliance quiz questions?
AI can draft them from your policy document in seconds, but a person must review every question against the current policy. Delete trivia, rewrite trick wording and ask the policy owner to check the final set before publishing.
How much does it cost to build a compliance game in Arcadedo?
Building and hosting a game is free. Credits pay only for optional extras: 5 credits per batch of AI-generated questions, and credits to remove the Arcadedo badge. See how credits work.
Do compliance games replace the annual compliance course?
No. The course teaches and records; the game makes people practise between courses. Used together, the game gives you per-question evidence of what people know, which a completion tick on its own cannot.
