What should training change: knowledge, skill, behavior, or performance?

Many training projects become difficult before anyone creates a lesson.

The problem is not always the content.

It is that the team has not agreed on what training is supposed to change.

A learner may be able to explain a rule, perform a procedure in a simulation, use the procedure during real work, or consistently produce a high-quality result. Those are four different outcomes. They require different learning designs and different evidence.

The practical answer is simple:

Choose the intended outcome before choosing the content, activity, or metric.

The framework in this article is a LoreGraph synthesis of learning, transfer, competency, and training-evaluation research. It is not a formally validated academic model. Its purpose is to help workplace-learning teams distinguish outcomes that are often grouped together under the single word learning.

Key takeaways

• Knowledge, skill, behavior, and performance are related, but they are not interchangeable.
• A quiz can provide evidence of some knowledge. It cannot, by itself, prove workplace behavior or job performance.
• Training can directly support knowledge and skill, while workplace conditions strongly influence whether people apply them.
• The stronger the business claim, the stronger and more realistic the evidence must be.
• One training program may target several levels, but it should name the primary outcome clearly.

The outcome chain

A useful way to think about workplace training is:

Exposure → knowledge → skill → behavior → performance → organizational result

Exposure means that someone opened, attended, watched, or completed the training. It confirms access or participation, not capability.

Knowledge means that the person can retrieve, explain, recognize, compare, or reason with relevant information.

Skill means that the person can perform a task under defined conditions and to an acceptable standard.

Behavior means that the person actually performs the intended action in the workplace.

Performance describes how well the work succeeds: its accuracy, quality, timeliness, safety, consistency, or efficiency.

An organizational result is a broader outcome such as lower rework, fewer incidents, faster onboarding, or improved service quality.

The arrows are not guarantees.

A completed course may not create knowledge. Knowledge may not become skill. Skill demonstrated during training may not transfer to the job. Correct behavior may still produce a weak result if the process, tools, or workload are poorly designed. A better business result may also occur for reasons unrelated to training.

CDC guidance distinguishes learning from learning transfer and recommends assessing whether learners can apply what they learned after they return to work.

Source: https://www.cdc.gov/training-development/php/about/evaluate-training-measuring-effectiveness.html

Research on training transfer has also emphasized that trainee characteristics, training design, and the work environment can all affect whether trained capabilities generalize to the job and persist over time.

Source: https://doi.org/10.1111/j.1744-6570.1988.tb00632.x

Knowledge: can the learner explain or decide?

Knowledge is more than remembering isolated facts.

In workplace training, it can include:

• facts and terminology;
• concepts and relationships;
• rules and policy conditions;
• reasons behind a procedure;
• signals that indicate a problem;
• exceptions and escalation thresholds;
• judgment about which rule applies.

Consider a confidentiality policy.

A factual knowledge outcome might be:

Identify which categories of information are confidential.

A conceptual outcome might be:

Explain why a specific disclosure creates a confidentiality risk.

A judgment outcome might be:

Given a realistic request for information, decide whether disclosure is permitted and explain which policy condition applies.

The evidence should match the claim.

Recognition questions may be useful for checking terminology or rules. Explanations, comparisons, and scenarios provide stronger evidence when the intended outcome requires reasoning.

Avoid objectives such as understand the confidentiality policy. The word understand does not specify what the learner must demonstrate.

Skill: can the learner perform?

A skill is the ability to carry out a task, not merely describe it.

Skill may involve physical action, software use, communication, diagnosis, judgment, or a sequence that combines several of these.

Examples include:

• completing an incident report accurately;
• using an electronic visit verification system;
• conducting a customer escalation conversation;
• inspecting equipment using an approved procedure;
• classifying a case and selecting the next action.

Define skill using observable standards such as:

• accuracy;
• sequence;
• completeness;
• speed;
• independence;
• error tolerance;
• appropriate escalation.

Evidence of skill normally requires a demonstration, simulation, work sample, role-play, or observed task. A multiple-choice question can test knowledge about a procedure, but it usually cannot prove that the learner can perform the procedure.

Immediate success also needs careful interpretation. Research on learning versus performance shows that strong performance during instruction may not indicate a durable change that will remain after cues, support, or recent exposure disappear.

Source: https://doi.org/10.1177/1745691615569000

A learner who completes a task while following a visible step-by-step guide has demonstrated supported performance. That may be exactly what the job requires. It should not automatically be labeled independent mastery.

Behavior: does the action happen at work?

Behavior is the intended action as it occurs in the real environment.

Examples include:

• an employee reports a qualifying incident promptly;
• a supervisor conducts the required safety check before work begins;
• a support agent verifies identity before disclosing account information;
• a manager uses the approved approval path instead of an informal shortcut.

A learner can possess the knowledge and skill but still not perform the behavior.

The employee may lack access, time, authority, equipment, manager support, or an opportunity to use the capability. The workplace may reward speed while the training asks for careful documentation. Colleagues may continue using the old process.

CDC follow-up guidance explicitly asks about resources, opportunities, time, supervisor support, colleague support, relevance, and memory as factors that can enable or prevent workplace use.

Source: https://www.cdc.gov/training-development/php/about/evaluate-training-measuring-effectiveness.html

Behavior evidence may come from:

• direct observation;
• workflow events;
• manager review;
• audit records;
• submitted work samples;
• documented follow-up;
• system logs that represent the actual action.

Self-report can provide useful context, but it is not identical to observed behavior.

Performance: how well does the work succeed?

Performance describes the quality of work under real conditions.

It can include:

• accuracy;
• completeness;
• consistency;
• timeliness;
• safety;
• productivity;
• reliability;
• customer experience;
• compliance with an approved standard.

Behavior and performance are connected but distinct.

Behavior:

The employee uses the required checklist before closing the task.

Performance:

The task is completed with all required fields, no critical omissions, and within the approved time range.

Performance measures should be close enough to the work to be interpretable. A broad metric such as annual customer retention may be influenced by many variables. It is rarely appropriate to attribute it to one training program without a stronger evaluation design.

Competency frameworks often combine knowledge, skills, abilities, and behaviors because successful work requires an integrated capability rather than a single test score.

Source: https://www.cdc.gov/infrastructure/training-professional-development/competencies-for-public-health-professionals.html

The NIST NICE Framework provides a concrete workforce example by describing work as tasks and connecting those tasks with supporting knowledge and skills.

Source: https://csrc.nist.gov/pubs/sp/800/181/r1/final

Where the chain breaks

The most useful diagnosis often comes from identifying where the progression stopped.

Observation	Likely interpretation	Better next question
The learner completed the course but cannot explain the rule	Exposure occurred; knowledge evidence is weak	Was the essential concept practiced and retrieved?
The learner explains the procedure but cannot perform it	Knowledge exists; skill is incomplete	Was there demonstration, guided practice, and feedback?
The learner performs in training but not at work	Transfer or workplace support is failing	Are tools, time, opportunity, incentives, and manager support present?
The behavior occurs but quality remains low	The behavior may be incomplete, the standard unclear, or the system weak	Which part of performance is failing, and what else influences it?
The business result improved after training	Training may have contributed	What other process, staffing, product, or market changes occurred?

This diagnosis prevents a common reaction: assigning another course every time performance remains weak.

Sometimes the right response is more practice. Sometimes it is a job aid, software change, clearer SOP, manager coaching, redesigned workflow, or a combination.

A worked example: incident reporting

Consider a hypothetical organization introducing an updated incident-reporting procedure.

The source is a detailed SOP. The organization wants incidents documented correctly and on time.

Knowledge outcome

Employees identify what counts as a reportable incident, who must be notified, what information is required, and the applicable timeline.

Possible evidence:

• recall questions;
• rule comparisons;
• scenarios requiring a report-or-do-not-report decision;
• explanations of why a condition applies.

Skill outcome

Employees complete a report from a realistic case using the approved form and escalation path.

Possible evidence:

• simulated report;
• ordered-step activity;
• work sample reviewed against a rubric;
• independent use of the reporting tool.

Behavior outcome

Employees begin the correct reporting process when a qualifying event occurs during work.

Possible evidence:

• workflow timestamp;
• supervisor review;
• audit of actual cases;
• observation during a drill where appropriate.

Performance outcome

Reports are timely, complete, factually accurate, and routed to the correct reviewer.

Possible evidence:

• completeness rate;
• critical-error rate;
• submission time;
• correct escalation rate;
• recurring-error analysis.

The broader organizational hope may be safer operations or stronger compliance. Those are meaningful goals, but they should not be treated as proof that the course alone caused the result.

Match the evidence to the outcome

Intended outcome	Useful evidence	Evidence that is usually insufficient by itself
Exposure	Enrollment, attendance, completion	Acknowledgment that the content was understood
Knowledge	Recall, explanation, comparison, scenario reasoning	Page views or time in course
Skill	Demonstration, simulation, work sample, observed practice	A quiz about the steps
Behavior	Observation, workflow data, manager review, audit	Intention to apply the training
Performance	Quality, accuracy, timeliness, safety, reliability data	Completion or satisfaction score
Organizational result	Operational or business indicators with contextual analysis	A before-and-after change with no examination of other causes

A pretest and posttest can estimate change in knowledge or skill. A delayed assessment can examine retention. Workplace observation or operational evidence is better suited to behavior and performance.

Not every program requires measurement at every level. The cost and strength of evaluation should match the importance, risk, and claim.

Common mistakes

Using one quiz for every outcome

A quiz may be appropriate for factual knowledge. It is weak evidence for physical procedures, conversations, tool use, workplace behavior, or operational quality.

Calling completion learning

Completion is an activity measure. It is useful for administration and compliance records, but it should not be renamed as understanding or capability.

Measuring only immediately

Immediate assessment may overstate what will remain after time passes. Important capabilities may require delayed retrieval or later application evidence.

Jumping directly to business impact

The farther the measure is from the learning activity, the more alternative explanations enter the system.

Treating broad competencies as single lessons

A competency may contain multiple tasks, knowledge elements, skills, behaviors, and standards. It often needs to be decomposed before it can be taught or assessed.

Choosing the highest level automatically

Not every detail needs to become memorized knowledge or independent skill. Some information should remain available in an SOP, checklist, or searchable support tool.

A practical design checklist

Before developing the next training program, answer these questions:

1. What is the primary intended change: knowledge, skill, behavior, or performance?
2. What would a successful person actually say, decide, or do?
3. Under what conditions must they succeed?
4. What standard defines acceptable performance?
5. What knowledge is required?
6. What skill requires practice?
7. What workplace factors could block application?
8. What evidence is feasible and strong enough for the claim?
9. When should the evidence be collected?
10. Which details should remain externally available instead of being memorized?

A document-to-training platform can help structure information into lessons and knowledge checks. But the organization must still decide what the training is meant to change. LoreGraph's SOP training workflow is most useful when that outcome and the necessary human review are clear.

Start with the outcome.

Then select the content, practice, and evidence that serve it.

Sources and further reading

• CDC, “Evaluate Training: Measuring Effectiveness”.
• CDC, “Competencies for Public Health Professionals”.
• NIST, Workforce Framework for Cybersecurity (NICE Framework).
• Soderstrom and Bjork, “Learning Versus Performance: An Integrative Review”.
• Baldwin and Ford, “Transfer of Training: A Review and Directions for Future Research”.
• Blume and colleagues, “Transfer of Training: A Meta-Analytic Review”.