Ditto this, under "Pretexting protection": In fact, the evaluation of the effectiveness of such employee training probably should include a follow-up program of random spot-checks, "outside the classroom", after completion of the initial employee training, in order to check on the resistance of a given (randomly chosen) student to various types of "social engineering" – perhaps even designed to focus attention on any new wrinkle that might have arisen after the initial effort to "develop" the curriculum for such employee training.  

 Also, the opening sentence of "Pretexting protection" could be rewritten as follows, for improved clarity: Pretexting (sometimes referred to as "social engineering") occurs when someone lacking the proper authority attempts to gain access to personal nonpublic information through impersonation, persuasion, or other deceptive means.