A validation schedule proves you planned to validate. It doesn't prove you did. Under the 2025 Standards, the real exposure for an RTO is the evidence trail: whether validation happened, was independent, was risk-based, and changed the assessment tools. That trail is where validation looks thinnest when an auditor asks for it.
Why this lands on your desk
You own the schedule and the evidence behind it. The 2025 Standards replaced the 2015 Standards on 1 July 2025, and ASQA says providers must show compliance against the Standards in effect when a decision is made. If a 2015-based audit runs past that date, ASQA may ask for additional evidence against the revised Standards. A schedule built for 2015 can leave you exposed.
The 2025 Standards have three parts: Outcome Standards, Compliance Requirements and a Credential Policy. The Credential Policy is enforceable. It covers the credentials needed to deliver training and assessment, and to undertake validation of assessment.
Then there's self-assurance. ASQA's Corporate Plan measures the proportion of providers demonstrating effective self-assurance through self-assessment and transparent reporting. Your own monitoring is now part of how the provider is judged, not just the auditor's findings.
And if your evidence is spread across drives, inboxes and spreadsheets, you become the bottleneck. A validation record you can't produce quickly looks the same to an auditor as one that never happened.
What the evidence trail has to show
ASQA's 2026 Statement of Intent commits to embedding the 2025 Standards and reinforcing outcome-focused regulation. That means emphasising outcomes over inputs and continuous improvement. For validation, the question shifts from "was it scheduled?" to "did it improve assessment outcomes?"
Four tests an auditor can apply
- It happened. Dated records, attendees, materials reviewed and findings, not a calendar entry.
- It was independent. Validators were not involved in designing or delivering the training and assessment being validated, and held the credentials the Credential Policy requires.
- It was risk-based. You can explain why you chose that product, that timing and that sample size.
- It changed something. Findings link to a revised tool, a version history and a sign-off.
The fourth test is the one most files fail. A validation report full of findings and no corresponding tool changes tells an auditor the process produced paper, not improvement.
A caution on the detail
Secondary sources (Knowledge Foundry and eSkilled among them) say assessment tools must be reviewed before use, and every training product validated at least once every five years, or sooner when risks or changes arise. They also say sample size is a risk-based judgement and validators must be independent of design and delivery. That reads sensibly, but these are not ASQA publications. Check each point against ASQA's Assessment Practice Guide and the 2025 Standards FAQs before it goes into your policy.
Where records and practice drift apart
A Skiltrak list of commonly identified audit issues includes inadequate validation processes, RPL granted without sufficient evidence, incomplete trainer and assessor credential files, and governance records that don't reflect actual practice. It's a secondary source and indicative only. The pattern is still useful: records and practice fail to match.
Notes from a March 2026 ASQA sector workshop, recorded by Skills Education and not an ASQA publication, report 89 performance reviews between July 2025 and 30 January 2026, with a 62% compliance rate. The same notes describe performance reviews as more targeted and smaller in scope than audits. A narrow review can still turn on a single piece of evidence, and validation records are an obvious candidate.
The wider context matters too. ASQA is running an ongoing program of action against non-genuine and bad-faith providers, and its 2026–27 priorities include provider governance. Most RTOs are nowhere near that territory. But thin validation evidence sits closer to those concerns than most compliance managers would like.
The independence constraint is real
Independence is easy to write into a policy and harder to staff. Jobs and Skills Australia's VET Workforce Study (October 2024) describes a highly casualised, ageing workforce. Validation relies on a stretched pool of qualified people, so your independent validators are probably also someone else's.
That doesn't excuse the requirement. It means the decision about who validates what, and why they qualify, should be recorded at the time, with their credentials on file. Reconstructing it during an audit is where gaps appear.
A first step you can take this quarter
Pick one training product and trace it end to end, as an auditor would.
- Find the validation record. Time how long it takes.
- Confirm who validated, that they were independent, and that their credentials are on file.
- Locate the rationale for the sample size and timing.
- Find the tool changes that came out of the findings, and the sign-off.
- Name one owner for each gap, with a date.
If step one takes an afternoon, that is your finding. You've found it before ASQA does.
Key takeaways
- The 2025 Standards took effect on 1 July 2025, and ASQA assesses against the Standards in effect when it decides, so a 2015-era schedule needs review.
- Evidence should show validation happened, was independent, was risk-based and led to changed assessment tools.
- The Credential Policy is enforceable and covers validation credentials, so keep validator credential files current.
- Treat secondary-source detail (five-year cycles, sample sizes) as a prompt to check ASQA's own guidance, not as the rule.
- If you can't produce a validation record quickly, an auditor will read it as one that didn't exist.
Our take
Most compliance teams treat validation as a scheduling problem. The 2025 Standards make it an evidence problem, and a closing-the-loop problem. The strongest position isn't a perfect calendar. It's a short, boring trail from "we chose this product for these reasons" to "here is the revised tool."
We'd also argue the independence question deserves more attention than it gets. It's the decision most likely to be made informally, because the validator pool is thin. Make it formally, write it down, and the rest of the file gets easier to defend.
FAQ
Is a validation schedule enough under the 2025 Standards?
No. A schedule shows planning. ASQA's outcome-focused approach, set out in its 2026 Statement of Intent, points to evidence that validation took place, was independent and risk-based, and improved assessment tools.
How often must training products be validated?
Secondary sources say at least once every five years, or sooner when risks or changes arise. They are not ASQA publications. Confirm the requirement in ASQA's Assessment Practice Guide and the 2025 Standards FAQs before relying on it.
Who can validate our assessment?
Secondary sources say validators must be independent of the design and delivery of the training and assessment. The enforceable Credential Policy sets the credentials needed for validation. Keep validator credentials on file and record why each validator qualified.
Can a performance review focus on validation alone?
Yes, it's possible. Notes from a March 2026 ASQA workshop, recorded by Skills Education, describe performance reviews as more targeted and smaller in scope than audits. A single piece of evidence can decide the outcome, so be able to produce validation records on request.
If an auditor asked for your last validation record this afternoon, who would you call, and how long would it take them to find it?