Audit-readiness rarely fails because nobody cares. It fails because, on the day, nobody can show who owns a compliance task and where its evidence sits. If you are the named owner and the reviewer of everything, you aren't a safeguard. You're a single point of failure with a strong work ethic.
Why this lands on your desk
You answer for registration and audit-readiness. But most of the evidence is created by trainers, assessors and student support staff. Accountability sits with you while control sits with others, and that gap is where findings come from.
The Standards for RTOs 2025 took effect on 1 July 2025. They have three elements: the Outcome Standards, the Compliance Standards (including the Fit and Proper Person Requirements) and the Credential Policy. The Outcome Standards span four quality areas: training and assessment, VET student support, VET workforce and governance.
Each of those areas crosses several teams. No single person can own and review every task across all four. If ownership isn't explicit, it defaults to you, and you become the bottleneck for every document review.
What the numbers say, and what they don't
ASQA completed 284 performance assessments in 2024-25. Of those, 221 (78%) resulted in a non-compliance finding (ASQA Annual Report 2024-25).
Be careful with that figure. ASQA selects providers using risk indicators, so it is not a random sample of the sector. It doesn't tell you 78% of RTOs are non-compliant.
The second number is more useful. Of the non-compliant providers, 102 (46%) satisfied ASQA that they had returned to compliance. Fixing is possible. The question is whether you find the gap first, or the regulator does.
Use Outcome Standard 4.4 as your ownership test
Outcome Standard 4.4 is about systematic monitoring and evaluation to support continuous improvement. One secondary source reports that ASQA identified 21 instances of non-compliance against it up to October 2025. Verify that against ASQA before you quote it.
The standard's intent is clear without the statistic. "Systematic" means the monitoring doesn't depend on you remembering to ask. It means someone is assigned, a signal exists, and there's a record that the loop closed.
A manager who personally reviews every document cannot be the early-warning system. By the time a document reaches you, the problem has already happened. Early warning comes from owners close to the work who know what "off" looks like.
Make ownership task-level, role-based and traceable
A policy owner list isn't enough. "Student support: Jane" tells an auditor nothing about which task, which evidence, or what happens when Jane is on leave.
For each recurring compliance task, record four things:
- A named role as owner, not just a person. Roles survive resignations.
- Where the evidence lives, as a single location, not "somewhere in the shared drive".
- The review trigger: a date, an event or a standards change.
- A backup role with authority to act.
Role-based matters more than it sounds. JSA found VET teachers in shortage nationally for two years, with a highly casualised workforce (the study is from 2024). The Productivity Commission's RoGS 2026 reports teacher outflow exceeded inflow in eight of nine reference years. Ownership that lives in one person's memory is fragile when people move on.
Four tasks to assign this quarter
Start with the tasks that fail silently. These are the ones nobody notices until a regulator does.
Change tracking
ASQA says providers must demonstrate compliance against the Standards in effect when a decision is made, and must stay up to date with amendments. The 2025 Standards are still being amended. DEWR's Skills Reform page lists a 30 March 2026 announcement on early changes, and I couldn't confirm what it says, so read it directly.
Treat change tracking as a standing, assigned task. Someone owns watching for amendments and carrying each one through to updated policies, TAS and evidence.
Interpreting guidance
One commentator argues that replacing the single Users' Guide with nineteen Practice Guides makes compliance information harder to find. That's opinion, but the practical point holds. Someone needs to read the guidance and translate it into what trainers and assessors actually do.
Notification triggers
ASQA has issued a Statement of Regulatory Expectations on the Fit and Proper Person Requirements and notification of material changes. One consultancy cites a 10 business day timeframe. I couldn't verify it, so check the Compliance Standards instrument yourself.
Whatever the deadline, notification only works if someone owns spotting the trigger. Often that is HR, finance or a governing person, not you.
The Annual Declaration on Compliance
Consultancy sources say the declaration requires non-compliance to be disclosed and allows rectification steps to be described. Either way, the declaration is only as sound as the confidence of the people beneath it. Ask each owner to attest to their tasks before you sign off, not after.
Governance is part of the question
Secondary sources report that ASQA's 2026-27 priorities include governing persons not actively overseeing compliance. If that is right, "who owns this?" is a governance question as well as a document-control one.
Give your governing body a view of ownership, not just a compliance report. They should be able to see which tasks have owners, which are overdue, and where evidence is thin.
Key takeaways
- ASQA found non-compliance in 78% of 284 performance assessments in 2024-25, but those were risk-selected, so don't read it as a sector-wide rate.
- 46% of non-compliant providers returned to compliance, so early detection matters more than perfection.
- With four quality areas across several teams, one Compliance Manager cannot own and review everything.
- Assign ownership to roles, with evidence location, review trigger and backup recorded for each task.
- Make change tracking, guidance interpretation and notification triggers explicit, assigned tasks.
Our take
Most compliance frameworks are built around the manager. That feels safe, because you know the standards best. It's also the design most likely to fail, because it concentrates knowledge, review and memory in one role.
The better model is one where you set the system and test it, rather than doing all the work inside it. You become the person who checks that owners know their tasks, evidence is findable and signals reach the right desk. That's closer to what systematic monitoring asks for, and it's a better job.
This week, pick ten recurring compliance tasks. For each, ask: if I were away tomorrow, could someone else name the owner and find the evidence in five minutes? Wherever the answer is no, you've found your next finding.
FAQ
Does the 78% non-compliance figure mean most RTOs would fail an audit?
No. ASQA completed 284 performance assessments in 2024-25 and 221 (78%) had a non-compliance finding. But providers are selected using risk indicators, so it's not a random sample of the sector.
What does Outcome Standard 4.4 mean for task ownership?
It expects systematic monitoring and evaluation to support continuous improvement. In practice, that means assigned owners, defined review points and records showing issues were identified and closed, rather than relying on one manager's memory.
Should ownership be assigned to people or roles?
Roles, with a named current holder. The VET workforce is highly casualised and teacher outflow exceeded inflow in eight of nine reference years (RoGS 2026), so person-based ownership breaks when staff leave.
Who should track amendments to the 2025 Standards?
Assign it to a named role as a standing task. ASQA assesses against the Standards in effect when a decision is made and expects providers to keep up with amendments. Check the DEWR and ASQA pages directly for current changes.