How long do we actually need to keep assessment records?

It depends on the qualification and the framework behind it. Some core assessment evidence has to be kept for 30 years, which is longer than most systems and most staff last. So we build the retention rule into the backup and the document store rather than leaving it to a person. Then we document how it works, so ASQA can see it at audit.

Our Student Management System stores everything. Isn't that enough?

A Student Management System is where the records are kept. It is not what protects them. Backup, access control, identity and removing a leaver's access all happen outside aXcelerate, Wisenet, JobReady or VETtrak. If your vendor is down for two weeks, or an ex-trainer still has a login six months on, the system will not tell you. We secure the environment around it and review who has access.

An ASQA audit is coming. What does the IT side of it look like?

ASQA does not audit IT directly. What it does audit depends on IT evidence. Auditors want assessment records that exist, are unaltered and can be produced on request. They also want access to student records limited to the right people, and your Unique Student Identifier obligations met. We assemble that evidence pack and keep it current.

We deliver training on client sites and online. Does that change anything?

It does, in the details. A trainer's laptop on a client site is on a network you do not control. It needs endpoint detection and response, DNS filtering to block known-bad sites, and conditional access on every login. Online delivery platforms need someone checking who still has an account. Recorded sessions need clear rules about who can keep them and for how long. None of that is exotic. A generic IT provider just will not set it up unless you ask.

Can our trainers use Microsoft 365 Copilot or ChatGPT to write, mark or review assessment evidence?

Yes, in some cases, with a policy built around ASQA's expectations. ASQA does not currently ban AI-assisted assessment development, but it does expect validation that confirms an assessment tool reliably assesses the competency claimed. Drafting materials with AI is usually fine. Marking student evidence with AI and no human sign-off is usually not. Pick an enterprise tier, such as Copilot under Microsoft 365 Business Premium, Claude for Work or ChatGPT Enterprise. We help RTOs write the acceptable-use policy and document the controls, so you have a straight answer at the next audit.

IT and cybersecurity for Australian Registered Training Organisations.

You keep student records for decades and have to produce them intact on demand. Whether an audit by the Australian Skills Quality Authority (ASQA) runs clean or turns into a show-cause can come down to your IT. Unique Student Identifiers, Student Management Systems and trainers working on client sites are all part of that.

What compliance asks of you See if we're a fit

What's actually different

Student records you keep for decades change what RTO IT has to do.

Some of your assessment evidence has to be kept for up to 30 years. That outlives your file server, your backup contract and most of your staff, so retention cannot depend on someone remembering to do it. It has to be built into the systems and written down where an auditor can read it.

Your evidence is also spread across systems nobody bought together. A Student Management System, a learning platform, an assessment tool, payroll and the AVETMISS reporting pipeline are usually separate products. Each has its own logins and its own security settings. Most RTOs collect these over years and never review who can reach what across the whole set. We do.

A clean ASQA audit starts well before the auditor arrives. Have the retention policy, the access register, backup proof and the Student Management System audit log already assembled. Turn up with those and the auditor spends the day on training quality, not on whether your records are real. We keep that pack current as part of the service, so nobody is rebuilding it six weeks out.

Live right now

The 2026 pressure points we're actively working on with clients.

The specific asks, deadlines and enforcement actions shaping 2026 conversations in your sector.

2025 Standards for RTOs commenced 1 July 2025

The revised framework is in force: the Outcome Standards, the Compliance Standards including Fit and Proper Person Requirements, and the Credential Policy. ASQA has published 19 Practice Guides alongside them. The Information guide and the Transparency and Accountability guide both ask more of you on how student data is handled, disclosed and retained. Most RTOs we assess have not updated their internal processes to match.

USI handling under the Credential Policy

Unique Student Identifier verification is now tied more tightly to the Credential Policy and the 2025 Standards. The systems behind your AVETMISS submissions, USI checks and student-record retention have to work cleanly and produce evidence when asked.

Cyber-insurance renewals after the 2023 TAFE breaches

Underwriters have priced in the 2023 breaches across the TAFE sector. At renewal they are asking mid-size private RTOs for multi-factor authentication on every account and endpoint detection and response software. They also want staff cybersecurity training, tested backups and a written incident response plan. Several RTOs have had quotes declined over missing controls in the last 12 months.

Mandatory ransomware payment reporting, 72 hours

If your turnover is above $3M and you pay a ransom, you have 72 hours to report it to the Australian Signals Directorate. The Cyber Security Act made that mandatory on 30 May 2025. Most mid-size private RTOs are above that threshold.

Frameworks and regulators

Industry frameworks, regulations and audit standards for registered training organisations in Australia.

Standards for RTOs 2025: The Standards ASQA administers, revised on 1 July 2025 into the Outcome Standards and the Compliance Standards. They cover what learners are told, how the organisation is run and how records are kept. Your IT is what proves those controls were followed.
VET Quality Framework and Data Provision Requirements: AVETMISS is the national data standard for vocational education reporting. This framework covers those submissions, Unique Student Identifier handling, and how long student and assessment records must be kept. For some assessment evidence, that reaches 30 years.
Privacy Act 1988 and the Australian Privacy Principles: Unique Student Identifiers and student records fall under the Australian Privacy Principles. The USI Registrar adds its own rules on who may access a USI, who it can be disclosed to and when it must be destroyed.
CRICOS and ELICOS obligations: If you deliver to overseas students under CRICOS, you carry extra reporting and record-keeping duties on top of the domestic ones. They push your retention obligations out further again.
Essential Eight: The Australian Cyber Security Centre's eight mitigation strategies now turn up in RTO insurance renewals and in training contracts with larger enterprise clients. See the Essential Eight maturity model, level by level.

Where firms usually start

Compliance and IT starting points for registered training organisations in Australia.

Common questions

The things registered training organisations clients ask us first.

How long do we actually need to keep assessment records?: It depends on the qualification and the framework behind it. Some core assessment evidence has to be kept for 30 years, which is longer than most systems and most staff last. So we build the retention rule into the backup and the document store rather than leaving it to a person. Then we document how it works, so ASQA can see it at audit.

Our Student Management System stores everything. Isn't that enough?: A Student Management System is where the records are kept. It is not what protects them. Backup, access control, identity and removing a leaver's access all happen outside aXcelerate, Wisenet, JobReady or VETtrak. If your vendor is down for two weeks, or an ex-trainer still has a login six months on, the system will not tell you. We secure the environment around it and review who has access.

An ASQA audit is coming. What does the IT side of it look like?: ASQA does not audit IT directly. What it does audit depends on IT evidence. Auditors want assessment records that exist, are unaltered and can be produced on request. They also want access to student records limited to the right people, and your Unique Student Identifier obligations met. We assemble that evidence pack and keep it current.

We deliver training on client sites and online. Does that change anything?: It does, in the details. A trainer's laptop on a client site is on a network you do not control. It needs endpoint detection and response, DNS filtering to block known-bad sites, and conditional access on every login. Online delivery platforms need someone checking who still has an account. Recorded sessions need clear rules about who can keep them and for how long. None of that is exotic. A generic IT provider just will not set it up unless you ask.

Can our trainers use Microsoft 365 Copilot or ChatGPT to write, mark or review assessment evidence?: Yes, in some cases, with a policy built around ASQA's expectations. ASQA does not currently ban AI-assisted assessment development, but it does expect validation that confirms an assessment tool reliably assesses the competency claimed. Drafting materials with AI is usually fine. Marking student evidence with AI and no human sign-off is usually not. Pick an enterprise tier, such as Copilot under Microsoft 365 Business Premium, Claude for Work or ChatGPT Enterprise. We help RTOs write the acceptable-use policy and document the controls, so you have a straight answer at the next audit.

The qualifier

Let's see if we're a fit.

Seven questions, one moment of your time. We'd rather tell you now than three months in.