Start With the Requirements: Building a Compliance Baseline Your RTO Can Manage
John Liddicoat, Founder and Director13 October 20264 min read
Every RTO should be able to answer three questions with confidence.
Are we meeting the Standards today? If yes, can we prove it? If not, can we point to the gaps and show how we are closing them?
Do we have a system that continuously monitors and improves our performance?
Do we understand our compliance performance, and is it improving over time?
Most leaders would like to answer yes to all three. Far fewer could show how they know. The reason is usually simple. The organisation has never set out, in one place, exactly what it has to comply with and how each requirement is managed.
“You can't manage what you haven't properly defined.”
Self-assurance is a management system
Standard 4.4 of the Outcome Standards asks RTOs to undertake "systematic monitoring and evaluation of the organisation to support quality delivery and the continuous improvement of services"1. Its first performance indicator is a system for monitoring and evaluating performance against the requirements1.
In practice, that system follows a repeating cycle:
The self-assurance cycle
Step 1: Know
Know what the Standards require.
Step 2: Monitor
Monitor performance.
Step 3: Identify
Identify gaps, risks and opportunities.
Step 4: Act
Take action.
Step 5: Verify
Verify the outcome.
Step 6: Repeat
Repeat and keep improving.
The cycle needs a foundation. Monitoring only means something when you know what you are monitoring against. Action only helps when you know who owns it. Verification only works when you have decided what good looks like.
Five things the system needs to know
For any requirement, a self-assuring RTO can answer five questions:
- Requirements. What must we do?
- Controls. How do we make sure it happens?
- Evidence. How do we demonstrate it?
- Performance. How do we know it is working?
- Improvement. What do we do when it isn't?
There is an important principle underneath these questions. Compliance information should be collected because the RTO needs it to manage itself. Information gathered because "the auditor might want it" tends to end up in folders. Information gathered to run the organisation gets used.
What a compliance baseline is
A compliance baseline is one list of everything your RTO has to comply with, showing how each requirement is managed. The easiest way to picture it is a spreadsheet. Each requirement gets its own row. Across that row, you record what you do to meet it, who looks after it, what proof it leaves behind, how and how often you check it, and what you do if a check finds a problem.
It is where you answer the five questions above for every requirement, in writing and in the same format each time. Each row has seven columns. The first four record what is required and how it is managed:
| Requirement | Control | Owner | Evidence |
|---|---|---|---|
| What must we do? | How do we make sure it happens? | Who is responsible? | How do we demonstrate it? |
| Drawn from the 2025 Standards and the Credential Policy. | Policies, processes, systems and practices. | The role accountable for implementation and monitoring. | Records, documents, data and other evidence. |
Columns one to four: the question each answers, and what goes in it.
The last three record how it is checked and what happens when a check finds a gap:
| Monitoring activity | Review frequency | Action if a gap is found |
|---|---|---|
| How do we check it is happening? | How often do we review it? | What do we do when it isn't compliant? |
| Validation, spot checks, data analysis and reporting. | Ongoing, monthly, quarterly or annually, as applicable. | Corrective action, an improvement plan and follow-up. |
Columns five to seven: where most registers stop short.
Fill in all seven columns for each key requirement and you have the baseline. It is the centre of a compliance framework. It gives the organisation a clear, structured view of what is required, how it is controlled, how it is monitored and how gaps are addressed.
The last three elements are where most registers stop short
Plenty of RTOs can list requirements, policies and owners. Fewer have decided how each control will be checked, how often, and what happens when the check fails. Without those elements the baseline describes intent. With them, it describes a system.
Cover the whole architecture
ASQA describes three components of the 2025 Standards for RTOs: the Outcome Standards, the Compliance Standards and the Credential Policy2. The first two are legislative instruments2,1,3. The Credential Policy is listed on the National Register and sets out the credentials required to deliver training and assessment and to validate assessment2,4.
A baseline that maps only the Outcome Standards leaves part of the picture out. ASQA's own self-assurance question for Standard 4.4 asks how an RTO monitors and evaluates its performance against both the Outcome Standards and the Compliance Requirements instruments5. The baseline should also carry the other obligations the organisation holds, such as funding contracts, legislation and third-party arrangements.
Where to start
Building a full baseline can feel like a large project. It doesn't need to happen in one go.
- Start with the requirements that carry the most risk for your scope, delivery model and student cohorts.
- Name an owner by role, so the row survives staff changes.
- Write down the evidence the control should leave behind, before anyone needs to find it.
- Choose a monitoring activity and a frequency you will actually keep. A monthly check that happens is worth more than a weekly one that doesn't.
- Decide the response to a gap in advance, so a finding turns into action quickly.
Then add the next group of requirements, and the next.
Why it matters
Once the baseline exists, the three big questions become answerable. You can see which requirements are covered and which aren't. You can see whether monitoring is happening. You can see whether gaps are being closed. And you have the foundation for the compliance indicators that tell leaders how the system is performing.
Octossure maps requirements to controls, owners, evidence, monitoring and corrective action, and reports coverage as one of ten compliance indicators on a single scorecard. Want to see where your baseline stands? Take the ASQA Self-Assurance Ready Reckoner or book a demo at www.octossure.com.au.
Sources
- 1.National Vocational Education and Training Regulator (Outcome Standards for NVR Registered Training Organisations) Instrument 2025 (F2025L00354), Federal Register of Legislation, 2025
- 2.About the Standards, Australian Skills Quality Authority (ASQA), Accessed 29 September 2026
- 3.National Vocational Education and Training Regulator (Compliance Standards for NVR Registered Training Organisations and Fit and Proper Person Requirements) Instrument 2025 (F2025L00355), Federal Register of Legislation, 2025
- 4.Credential Policy, training.gov.au (National Register of VET), Accessed 29 September 2026
- 5.Continuous Improvement Practice Guide (Standard 4.4), Australian Skills Quality Authority (ASQA), Accessed 29 September 2026