What do ASQA's risk priorities mean for RTOs?

ASQA’s regulatory risk priorities identify the threats it considers most significant to the quality and integrity of vocational education and training. They help direct the regulator’s intelligence gathering, monitoring, education and regulatory activity. For RTOs, they provide a clear indication of the practices, business models and outcomes likely to attract greater scrutiny.

They are not additional Standards, nor do they replace an RTO’s existing regulatory obligations. An RTO does not become compliant by creating a register against each priority or adding several new questions to an internal audit checklist. The practical implication is more substantial: RTOs should consider whether the conditions described by ASQA exist within their own operations, how they would detect them and what evidence supports their confidence that the associated risks are being controlled.

ASQA’s 2026–27 priorities are grouped into four connected areas:

• provider governance, market conduct and non-genuine operations

• quality, sufficiency and fitness for purpose of training delivery

• integrity of qualifications and competency outcomes

• transparency, accountability and assurance in complex and international delivery models.

These priorities point to a common regulatory concern. An RTO must be able to show that genuine training and assessment sit behind the qualifications it issues, and that its governance arrangements give it adequate oversight of how those outcomes are produced.

Risk priorities explain where ASQA is directing attention

Risk-based regulation recognises that a regulator cannot examine every aspect of every RTO with equal frequency or intensity. ASQA uses research, consultation, regulatory intelligence and data to identify threats that may affect individual RTOs or create wider problems across VET. Its annual environmental scan draws on engagement with RTOs, industry bodies and governments, as well as regulatory and other data.

The resulting priorities influence where ASQA directs its regulatory attention. ASQA states that it uses a range of monitoring approaches, intelligence and data to assess provider and systemic risk. Its regulatory response may also vary according to the scale and impact of non-compliance, an RTO’s compliance history, and its commitment and capability to address problems.

This means a priority is neither a prediction that every RTO will be audited on the topic nor a finding that every practice named by ASQA is occurring across VET. It identifies an area where the potential harm is sufficiently serious or widespread to warrant focused attention.

RTOs should therefore resist two weak responses. The first is panic, where a newly published priority triggers hurried document production without a clear understanding of the risk. The second is dismissal, where an RTO assumes the priority applies only to fraudulent operators or unfamiliar delivery models.

Some priorities do concern deliberate misconduct. Others describe conditions that may also develop through poor oversight, commercial pressure, weak assessment design or fragmented responsibilities. An ethical RTO may still have exposure to those risks.

Governance risk is broader than the conduct of governing persons

ASQA’s first priority brings together provider governance, market conduct and non-genuine operations. Its stated areas of focus include deliberate non-delivery, phoenixing, proxy ownership, infiltration of legitimate RTOs, governance failures that enable bad-faith business models, and exploitative or deceptive market conduct.

At the most serious end, these are integrity issues involving RTOs that present the appearance of legitimate education while failing to deliver genuine training and assessment. Most genuine RTOs will reasonably regard their own conduct as far removed from this behaviour.

The priority still has broader implications for governance. ASQA links weak or opaque governance with risks across recruitment, delivery, assessment and student protection. It also identifies financial pressure, competition and complex third-party relationships as conditions that can distort decisions and reduce accountability.

An RTO’s self-assurance should consequently extend beyond checking whether governing persons meet formal suitability requirements. It should examine who influences decisions, where financial or recruitment incentives may conflict with educational quality, and whether the RTO can see what is happening throughout its operations.

For example, a governing body may approve an arrangement with a broker that promises a substantial volume of recognition of prior learning applicants. A contract may exist and management reports may show strong enrolment growth. Neither provides assurance about the quality of the arrangement. Governing persons need to know how applicants are marketed to, what representations are made, who collects evidence, how assessor independence is protected and whether commercial expectations are placing pressure on competency decisions.

The relevant governance question is not simply whether authority has been assigned. It is whether the RTO retains sufficient visibility and control to meet its obligations.

Training must be sufficient for the students and outcomes involved

ASQA’s second priority concerns the quality, sufficiency and fitness for purpose of training delivery. The wording is significant because it directs attention beyond the existence of a training and assessment strategy or a nominal course duration. It asks whether students receive the training they need to develop the skills and knowledge represented by the qualification.

Training may be documented without being sufficient. A timetable can show allocated hours while saying little about the quality of instruction, access to practice, suitability of resources or opportunities to apply skills. An online learning platform can contain extensive material while providing limited training or interaction. A student may remain enrolled for a prescribed period but receive insufficient preparation for assessment or work.

Previous ASQA risk priorities examined shortened course duration as a specific concern. ASQA identified practices in which training was compressed or removed, leaving students to complete assessment without adequate skill development. It connected this risk with workforce readiness, safety and the quality of work performed by graduates.

The current priority frames the issue more broadly. The question is not whether every course should be longer. Longer delivery does not guarantee better training. The RTO should be able to justify how the amount, sequence and form of training respond to the training product, the student cohort and the intended workplace outcomes.

This requires evidence from delivery, not assumptions embedded in a strategy document. RTOs might examine student progression, attendance and engagement, trainer observations, requests for support, assessment performance, employer feedback and whether students receive adequate opportunities to practice before being assessed.

An RTO offering accelerated delivery should be particularly clear about its reasoning. Which students is the model suitable for? What existing skills or experience are assumed? How are those assumptions verified? What happens when a student needs more training than the published schedule anticipates? A fast course may be defensible, but speed cannot become the educational rationale.

Qualification integrity depends on genuine assessment decisions

The third priority concerns the integrity of qualifications and competency outcomes. ASQA describes this as encompassing risks that undermine confidence that a qualification represents genuine, independently demonstrated competence. Its focus is on whether assessment evidence, records and competency decisions are authentic and trustworthy.

This priority reaches the central promise made when an RTO issues a qualification or statement of attainment. The document represents more than completion of a course or participation in assessment. It indicates that a qualified assessor has considered adequate evidence and determined that the person meets the requirements of the relevant training product.

The integrity of that outcome can be weakened in several ways. Assessment tasks may not address the complete requirements. Evidence may have been produced by another person. Records may have been altered after submission. Assessors may be pressured to approve weak evidence. Recognition of prior learning may be reduced to the collection of workplace documents without an individual competency judgement.

These risks are not confined to deliberately fraudulent RTOs. They can also emerge when assessment workloads are unreasonable, decision-making rules are vague, learning platforms make student identity difficult to verify or validation concentrates on document completion rather than the quality of judgements.

ASQA’s recent qualification integrity actions demonstrate the potential consequences when qualifications cannot be relied upon. ASQA has cancelled the registration of critically non-compliant RTOs and, in some cases, cancelled qualifications or statements of attainment where appropriate training or assessment did not occur. It has also advised RTOs to consider the consequences of cancelled credentials for credit transfer decisions and trainer and assessor qualifications.

For RTOs, the practical response is not simply to check whether every assessment file contains the required forms. Self-assurance should test whether the evidence supports the decision recorded. That includes examining authenticity, assessor reasoning, the handling of gaps and inconsistencies, and whether results can be traced back to genuine assessment activity.

Complexity does not transfer accountability

The fourth priority addresses transparency, accountability and assurance in complex and international delivery models. ASQA describes the risk as arising where complexity reduces visibility, accountability or regulatory traceability.

Complexity may come from third-party delivery, education agents, offshore functions, corporate groups, subcontracting, online platforms or arrangements in which several entities contribute to recruitment, support, training, assessment and administration. These models are not inherently unacceptable. They do, however, create more opportunities for information to become fragmented and responsibility to become unclear.

An RTO may know what its contract requires while having limited knowledge of what occurs in practice. Senior leaders may receive aggregate reports without access to the student-level evidence behind them. A third party may use staff, systems or marketing materials that the RTO has never reviewed. Assessment or administrative work may move between entities without a clear record of who performed it.

The RTO remains responsible for ensuring that its obligations are met. Contract clauses, service-level reports and assurances from business partners may contribute to oversight, but they do not establish that students are receiving suitable training and valid assessment.

Self-assurance in a complex model requires traceability. The RTO should be able to identify who performed each significant function, what information was used, where records are retained, who made decisions and how the RTO tested the quality of the work. Governing persons should also understand the complete delivery model, including relationships that may not appear in the primary contract.

Where an RTO cannot obtain reliable information about an activity conducted on its behalf, the problem is not merely administrative. It is an assurance failure.

The priorities are connected

The four risk priorities should not be treated as separate compliance projects. ASQA expressly describes them as deeply interconnected.

Weak governance can allow commercial considerations to reduce training. Insufficient training may leave students unable to produce valid assessment evidence. Poor assessment controls may result in qualifications that do not represent competence. Complex delivery arrangements may make each of these problems more difficult to detect.

The connections also work in the other direction. Clear governance can set limits on commercial pressure. Suitable training can prepare students to demonstrate competence genuinely. Effective assessment systems can protect qualification integrity. Transparent delivery arrangements can give the RTO the evidence it needs to identify weaknesses and intervene.

This is why a separate risk-priorities register may have limited value unless it connects with the RTO’s wider systems. The priorities should inform strategic and operational risk management, internal review, validation, third-party monitoring, workforce planning and the information provided to governing persons.

What should an RTO do with the priorities?

An RTO should begin by examining the underlying risks rather than matching each ASQA heading to an existing policy. The useful question is: where could this risk arise in our model, and what evidence tells us that it is being controlled?

That review should reflect the RTO’s context. A domestic workplace-based RTO will have different exposures from a large CRICOS RTO using education agents and offshore services. An RTO delivering high-risk licensing outcomes may need stronger assurance over practical assessment than an RTO delivering lower-risk professional development qualifications. An RTO relying heavily on recognition of prior learning should scrutinise marketing, evidence collection, assessor independence and the time available for individual assessment.

RTOs should also consider what information might contradict their current view. Strong enrolment figures do not establish sound market conduct. High completion rates do not establish sufficient training. Complete assessment files do not establish authentic evidence. A signed third-party report does not establish effective oversight.

ASQA’s priorities do not tell an RTO everything it must review, and they do not reduce the obligation to comply with requirements outside the priority areas. They do, however, provide an informed account of where ASQA sees significant threats to VET quality and qualification integrity.

A self-assured RTO will use that account to test its own assumptions. It will be able to explain where the identified risks could arise, how they are monitored and what evidence supports the conclusion that students receive genuine training and assessment. That is a more useful response than preparing for the questions an auditor might ask. It strengthens the RTO’s capacity to identify the problem before the regulator does.

If you've found this article helpful, you might wish to check out my YouTube videos on these risk priorities: https://www.youtube.com/playlist?list=PLEwc1IFH15ls