SPEAKER_00 0:46

The RTO Superhero Podcast Episode 35. You just got an audit notice. What to do before the auditor arrives. Welcome back to the RTO Superhero Podcast. I'm Angela Connell Richards and this is Episode 35. The second episode in our implementation series where we take the eight critical drivers framework and show you exactly how it works when real situations hit. Last week in episode 34, we walked through the 72-hour response plan for when your largest employer exits. Today we are tackling the other scenario that keeps every RTO leader awake at night. You have just received an audit

Audit Notice Scenario Set-Up

SPEAKER_00 1:32

notice from ASQA. Now I want to be clear about something right at the start. If you have been running the eight critical drivers, what I am about to walk you through is mostly a retrieval exercise. You are not preparing. You are confirming that the system has been producing the evidence all along. If you have not been running the system, what follows is a triage sequence. It will not fix governance gaps that have been building for months. But it will help you identify the most critical exposures, address what can be addressed in the time you have, and present your organization's position with maximum defensibility. Either way, this episode gives you the exact sequence. What to do first, what to check second, what to prioritize when time is limited, and what to absolutely not do. Before we dive in, your reminder that my book, The Eight Critical Drivers to RTO Success, is available for pre-order at 8-critical dash drivers-book.vivacity.com.au. It releases in July and gives you the complete system, including the evidence gate, the ARG model, the internal audit simulation methodology, and every dashboard template you need to demonstrate governance grade control. The companion workbook has the fillable forms, but the book is where the architecture lives. Right? Let me set the scene. Monday morning. An email from ASQA arrives. It is a notification of a site audit. The scope is defined. They want to see assessment evidence for a sample of learners from the last two intakes. Trainer and

The Core Principle Of Audits

SPEAKER_00 3:35

assessor, credentials and industry currency documentation. Your training and assessment strategies for the qualifications in the sample. Student support and intervention evidence. Your risk register and continuous improvement records. Third party arrangement documentation. And financial viability evidence under clause 4.5. You have a defined notice period before the auditor arrives. The clock is running. Here is the principle I want you to hold for this entire episode. The audit does not test what you can assemble. It tests what was governed while delivery was happening. An auditor is not asking, can you show me evidence? They are asking, was evidence being produced by the system as a byproduct of governance, or are you building it for me right now? That distinction is everything. And the eight critical drivers framework is designed to make the answer obvious. Let me walk you through five phases. The immediate assessment, the evidence triage, the credential verification, the governance pack preparation, and the communication plan. Phase one, the immediate assessment. Monday morning, first two hours. The moment the audit notice arrives, three things happen in this order. Action one, run the evidence gate on your five most critical artifacts. This is driver eight. You know the five questions. Is there a contemporaneous date stamp? Is the risk and regulatory link clear? Is there a named owner? Has it been reviewed within its defined cycle? Is it retrievable within 15 minutes without assistance? Apply the evidence gate right now to five artifacts. Your most recent validation report, your credential register, your AQF issuance log,

Phase One Immediate Assessment

SPEAKER_00 5:41

your continuous improvement register, your risk register. Time yourself on each one. Can you retrieve each artifact in under 15 minutes without calling anyone? If yes, on all five, your evidence architecture is functioning. The audit preparation is a retrieval exercise. You are confirming, not constructing. If any artifact fails the gate, that is your first priority. Not in the sense of creating evidence that does not exist, in the sense of identifying the gap, documenting its current state honestly, and preparing to demonstrate what governance actions are now in progress to close it. Action two, check your assurance economic stack. Three numbers, right now. Your regulatory risk index. Open non-conformances plus high risk findings times two divided by total active training products. If the RRI is above one, you are carrying more regulatory risk than your delivery footprint can absorb. That does not mean the audit will go badly. It means you need to know your exposure position before the auditor asks about it. Your credential compliance rate is at 100% right now, not at the last check, right now. If any trainer currently delivering has a lapsed credential, that is a same-day escalation. The trainer is removed from delivery before the audit, not during it. Your corrective action closure rate, actions closed within deadline divided by total actions raised. If this is below 80%, you have open governance actions that the auditor may identify as evidence that continuous improvement is not functioning as a system. Write down all three numbers. These are your governance baseline going into the audit. Action three, notify your leadership team. The CEO is notified immediately. The compliance manager, training manager, and CFO are notified within two hours. The notification includes the audit scope, the timeline, and the three numbers from the assurance economics stack. No all staff email yet, no panic communication. The leadership team needs to know the scope and the governance position before anyone else

Phase Two Evidence Triage

SPEAKER_00 8:16

is briefed. That is phase one, evidence gate test, assurance economics stack, leadership notification, two hours, phase two, the evidence triage, Monday afternoon through Tuesday. Now you know your governance baseline. Phase two is about systematically verifying the evidence the auditor will request using the drivers as your triage framework. I am going to walk through the audit scope items one by one and show you which driver governs each one and what to check. Triage item one. The auditor will request assessment files for specific learners. For each file they will check four things. Was the correct version of the assessment tool used? Is the assessor judgment documented with sufficient evidence? Is the tool mapped to the units of competency? And is the evidence complete, meaning all required components are present. If you have been running driver 6, the delivery control architecture has version controlled assessment tools with a TAS version currency rate at 100%. Each tool has a version number, issue date, and change log. The assessor judgment is documented in the system, not in a personal folder. If you have been running driver 5, the evidence control architecture means these files are retrievable in under 5 minutes per learner. No searching shared drives, no emailing trainers. Retrieval, not reconstruction. If you have not been running these drivers, here is the triage. Pull the sample the auditor is likely to request. For each learner, verify that the assessment file is complete. If any file is incomplete, document what is missing and why. Do not fabricate evidence. An incomplete file with an honest explanation and a corrective action plan is significantly better than a complete file that was assembled this week. Check version control. Can you confirm which version of the assessment tool applied to each cohort? If you have three versions in the shared drive and cannot tell which applied where, that is a finding waiting to happen. Document the current state. Implement version control now, even if it only covers the current cohort forward. The auditor will note the gap but will also note the corrective action. Triage item two trainer and assessor credentials and industry currency. This is driver two. The credential economic stack gives you the number immediately. Credential compliance rate one hundred percent or not. If you have been running driver two, the capability control architecture has a live credential register with automated expiry alerts, supervision documentation, and industry currency evidence for every active trainer. You pull it, print it, and it is audit ready. If you have not been running driver two, here is the triage. Pull every active trainer's credentials from the source documents, not from the register. From the actual certificates, the actual industry currency evidence, the actual supervision arrangements. Verify each one is current as of today. If any credential has lapsed even by one day, that trainer must be removed from delivery immediately. Do not wait for the audit. Do not hope the auditor does not check that trainer. Remove them now, document the removal and document the remediation plan. An organization that identifies and acts on its own credential breach before the auditor finds it is demonstrating governance. An organization where the auditor discovers it is demonstrating failure. Check supervision arrangements. For any trainer operating under supervision, is the supervision agreement documented? Is the supervising trainer's credential current? Is the supervision log maintained with evidence of oversight? Supervision that is informal and undocumented is not supervision under the standards. Check industry currency. For every trainer, can you demonstrate current industry engagement within the last 12 months? This is not just a certificate of attendance at a conference. It is evidence that the trainer's vocational competency is current and relevant to what they are delivering. If any trainer cannot demonstrate this, flag it and build the evidence now. Triage item three, training and assessment strategies. This is driver six. The TAS is the governance document that justifies your delivery conditions. The auditor will check whether the TAS reflects what is actually happening in delivery. If you have been running driver six, the TAS governance framework ensures every TAS is cohort specific, volume justified, industry referenced, and version controlled. The TAS matches the delivery. The version is current. The industry input is traceable. If you have not been running driver 6, here is the triage. Pull the TAS for every qualification in the audit sample. For each one, ask three questions. Does the TAS reflect the current delivery mode? If you shifted to blended delivery 18 months ago and the TAS still describes face-to-face, that is a gap. Does the TAS reflect the current volume of learning? If delivery hours have changed, the justification must be updated. Is the industry consultation section current and linked to a documented record? If any TAS is out of date, update it now. Date the update honestly. Do not backdate it. An updated TAS with today's date shows that you identified the gap and acted. A TAS with a fabricated date shows that you attempted to conceal the gap. The former is a corrective action. The latter is a governance failure of a different kind, entirely. Triage item four. Validation records. This is driver six and driver eight. The auditor will check your validation schedule, the validation reports, and whether findings were actioned. If you have been running the system, your risk-based validation schedule prioritizes high-risk products. Your validation reports are completed, findings are documented, and corrective actions are closed within 30 days. The validation systemic findings rate is tracked quarterly. The corrective action closure rate is above 90%. If you have not been running the system, here is the triage. Pull your validation schedule for the last 24 months. Were all required validations completed? If any were missed, document which ones and why. Do not conduct a rushed validation in the weeks before the audit and present it as routine. Auditors can see the date. A validation conducted in the month before an audit looks like what it is. More critically, pull every validation finding from the last 24 months. Were the findings actioned? Is there a documented corrective action for each finding? Was the corrective action completed and is there evidence of the completion? If findings were logged but never actioned, that is the single most common compliance failure I see. The organization identified the problem and then continued to operate with it. Under Outcome Standard 4.4, that is not continuous improvement. Document the current status of every open finding. Assign an owner and a deadline to each one. Close what can be closed before the audit. For what cannot be closed, have a documented plan with a realistic timeline. Triage item five, student support and intervention evidence. This is driver three. The auditor will check whether students who experience difficulty receive timely, documented support. If you have been running driver three, the engagement control architecture produces this evidence automatically. The intervention gate was triggered within two business days of every risk flag. Every intervention has a documented plan with six elements trigger, contact attempt, intervention summary, student agreement, named owner, and outcome. The intervention timeliness rate is above 90%. If you have not been running driver 3, here is the triage. Pull the student records for any learner in the audit sample who withdrew, complained, or received an extension. For each one, can you demonstrate that support was provided in a timely and structured way? Remember the documentation rule from episode 27. A note that says called student is not evidence of support. A record that shows the date, the trigger, what was discussed, what was agreed, who owns the follow-up, and what happened next that is evidence of support. If your support evidence is scattered across email, LMS notes, and handwritten records, consolidate it now into a structured format for each student. You cannot change what was documented, but you can organize it so the auditor can see the support that was provided. Triage item 6, risk register and continuous improvement records. This is driver 8. The auditor will check whether you have a functioning risk management system and whether continuous improvement is operational. If you have been running driver 8, the ARC model is intact. Your risk register has numerically scored risks with named owners. Your continuous improvement register has a closure rate above 90%. The evidence currency index shows all controlled artifacts within their review date. If you have not been running driver 8, here is the triage. Open your risk register. Is it current? When was it last reviewed? Are risks scored numerically or described in narrative? Does each risk have a named owner? If the risk register is a static document that has not been reviewed in six months, be honest about that. Update it now with current risks, numeric scoring, and named owners. Date the update honestly. Prepare to explain to the auditor what governance rhythm you are now implementing to keep it current. Open your continuous improvement register. How many open corrective actions are there? How many are overdue? Calculate the closure rate. If it is below 80%, prioritize closing the highest risk overdue actions before the audit. For any that cannot be closed, have a documented status update with a realistic completion date. Triage item 7, third party arrangement documentation. This is driver 4. If you use any third party arrangements for delivery, assessment, or recruitment, the auditor will check that those arrangements are documented, monitored, and governed. Pull every active third party agreement. Is there a formal written agreement in place for each one? Under the compliance requirements, third party arrangements require documented agreements, defined responsibilities, and evidence of monitoring. If any arrangement is operating on a verbal agreement or an unsigned memorandum, formalize it now. Triage item eight Financial Viability Evidence This is Driver seven. Under clause four point five, financial viability must be demonstrable, not just asserted. If you have been running driver seven, the viability control architecture produces this evidence. Gross margin tracked monthly, the thirteen week rolling cash forecast updated weekly, funding concentration ratio monitored against the dependency limit, and scenario modeling reviewed quarterly. The board has approved the runway limit and has visibility of the margin economic stack. If you have not been running driver 7, the auditor may request evidence that financial viability is being actively governed. At minimum, prepare your current gross margin, your current cash position expressed as months of runway, and your funding concentration by stream. If you have board minutes that show financial viability was discussed, have those ready. If you do not, prepare to explain what governance rhythm you are now implementing. That is phase two. Eight triage items, each map to the driver that governs it. Phase three, the credential verification. Wednesday, I am separating this out because it is the single highest risk item in any audit, and I want to be absolutely clear about the protocol. Every trainer and assessor who will be delivering during the audit period or who delivered to the learners in the audit sample must have their credentials verified from source documents before the auditor arrives, not from the register. From the actual certificates. The check covers four elements for each trainer. Qualification credentials. Are they current and do they cover the scope being delivered? Vocational competency is industry currency

Phase Three Credential Verification

SPEAKER_00 23:32

documented within the last 12 months? Supervision arrangements, if applicable. Are they documented with evidence of oversight? And professional development, has the trainer participated in relevant PD within the defined cycle? If any element fails for any trainer, the response depends on the severity. Lapsed credential. The trainer is removed from delivery. Assessments conducted during the lapse are reviewed. CEO notified same day. Board notified within forty eight hours. This is a non-negotiable. It does not matter how close the audit is. A trainer with a lapsed credential continuing to deliver is a governance failure that compounds with every day it continues. Industry currency gap. A professional development plan is created and documented before the audit. Evidence of commencement is produced. This is a correctable gap with a plan, not a fundamental compliance failure. Supervision documentation gap. The supervision arrangement is formalized and documented before the audit. If the supervision has been occurring informally, document it now, with dates, activities and outcomes. Phase four. The governance pack preparation Thursday and Friday. By Thursday, you should be assembling the evidence that demonstrates governance was operating, not just that compliance artifacts exist. If you have been running the eight drivers, this is straightforward. Pull the twenty four metric integrated governance pack from the last three governance meetings. Pull the driver eight assurance economics stack reports. Pull the escalation register showing threshold breaches and their resolution. Pull the board minutes showing the runway limit approval, the exposure limit approval, and the governance agenda test scores. This is the evidence that transforms

Phase Four Governance Pack Prep

SPEAKER_00 25:40

a compliance audit into a governance demonstration. The auditor is not just checking that you have policies and procedures. They are checking that governance was operating. The eight drivers produce the evidence of governance operating. If you have not been running the system, prepare what you have. Board minutes showing financial viability discussion. Meeting records showing compliance issues were discussed. Any threshold or metric that was reviewed at governance level. Any escalation that was formally documented and resolved. This is not as strong as a functioning governance operating system, but it demonstrates governance intent, which is better than governance absence. Phase five, the communication plan. Action one, brief your team. By Wednesday at the latest, your full staff need to know that an audit is occurring. The briefing should cover the scope, the timeline, what the auditor will be looking at, and what each person's role is during the audit. The briefing should not include instructions to create, modify, or backdate any documentation. I should not need to say that, but I am saying it because it happens, and it creates problems that are orders of magnitude worse than any compliance gap. Action two. Brief your trainers individually. Every trainer

Phase Five Communication Plan

SPEAKER_00 27:14

in the audit sample scope needs a one-on-one conversation. Do they know which learners may be sampled? Are their assessment files complete and accessible? Is their credential documentation current and retrievable? Do they know how to respond if the auditor asks them a question? The answer to that last one is honestly, factually, and without volunteering information that was not asked for. Action three. Prepare your governing persons. If the auditor requests to speak with governing persons and under the 2025 standards they may well do so, your governing persons need to be able to describe the governance system. Not recite policy numbers, describe how the system works, what metrics do they see, what thresholds are defined? What happens when a threshold is breached? If they can describe the eight drivers framework, the 24 metric pack, and the exposure limit, they are demonstrating active oversight. If they cannot, that is a gap that cannot be closed in the days before an audit. It can only be closed by running the system. Now, let me talk about what this looks like when the system was running versus when it was not. When the eight drivers were operational before the audit notice arrived, the response looks like this. Monday morning, evidence gate confirms all five critical artifacts are retrievable. Assurance economic stack is already calculated, RRI is below 0.5, credentials are at 100%, closure rate is above ninety percent. Tuesday, the eight triage items are verification exercises, not construction projects. Each one takes 30 minutes to confirm, not three days to assemble.

System Running Versus Rebuilding

SPEAKER_00 29:19

Wednesday, credential verification from source documents confirms what the live register already showed. Thursday, the governance pack is pulled from the existing reporting system. Friday, the team is briefed calmly and the governing persons can describe the system because they have been seeing it operate for months. When the system was not running, the same notice triggers a week of reconstruction. Evidence is assembled from scattered sources. Credentials are checked for the first time in months. TAS documents are updated under time pressure. Validation findings are actioned retrospectively. The risk register is refreshed, the improvement register is populated, and the team is briefed with barely concealed anxiety. Same audit. Completely different governance experience. The eight drivers do not eliminate audit risk. They eliminate audit surprise. When the system is running, the auditor is testing governance that was already operating. When it is not, the auditor is testing governance that was assembled for their arrival. Auditors can tell the difference. So here is your action step for this week. Two things. Action one, run an internal audit simulation right now. Do not wait for an audit notice. Pick five governance questions at random, one from each of five different drivers. For each one, attempt to retrieve the relevant evidence in under 15 minutes without assistance. Time yourself. Score yourself. Any failure is a current governance gap. Here are five questions to start with. Can you retrieve the complete assessment evidence file for a specific learner from two intakes ago, including tool version and assessor judgment? Can you confirm that every trainer currently delivering has a current credential? Verified from the source document,

Action Steps And Book Pre-Order

SPEAKER_00 31:26

not the register? Can you produce your validation schedule for the last 24 months and show that every finding has been actioned? Can you state your current cash runway in months without opening a spreadsheet? Can you show a governing person the 24 metric integrated governance pack from the last governance meeting? Five questions. 15 minutes each. Score yourself out of five. That score is your audit readiness position. Action two. Check your corrective action closure rate right now. How many corrective actions are currently open? How many are overdue? If the closure rate is below 80%, you have open governance risk that an auditor will identify. Start closing the highest risk overdue items this week. And if you want the complete audit readiness framework, the evidence gate methodology, the internal audit simulation guide, the triage protocols for every audit scope item, and the full ARC model, the book gives you everything. Preorder the eight critical drivers to RTO Success at eight-critical dash drivers-book.vivacity.com dot AU. It releases in July. Next week in episode thirty six, we are walking through another scenario. Your most experienced trainer has just resigned and taken half your delivery capacity with them. I will show you the key person limit response protocol, the immediate credential coverage assessment, the student communication plan, and the financial impact modeling. And I will show you the difference between an organization that had succession built into the system and one that is starting from scratch. That is next week. For now, go run the internal audit simulation. Go check your closure rate. And go make sure you could survive the Monday morning email. I will see you next week. You have been listening to the RTO superhero podcast with Angela Connell Richards. If this episode was useful, share it with another RTO leader who needs to hear it. Pre order the book at 8 2.vervacity.com dot AU. Or find us at vivacity.com.au and complyhub.ai.