We are currently experiencing an outage affecting the asqanet portal. We are working to restore access as a priority. We apologise for any inconvenience and will provide further information when the service is available again.

Last updated
29 October 2026

On this page

Standard 4.3

Any risks to VET students, staff and the organisation itself are identified and managed.

Performance indicators

An NVR registered training organisation demonstrates:

  1. it identifies, manages and reviews risks to VET students, staff and the organisation;
  2. how the financial position, financial performance and cashflows of the organisation are managed, monitored and understood by governing persons; 

Note: In accordance with section 24 of the Act, NVR registered training organisations must also comply with the Financial Viability Risk Assessment Requirements made under section 158 of the Act.

  1. it has a system for identifying, managing and disclosing any real or apparent conflicts of interest; and
  2. Where it offers training or assessment to VET students aged under 18 - risks to their safety and wellbeing associated with the organisation's delivery of the training or assessment are identified and managed:
    1. by having regard to the training content and modes of delivery; and
    2. in accordance with the National Principals for Child Safe Organisations, as in force from time to time.

Note: Section 191A of the Act permits this instrument to make provision in relation to a matter by applying, adopting or incorporating any matter contained in another instrument or other writing as in force or existing from time to time.

  • You can demonstrate that you have systems in place to identify risks to students, staff, your organisation, and your continued compliance with the Standards. 

  • You can demonstrate that you have processes in place to identify or plan for emerging risks, or disruptions, such as those relating to artificial intelligence (AI), and document these in your risk register, with clear review dates and references to where those risks apply (for example, training delivery, assessment processes, student support or data handling). 

  • You can demonstrate how you have determined appropriate risk mitigation strategies for identified risks and implemented them. 

  • You can explain how the design of your risk management system has considered the context within which you operate and the risks that are most relevant to your RTO and students. 

  • You can show how risk management is informed by strategic planning, environment scanning, relevant data and feedback from students, staff and regulators. 

  • You have documented systems and strategies in place to anticipate, identify and treat financial risks, to ensure stability of your RTO’s financial position. 

  • You can demonstrate that there is a sufficient level of financial acumen amongst your governing persons. 

  • You can demonstrate how governing persons are involved in reviewing the financial plan and are regularly informed about the financial position and forecasts of the RTO, including how the position impacts the delivery of training and assessment in accordance with the Standards. 

  • You can demonstrate that you have a business continuity plan which is reviewed regularly. 

  • You have a documented conflict of interest policy and procedure which makes clear the process to identify and respond to conflicts, as well as details of how a disclosure of conflict can be made. You have an active process for managing actual, potential or perceived conflicts of interest. 

  • You promote a culture of disclosure and ensure that governing persons have access to contemporary information about the appropriate management of conflicts of interest. 

  • Where you offer training or assessment to students aged under 18, you: 

    • have procedures in place to monitor and address risks to their safety and wellbeing, which are specific to this cohort 

    • ensure all relevant employees, and third parties, who are delivering to students under 18 years, are cleared to work with children 

    • demonstrate how your approach is consistent with the National Principles for Child Safe Organisations – for example through your child safety and wellbeing policy, child safe code of conduct or a charter of commitment to the safety and wellbeing of young people. 

  • You regularly review your risk management approach and tools and have these reviews externally validated periodically as risk profiles change. 

  • Solely relying on purchased risk management systems without tailoring them to be reflective of your actual operational environment, student cohort and contemporary risks.
  • Insufficient financial planning or management of financial risks.
  • Failure to review and assess the potential impact of ASQA’s regulatory risk priorities in the context of your operations. These are sector-wide risks that have the potential to impact the VET sector’s reputation, integrity, market health or student outcomes.
  • Failing to appropriately risk-assess AI used for training, assessment, student support or other purposes.  
  • Aiming for technical compliance rather than actively managing risks to the outcomes intended by the Standards.
  • Failing to effectively monitor conflicts of interest, including third party conflicts of interest, which undermines quality and integrity of operations.
  • Not properly securing and protecting personal information and sensitive information, in line with privacy legislation and cybersecurity principles. 

 

Self-assurance questions

  1. What informs your understanding of the key risks to your RTO’s quality and integrity, students and your continued compliance with the Standards?
  2. Do you have risk controls for AI-enabled systems or tools and appropriate data governance when AI is used?
  3. How do you inform students about how AI is used in training, assessment, support and other activities, including how data is protected and what alternatives are available?
  4. How do you know that your approach to risk identification and mitigation is effective and adequate?
  5. How do you monitor the RTO’s financial position and ensure governing persons are aware of (and managing) financial risks?
  6. How do you ensure staff and third parties are aware of the types of conflicts of interest that need to be disclosed and how these are to be documented and managed?
  7. If you deliver to VET students under the age of 18, what practices do you have in place to embed the principles of child safe organisations? 

Case study

Managing emerging workforce risks

VVV Training Pty Ltd (VVV) is a medium-sized training provider delivering business, aged care and hospitality qualifications across two campuses and through online learning. To ensure risks are appropriately managed, VVV has implemented a risk management framework that helps them identify, manage and review risks affecting students, employers, staff and the organisation.

Each quarter, VVV’s executive team reviews the organisation’s risk register, which includes risks related to training and assessment quality, student wellbeing, artificial intelligence, workforce capability, cyber security, financial viability and third-party providers. Risks are assigned owners, rated according to their likelihood and consequence, and supported by documented treatment plans, timelines and review dates. Risk information is also informed by staff, student and employer feedback, complaints data, assessment validation outcomes, internal audit findings and regulatory updates.

During a recent review, VVV identified an increasing risk of trainer shortages in aged care programs due to workforce demand across the sector. To mitigate this risk, VVV developed a workforce succession plan, established a pool of qualified casual trainers and assessors, implemented mentoring arrangements for emerging trainers and increased professional development opportunities for existing staff. VVV also established partnerships with local industry employers to support future recruitment opportunities. These actions helped ensure continuity of training delivery and assessment services, reduced the likelihood of cancelled classes and protected student progression and completion outcomes, as well as VVV’s ongoing financial viability.

  1. In assessing financial viability under governance, what indicators signal that a provider is proactively managing risk rather than reacting to it? 

    We look for evidence that a provider actively identifies, monitors and manages financial risks before they impact operations. Indicators of a proactive approach include regular monitoring of financial performance, budgeting and cash flow forecasting, documented financial risks and mitigation strategies, active oversight by governing persons, and timely action in response to emerging risks. The key consideration is whether the provider can demonstrate ongoing financial oversight, informed decision-making and effective risk management, rather than responding to issues only after they arise. 

     

  2. How should Enterprise RTOs meet the Standard relating to financial position, financial performance and cashflows when all we receive is a budget to work with from our corporate entity?  

    As a condition of registration, providers must maintain their financial viability at all times. The governing persons of the RTO have a responsibility to ensure the provider maintains an acceptable financial position and cashflows. 

     

  3. The 2025 Standards now require providers to have a system for identifying, managing and disclosing any real or apparent conflicts of interest. Does this need to be shared with ASQA or just maintained for compliance and auditing?

    ASQA may request information on your RTOs conflict of interest disclosures and management at any time. If you identify an event that would significantly affect the organisation’s ability to comply with any of its obligations under the Act, including an issue arising from a conflict of interest, you must notify ASQA. This is a requirement under the Compliance Requirements.

     

  4. In respect of the conflicts of interest, who do we contact to gain more clarification on whether an action could be considered a conflict of interest?  

    The 2025 Standards require providers to identify, manage and disclose any real or apparent conflicts of interest. This is to preserve the integrity of your RTO’s decisions and reduce the risk of fraudulent activities and corruption by ensuring accountability for the RTO’s operations. There are publicly available resources for businesses on managing conflicts of interest that may assist in building the governance systems of your RTO, for example see www.business.gov.au.  

     

  5. How should providers implement the National Child Safe Standards? What would ASQA be looking for?  

    Standard 4.3 requires providers to demonstrate that where training and assessment is offered to students aged under 18, risks to their safety and wellbeing associated with the organisation’s delivery of the training or assessment are identified and managed in accordance with the National Principles for Child Safe Organisations. In a regulatory activity, ASQA would be looking to ensure your organisation has regard to all legislative and regulatory obligations, including the National Principles for Child Safe Organisations, and can demonstrate how risks to students under the age of 18 are actively identified and managed.