Fact sheet: Records Management

Records management principles

A record is information created, received or maintained as evidence of an activity, decision or business transaction. Records may be in paper or electronic form and can include documents, images, emails, databases, audio recordings and other information assets.

Records management is the systematic control of records throughout their lifecycle, from creation or receipt through to retention and authorised disposal. Effective records management helps ensure information remains accurate, secure, accessible and reliable.

RTOs should store records securely and protect them from unauthorised access, loss, damage or destruction. Records may be retained in hard copy, electronic format or both, provided they remain accessible for the required retention period and can be retrieved for the Training Accreditation Council’s (TAC) audit purposes. Student information should not be disclosed to a third party without the student's consent, unless authorised or required by law. Records management procedures should also ensure students can access their own records when requested. Table 1 below provides a checklist of what an RTO should consider when establishing a records management system.

Table 1. Checklist for establishing a records management system

RTOs can support effective record keeping by developing and maintaining a Records Management Plan that outlines how records will be created, managed, protected, retained and disposed of. The State Records Office of Western Australia provides resources and templates that may assist organisations in developing records management processes and plans.

Legislative and regulatory frameworks

Depending on legal status and operations, RTOs may have obligations under Commonwealth or State privacy, freedom of information and records legislation. RTOs should identify the legislation that applies to their organisation, their operations, and the jurisdictions in which they operate. 

Relevant legislation may include the Commonwealth Privacy Act 1988, applicable State or Territory privacy and freedom of information legislation, and records legislation applying to public sector organisations. In WA, the public sector may also have obligations under the WA Privacy and Responsible Information Sharing Act 2024.

Like many organisations, RTOs have record keeping obligations enforced by additional legislation and regulations. The nature of those obligations is dependent on many factors including:

• the industry area in which the RTO operates;
• whether it is a public or private organisation;
• whether the RTO is a ‘for profit’ or ‘not for profit’ organisation; and
• an RTO’s client group. 

Generally, each RTO will need to consider this hierarchy to establish their obligations:

1. Legislation
2.  Regulation
3. Regulatory body guidelines and instructions
4. Funding body or contractual requirements 
5. RTO’s own policy and procedure requirements.

For each level of obligation, the RTO will need to consider:

• What is relevant to my RTO?
• What specific records is my RTO required to keep?

An RTO’s policies and procedures should identify what additional records are created and managed to satisfy record keeping obligations.

Retention and record-keeping obligations

Retention periods at a glance

The retention guidance referred to in this Fact Sheet  summarised below. Legislation or funding contracts may require some records to be kept for longer. Table 2 summarises key requirements under the Compliance Standards and Outcome Standards that expressly require records to be created or that are particularly relevant to records management.

Table 2.  Key records retention requirements 

Key obligations under the Registration Standards 2025

As a condition of registration, RTOs must cooperate with the TAC to the extent necessary for TAC to perform its functions (Regulation 13(2)(f) of the Vocational Education and Training (General) Regulations 2009. RTOs must also operate in accordance with the Registration Standards 2025 (2025 Standards). Having effective systems for retaining, archiving, retrieving and transferring records assist RTOs to meet both obligations.

RTOs should also refer the RTO Reporting Requirements page on the TAC website for further information about retention and reporting of data.

The 2025 Standards are outcomes-focused. While a small number of requirements specifically require RTOs to create or retain particular records (listed in Table 3), most outcomes do not prescribe what records must be kept. Instead, each RTO determines the records it needs to create and retain to demonstrate achievement of the relevant outcomes. Examples of records that may support this are provided in Table 4.

Table 3: Records components of the Compliance Requirements and Outcome Standards

Specific record retention considerations

Assessment Validation

The assessment records retained under Compliance Requirement 10 (see Retention of Student Assessments) also support validation. To show how each judgement was made, records should include both the student's evidence and the assessor's record of the decision. Depending on the assessment method, this may include submitted assessments, photos or videos, observation records, completed marking guides, workplace evidence, workplace supervisor or third-party reports, records of reasonable adjustments and feedback provided to the student. RTOs must retain records of all assessments submitted by a VET student for two years after the student completes the training product.

Outcome Standard 1.5 requires RTOs to use a risk-based approach to decide which parts of the assessment system to validate and the sample size. RTOs should keep records of how these decisions were made, who undertook the validation and their credentials, what was found, and what changes were made as a result.

Appeals

RTOs should retain sufficient records including evidence of assessment decisions, for the duration of the RTO’s appeals period, including extending beyond the minimum two-year retention period when required to support the investigation and resolution of complaints or appeals. Retaining assessment evidence may also assist validation activities, internal quality assurance processes, and audits conducted by TAC, funding bodies or other regulators.

Records for audit 

RTOs are required to participate in audit processes and will need to provide records that demonstrate they are complying with the 2025 Standards. Where records are stored off site, arrangements should be made in advance to ensure auditors can access them during the audit process.

As a guide, TAC recommends that documents (other than those listed in Table 3) which may be requested during an audit, are retained for at least seven years, unless a longer retention period applies under legislation or other regulatory requirements. These documents may include the following: 

• Training and assessment records such as attendance records, assessment records, training record books, RPL and credit transfer decisions and assessment validation records.
• Training delivery and governance records, including training and assessment strategies, policies and procedures, student handbooks, and records of continuous improvement activities.
• Student and stakeholder engagement records, including complaints, appeals, student surveys, feedback and actions arising from feedback.
• Quality assurance and compliance records, including audit reports, corrective actions, validation records and evidence of compliance activities.
• Data and reporting records, including data for the National VET Provider Collection (AVETMISS), Quality Indicator data collected under the Data Provisions Requirements and VET Data Policy, reports submitted to TAC, and any actions arising from the analysis of this data.
• Where public funding has been received, financial and funding records, including records relating to funding agreements, enrolments, assessment delivery and expenditure.
• Marketing and promotional materials used to inform prospective students and other stakeholders.

Managing records following RTO closure

Section 6 of the national VET Data Policy requires RTOs to submit up-to-date data for the National VET Provider Collection (AVETMISS) for the time up to the date its registration ceases, and must notify the TAC that this has occurred.

In addition, Regulation 27 of the of the Vocational Education and Training (General) Regulations 2009 requires an RTO provide the TAC with student records within 28 days of a cancellation decision taking effect. 

Records that support compliance

A useful test for any record is whether it serves a clear purpose in supporting the RTO’s operations, decision making, student outcomes or continuous improvement. Records should demonstrate what happened, why decisions were made, and how the RTO meets its legal, regulatory or contractual obligations. Table 4 provides examples of records that may help demonstrate compliance with the 2025 Standards.

Table 4: Examples of records that may support compliance