Vocational Education and Training (VET) in Australia is a large and complex sector. That brings a wide range of risks, from marketing conduct to assessment integrity. Too many for any regulator to address at once. That’s why each year the Australian Skills Quality Authority (ASQA) conduct an environmental scan to work out where their priorities lie. The latest set, released for 2026-27, gives RTOs a clear steer on where to focus their own risk management.
In this article, we explore:
- What ASQA risk priorities mean
- How the regulator determines which risks take priority
- The latest risks that ASQA have identified and how they connect
- How Registered Training Organisations (RTOs) can align their strategies with the risks
What Are ASQA Risk Priorities?
Risk priorities, also known as regulatory risk priorities, are the areas ASQA have identified as posing the greatest risk to the VET sector’s reputation, integrity, market health, or student outcomes. They show where the regulator will concentrate its efforts each year. That might mean education campaigns, closer monitoring, audits, or action against non-compliant providers.
New risk priorities are released annually, though the focus areas often overlap with previous years. For example, the risk priorities in 2024-25 and 2025-26 were largely the same, with only ‘online delivery’ being removed as a standalone risk to the sector. In the same way, training delivery for international students has been listed as a risk priority since the first set was published in 2021.
How Does ASQA Set Regulatory Risk Priorities?
ASQA conduct extensive research and gather data from various sources to establish the risk priorities they will focus on in a given year. This is what they refer to as an environmental scan, or e-scan. It includes surveys, interviews, and consultations with providers, industry and sector peak bodies, and state and territory governments. This helps them identify patterns of challenges, behaviours, and concerns. These are compiled into themes, often covering multiple topics.
ASQA Risk Priorities in 2026-27
Provider Governance, Market Conduct, and Non-Genuine Operations
A lack of clear or transparent governance processes makes poor practice harder to detect. That can show up in recruitment, delivery, assessment, and student protection.
This isn’t always intentional. VET is a competitive sector, and it’s under real financial pressure. This means without careful oversight, RTO marketing and recruitment can drift into misleading or pressuring tactics. It also means students struggle to make informed choices as a result. Third-party arrangements carry a similar risk, where contract terms and partner oversight need close monitoring.
And then there are providers who never intended to deliver real training. They look compliant on paper, backed by fabricated records and overstated capability. Some are operators whose RTOs were cancelled, re-emerging under a new business identity. Others use proxy owners or infiltrate legitimate RTOs.
Top Tip. Compare your advertised course claims against what students actually receive. Gaps between the two are where marketing risk usually starts. Check duration, support, delivery mode, and stated outcomes.
Quality, Sufficiency, and Fitness-For-Purpose of Training Delivery
When students don’t get enough time, support, or contextualised learning, they don’t develop real competence.
Short training durations are a key concern, particularly where they fall below the volume of learning for the qualification. Delivery built around assessment rather than learning is another risk. Both leave little room for supervised practice, feedback, or consolidation. Similar risks apply when practical or safety-critical units are delivered online only, or when materials are generic rather than targeted to an area of study. Students learn the steps, but never practise them in a relevant context.
Gaps in cultural safety and culturally appropriate training also affect learning outcomes, particularly for First Nations learners. So do gaps in learners’ readiness when they enrol. Without pre-training assessments, which should include Language, Literacy, Numeracy, and Digital literacy (LLND), providers can’t understand where these gaps lie, and where support is needed. Training continues as normal, even for students who don’t have the level of LLND required for the program. This makes them more likely to disengage, progress unevenly, or finish without the skills they came for.
Top Tip. Where your delivery duration sits below the indicative volume of learning, record the reasoning in your Training and Assessment Strategy. This helps prove due diligence during an audit.
Integrity of Qualifications and Competency Outcomes
Non-genuine assessment evidence has a knock-on effect that reaches well beyond an RTO. Qualifications no longer prove independently demonstrated competence, and students and employers lose trust in them.
What Does Non-Genuine Evidence Look Like?
Explore the Rules of Evidence and what assessors should look for when making judgements.
Some of the biggest risks that ASQA raise are around facilitated cheating, falsified records, and competency decisions that aren’t supported by evidence. AI tools contribute significantly towards this challenge, making it easier to generate, alter, or reproduce evidence at scale. These tools can also weaken assessment processes in less deliberate ways, such as using AI marking to make judgements without assessors reviewing and approving them.
These risks are often clearest in Recognition of Prior Learning (RPL) and workplace assessments. Both rely heavily on indirect and third-party evidence, which is easier to fabricate and harder to validate than an assessor’s direct observation. For example, if a workplace manager submits an unclear audio recording as evidence, but leaves the company shortly thereafter, it can be difficult to validate what occurred during the assessment. ASQA also highlight the risk of RPL pathways being misused and run at industrial scale, with little genuine assessment behind them.
Top Tip. Pull a sample of recent RPL and workplace assessment decisions, and trace the evidence behind them. Where a decision rests on someone’s word alone, that’s where integrity risk sits.
Transparency, Accountability, and Assurance in Complex and International Delivery Models
Over the past few years, VET providers have had to rethink how they reach international learners. Tighter visa settings have made onshore growth harder. Providers that offer English Language Intensive Courses for Overseas Students (ELICOS) face the same challenges. This has resulted in many training organisations adjusting their strategies to deliver training offshore through local partners.
Partnerships aren’t only growing in international delivery. Trainer and assessor shortages also push providers to bring in outside subject matter experts. When managed well, these arrangements add real value. For example, an expert working in the field brings specific and current practice into the classroom that trainers may lack. But expansion can outpace the oversight built to support it, and responsibility doesn’t shift with delivery. Providers remain accountable for their partners and contractors, wherever training happens.
When a partner delivers training or assessment, that means relying on external staff, records, and judgement. Risks rise where arrangements lack proper due diligence and active monitoring. Heavy reliance on agents, brokers, and third parties across recruitment and RPL stretches oversight further. For example, a broker may gather evidence, an employer may sign it off, but your assessor may never meet the applicant to confirm or validate it. Offshore activity can also go undisclosed or misrepresented. Even where it isn’t, arrangements can appear transparent on paper while oversight stays weak in practice.
Top Tip. Don’t rely on contract terms alone. Contracts describe intent, not what happens week to week. Actively monitor partners’ delivery to ensure it aligns with what the contracts detail.
How These Risk Priorities Work Together
While ASQA have split their risk priorities into four categories, they are deeply interconnected. Instead of describing four unique problems that can be addressed in isolation, the four risks are consequences of the same pressures and challenges.
- Governance. An RTO’s oversight and conduct are central to managing and mitigating risks. Poor governance, even in well-meaning providers, makes problems with training and assessment more likely and harder to spot.
- Third Parties. Whether they’re helping with recruitment, delivering training, or conducting assessments, third-party contracts need to be carefully managed. Without transparency and careful oversight, it becomes ever more difficult to ensure quality and effective training and assessment that legitimately proves competence.
- Distance. The further training, assessment, and evidence collection happen from an RTO and their staff, the harder they are to verify. This isn’t only physical distance, as is the case with offshore training and assessment, but distance from direct observation. An assessor watching a student demonstrate a skill is the ideal. Every additional party between that observation and the competency decision makes the assessment validation more difficult.
How Can RTOs Align Their Strategies with ASQA’s Annual Risk Priorities?
ASQA’s regulatory risk priorities change each year, but the way you respond to them doesn’t have to. Following these best practices will help you prioritise compliance and mitigate risks no matter what ASQA focuses on in a given year.
Understand the Priorities and the Reasoning Behind Them
Read the published priorities, not just the summaries. ASQA explain why each area was flagged, and that reasoning tells you what evidence they’ll expect to see. It also helps you recognise the same risks in your own operations. Keep an eye on ASQA’s wider updates too, since priorities rarely appear without warning.
Determine How Each Priority Applies to You
Priorities are often broad, covering several related areas. If you don’t deliver training offshore, that element won’t apply to you. However, if you use partners for recruitment, training delivery, or conducting assessments, other areas of the same risk priority will still apply. Work out which parts are relevant to your scope, delivery modes, and student cohorts. Then add any internal risks ASQA haven’t flagged. Their list is a starting point, not a limit.
Build the Priorities into Self-Assurance and Governance
Someone in your organisation should be responsible for prioritising risk management. Their role is to monitor performance against both the Standards for RTOs 2025 and the current priorities. Make it a standing agenda item rather than an annual scramble. Ongoing review and internal quality assurance is what turns a list of risks into something you actually manage.
Monitor the Flagged Areas
Focus your monitoring where ASQA have said they’re looking. Those areas are the most likely to be examined if you’re assessed. Student data works well as an early warning system, so track completions, withdrawals, feedback, and complaints. Good records also show you’re actively addressing the priorities, rather than just aware of them.
Ensure Your People and Partners Meet Requirements
Audit your training team against trainer and assessor requirements. This is about more than just compliance. It also supports stronger outcomes. Capable trainers produce work-ready graduates. Applying the same checks to third parties and partners will help you verify their delivery and assessment processes.
Maintain Evidence of Decision-Making
Keep clear records of adjustments and your decision-making processes. These should cover why decisions were made, what changed, and their outcomes. Reasoning matters as much as the result, because it shows careful consideration. Good records also make audit preparation less frustrating. Most importantly, they demonstrate genuine and continuous improvement.
Previous ASQA Regulatory Risk Priorities
These areas featured in ASQA’s risk priorities in previous years. Many remain relevant. Some now sit inside the four broader themes identified for 2026-27. Others are no longer named, but the underlying risks haven’t gone away.
- Non-Genuine Providers and Bad Faith Operators. Providers deliberately exploiting the VET system through fraudulent qualifications, funding fraud, and phoenixing.
- Marketing, Recruitment, and Delivery of International Education. Misleading marketing, unregulated education agents, and providers moving parts of delivery offshore to stay viable.
- Academic Integrity. Academic cheating, contract cheating services, and providers enabling dishonesty among students and staff.
- Recognition of Prior Learning. Unethical RPL marketing, inadequate assessment, and high-volume operations issuing qualifications without verifying competence.
- Shortened Course Duration. Training delivered in less time than the training package or qualification level indicates, often by stripping out learning and leaving only assessment.
- Student Work Placement. Enrolling more students than there were placements for, shifting responsibility for finding placements onto students, and falsifying placement records.
- Online Delivery. Risks to learning support and student wellbeing, along with courses that let students bypass learning and go straight to assessment.
- VET Workforce Capability. Trainer and assessor shortages that affected both training quality and compliance. These also compounded other risks.
- Governance Through Change. Providers whose governance maturity left them struggling to keep pace with sector reform, including failures to declare Fit and Proper Persons or notify material changes.
- Aged Care and Disability Support Training. Assessment practices and short-duration training in aged care and disability support qualifications, where demand was rising sharply. Industry-specific targeting no longer appears among the named priorities.
- Economic Factors. Funding growth and third-party arrangements. Linked funding risk to changes in funding programs, delivery costs, and data reporting.
- Specified Training Products with Risk Exposure. Named qualifications identified as higher risk, based on assessment outcomes, complaint reports, and market growth.
- Self-Assurance. Developing tools and approaches to help providers self-assure and continuously improve, rather than a risk in itself. Self-assurance is now embedded in the Standards for RTOs 2025.
- VET in Schools. Strategic review actions, stakeholder engagement on shared risk, and better guidance for providers delivering VET to school students.
How Does Cloud Assess Address ASQA Risk Priorities?
Most of what ASQA look for comes down to evidence. Not just that a decision was made, but that it was properly supported, made by someone qualified to make it, and recorded well enough to hold up during an audit.
Cloud Assess is built around these concepts. The platform not only supports blended training delivery and assessment, but it helps RTOs manage their processes in ways that support clear governance and compliance. Some features that showcase this include:
- A full audit trail. Every action against every record is logged and visible, so governance decisions can be traced back rather than reconstructed.
- Version control on assessments. Only approved versions are available to use, which stops outdated or non-compliant tools reaching learners.
- Centralised document control. Keep contracts, agreements, and partner documentation in one place, so everyone works from the current version rather than a local copy.
- Assessment mapping. See how each assessment satisfies unit requirements, which is the practical test of whether a tool is fit for purpose.
- Verified evidence, tied to the learner record. Photos, video, and audio can be captured by learners, assessors, or third parties, with geo-location on submission and digital signatures. Everything attaches to the learner record, so evidence stays traceable to who collected it and when.
- AI marking support. Student responses are analysed against marking criteria, supporting assessors towards consistent decisions rather than replacing their judgement.
- Internal verification sampling. Set your own sample rates to flag records for second-level review before results are finalised.
- Secure third-party access. Workplace supervisors and partners contribute inside the system, so partner-delivered training stays visible to you.
Ready to see the difference that Cloud Assess can make in your training organisation? Request a demo with our sales team today.
Registered Training Organisations
Frequently Asked Questions (FAQs)
FAQs About ASQA Risk Priorities
Do ASQA risk priorities apply to training providers regulated by VRQA and TAC?
Not directly. ASQA’s risk priorities guide ASQA’s own regulatory effort, and providers in Victoria and Western Australia answer to different regulators. These are the Victorian Registration and Quality Authority (VRQA) in Victoria or the Training Accreditation Council (TAC) in Western Australia. The underlying risks still apply, though, and all RTOs are held to the Standards for RTOs 2025 regardless of who regulates them.
When are ASQA risk priorities released?
Annually, around the start of the financial year in July. The 2026-27 priorities were published in July 2026.
Does being in a priority area mean my RTO will be audited?
No. Risk priorities show where ASQA will concentrate its efforts, and that effort takes many forms. It might mean education campaigns, sector guidance, closer monitoring, or a performance assessment. Being active in a priority area doesn’t make an audit inevitable, and a compliant RTO in a priority area isn’t at risk simply for operating there.
Are ASQA risk priorities part of the Standards for RTOs 2025?
No. The Standards for RTOs 2025 set out your compliance obligations. The risk priorities indicate where ASQA will look most closely. Nothing in the priorities adds a new obligation, but they do signal which existing obligations are likely to receive the most scrutiny.
Are risk priorities the same as regulatory risk priorities?
Yes. ASQA’s published documents in previous years were titled regulatory risk priorities, and the abbreviation RRP is sometimes used. ASQA’s website navigation has since shortened this to risk priorities. Both terms remain in use.
Why do ASQA's risk priorities change each year?
Because the risks change. ASQA run an annual environmental scan to identify what’s most pressing across the VET and ELICOS sectors, then adjusts the priorities accordingly. Before 2021-22, ASQA published a multi-year Regulatory Strategy instead. The annual cycle allows for a faster response to emerging risks.
Why did ASQA move from six risk priorities to four?
The four themes group related risks rather than listing them separately. ASQA describe them as deeply interconnected, reflecting how risks interact in practice rather than occurring in isolation. Fewer priorities doesn’t mean fewer risks. Most of the previous six now sit inside the four broader themes.
What happened to risks like academic integrity and RPL under the new themes?
Both now sit within integrity of qualifications and competency outcomes. Academic cheating, falsified records, and the misuse of RPL are all named focus areas within that theme. Consolidation doesn’t reduce regulatory attention, and ASQA specifically flag RPL being run at industrial scale.
