Keeping Oversight of Third-Party Providers: A Practical Guide to Outcome Standard 4.2 Compliance

Third-party arrangements are among the most persistent sources of compliance risk in the sector, not because third parties are inherently problematic, but because RTOs treat signing the agreement as the end of the obligation rather than its beginning. Outcome Standard 4.2 requires a system for ensuring ongoing compliance throughout the engagement, and the definition of the services that trigger it is broader than most providers recognise, reaching marketing, enrolment, induction and fee collection as well as training and assessment. This article sets out what counts as a third-party service, how to maintain oversight after the agreement is signed, and what it means for RTOs, compliance teams, education agents and the students who deal with someone other than the RTO itself.

After the Agreement Is Signed

Third-party providers are one of the most persistent sources of compliance risk in VET, not because third parties are inherently problematic, but because RTOs frequently treat the execution of a third-party arrangement document as the end of the compliance obligation rather than its beginning. Questions raised at a recent ASQA webinar reflected this: what should RTOs be doing to keep oversight of third-party providers, what needs to be registered as a third-party service, and what constitutes recruitment of prospective learners. An earlier article in this series addressed when an arrangement is required and what minimum content it must contain. This article addresses what happens after the agreement is signed: how an RTO maintains ongoing oversight, which activities count as third-party services and so trigger the Outcome Standard 4.2 framework, and what a compliance team can put in place to ensure its third-party management will withstand audit. The governing point is simple: executing an arrangement document is the beginning of the obligation, not its end, because the Standard requires a system for ongoing compliance throughout the engagement, not a contract filed at commencement and forgotten.

1. What Counts as a Third-Party Service

A third party, under the 2025 framework, is broadly any person who has an arrangement with the RTO to deliver services, subject to specific exclusions. The breadth that surprises providers is in the word "services," which covers three categories: training and assessment; training support services, but not counselling, mediation, or information and communication technology services; and any activities related to the recruitment of VET students, including marketing, enrolment, induction, or the collection of fees. The breadth of "services" directly determines which arrangements trigger the framework.

Training and assessment is the most obvious category and the one most consistently managed. A contractor trainer, a subcontracted RTO delivering on the principal's behalf, a workplace delivering work-based components under an agreement, or an organisation facilitating specific learning activities are all delivering training and assessment, and most compliance teams already apply the framework to them. Training support services are managed less uniformly. They surround training delivery without constituting it: external mentoring and coaching, language, literacy and numeracy support from a specialist provider, welfare and pastoral care relating to a student's training participation, library and learning-resource services, and industry-placement coordination. Each of these, where delivered by an entity other than an RTO employee under an arrangement, is a third-party service. The ICT exclusion clarifies that a vendor providing the learning management platform or video-conferencing tools is not delivering a training support service, even though students use those tools.

Recruitment-related activity is the most frequently overlooked category, because it captures arrangements many RTOs have not historically treated as requiring an agreement. Any arrangement under which an external party markets the RTO's training products, processes enrolments or applications, conducts student induction, or collects fees on the RTO's behalf is delivering recruitment-related services. This captures education agents and brokers, marketing agencies with direct student-facing roles, third-party enrolment platforms, pathway partners who select and induct students, and employers who market the RTO's training to their workforce as part of a commercial arrangement.

2. What Constitutes Recruitment of Prospective Learners

The webinar asked specifically what constitutes recruitment, because this category captures arrangements that often escape attention. The instrument gives four examples, each worth attention. Marketing as a recruitment activity means student-facing promotional work, not general brand advertising: a design agency producing brochures is providing a behind-the-scenes creative service, but an education agent who presents the RTO's products to prospective students, advises on which qualification to choose, and facilitates their application is engaged in student-facing marketing and enrolment. The line is between production work and direct engagement with prospective students in the service of driving enrolment.

Enrolment means processing applications, managing enrolment paperwork, collecting documentation, verifying eligibility, and confirming a student's place. A pathway partner who collects application forms, assesses suitability and forwards confirmed enrolments, or a platform that manages the application workflow and communicates outcomes to students, is delivering enrolment services. Induction means orientation that prepares a student to commence: explaining what the training involves, the student's obligations, the support available, and what the RTO expects, which Outcome Standard 2.1 requires to be provided before or at the time of enrolment. An employer who conducts a workplace induction incorporating the RTO's training content and obligations is delivering an induction service. Fee collection means receiving fee payments from prospective or enrolled students and remitting them to the RTO; its financial accountability implications are significant, because the RTO's obligations under the tuition protection framework and the financial management provisions apply whether fees are collected directly or through an intermediary, and a third party holding student fees before remitting them creates both an Outcome Standard 4.2 risk and a financial viability risk that must be managed.

3. The Three Exclusions: What Is Not a Third-Party Service

Understanding what is excluded matters as much as understanding what is included. Three categories of parties are excluded from the third-party definition: employees, industry experts engaged under Outcome Standard 3.3, and qualifying government referral agencies, as the earlier article examined. Beyond those, certain activities fall outside the "services" definition entirely, regardless of who performs them. Counselling and mediation are specifically excluded from training support services: an external psychologist providing student mental health services, or a mediator resolving a student's conflict with a placement employer, is not delivering a training support service, reflecting that such professional services operate under their own professional and regulatory frameworks. Information and communication technology services are excluded for similar reasons: a learning management vendor, a video-conferencing platform, an assessment management system or a digital content library provides the technical infrastructure through which the RTO and its trainers deliver services, and the framework is not designed to govern technology vendor relationships.

The government referral agency exclusion is conditional. It applies only where the agency is a government or government-funded agency, only refers students to the RTO, and receives no payment from the RTO for doing so. Where any of these conditions is not met, the exclusion does not apply. An agency that receives a referral fee is not a qualifying government referral agency regardless of its funding status, and an agency that does more than refer, for instance by providing induction or support, is delivering services beyond referral, to which the framework applies.

4. The Outcome Standard 2.1 Obligation That Third Parties Create

Outcome Standard 2.1 requires that all information provided to students is clear, accurate and current, and it extends to information provided by persons on the RTO's behalf. Where a third party, whether an education agent, a pathway partner, an employer conducting induction, or a marketing organisation, gives prospective or enrolled students information about the RTO's training products, that information must satisfy Outcome Standard 2.1 as if the RTO had provided it directly. A third party that misrepresents the qualification outcomes, employment prospects, volume of learning, entry requirements, cost or assessment requirements has caused the RTO a compliance failure, regardless of the third party's independent conduct.

This creates a specific oversight obligation that many RTOs do not systematically address. The Outcome Standard 4.2 system for ensuring third parties meet the requirements must specifically address information accuracy: the RTO should provide third parties with approved information materials and require them not to supplement or vary those materials without approval, conduct periodic checks of the materials in use, monitor student feedback for signs that pre-enrolment information was inaccurate or misleading, and include a specific information-accuracy obligation in the arrangement document. The Fit and Proper Person Requirements also bear on education agents in certain circumstances, as examined elsewhere in this series, and where they interact with Outcome Standards 2.1 and 4.2 they reinforce the RTO's accountability for the conduct of persons providing information and enrolment services on its behalf, whatever the commercial structure.

5. The Outcome Standard 1.3 Connection: Assessment Consistency Regardless of Who Delivers

Outcome Standard 1.3 requires the assessment system to ensure assessment is conducted in a manner consistent with the training product, regardless of when, where, or by whom it is conducted. This is the basis for one of the most critical third-party obligations: where assessment is conducted by or through a third party, the RTO must demonstrate that the system still produces results consistent with the training product. A workplace conducting assessments under a work-based arrangement, a subcontracted RTO assessing on the principal's behalf, and an employer whose supervisors sign off on student performance against criteria are all conducting assessment that must satisfy the standard. The fact that the activity occurs away from the RTO's direct supervision does not reduce the requirement; it increases the oversight obligation.

The oversight mechanisms for third-party assessment must include validating the tools used by third parties against the training product under Outcome Standard 1.5, quality-checking the assessment records produced by third-party assessors to confirm the rules of evidence are satisfied, and moderating third-party judgements against the RTO's own assessors' judgements on equivalent evidence. RTOs that use employer supervisors to assess workplace performance face a particular challenge: the supervisor may have excellent industry knowledge but no formal assessment training. Outcome Standard 3.3 provides the framework for engaging industry experts in assessment, requiring that they work alongside a credentialled assessor who makes the final competency determination, and the arrangement with the employer must specify this clearly while the oversight system verifies it is applied.

6. Building the Oversight System: A Tiered Approach by Risk

Not all arrangements carry the same risk, and the system for ensuring compliance should be calibrated accordingly. A subcontractor delivering an entire qualification presents a different risk than an LLN provider delivering two hours of literacy support a week; an offshore agent handling enrolment and fees presents different risks than a local employer facilitating workplace visits. A risk-tiered framework concentrates monitoring where risk is highest while keeping proportionate oversight across all arrangements. The following table sets out an indicative three-tier structure.

The tier assignment should be documented and reviewed at least annually, or whenever the nature or scope of the arrangement changes. A third party that begins as a Tier 3 guest engagement and evolves into a regular delivery arrangement should be reclassified upward when the engagement changes, because the system must be responsive to the third party's role rather than static.

7. Performance Issues: What They Look Like and What to Do With Them

The oversight system is only useful if the RTO acts when it finds a third party is not meeting the requirements. A system that identifies issues but takes no action has failed in its purpose, so the corrective action process is non-negotiable. Performance issues arise in several categories. Assessment quality issues are the most common: records that do not satisfy the rules of evidence, competency judgements made by persons not authorised under the Credential Policy, tools used that differ from the RTO's approved tools, or outcomes statistically inconsistent with those from equivalent cohorts assessed by the RTO's own assessors. Information accuracy issues arise when monitoring reveals a third party providing inaccurate, outdated or misleading information, which may surface through student feedback, complaints, or material reviews, and the response must include immediate correction, a review of all materials the third party has used, an assessment of whether any enrolled students decided on the basis of inaccurate information and whether remediation or disclosure is required, and a documented review of the information processes in the arrangement.

Student support failures arise when a third party responsible for support fails to provide what the arrangement requires, leaving students with unmet needs, higher withdrawal rates or weaker outcomes than comparable cohorts under direct RTO support, often visible in feedback and completion data before any formal complaint. Credential and currency failures arise when a third-party trainer's credential has lapsed, is inappropriate for the role, or their industry currency has not been maintained, and these must trigger an immediate review of all assessment conducted by the affected trainer during the period of concern, because the Credential Policy and Outcome Standard 3.3 requirements are not retrospectively satisfied by later remediation.

8. Connecting Third-Party Oversight to Continuous Improvement

Outcome Standard 4.4 requires systematic monitoring and evaluation of performance and the use of the outcomes to drive continuous improvement, and third-party performance data is a primary input. The data the oversight activities generate, from assessment quality reviews, student feedback, complaint records, credential verification and information-accuracy checks, is not only evidence of third-party compliance; it is evidence of the quality of the RTO's own selection, induction and management of third parties. An RTO that repeatedly finds assessment quality issues in one third-party trainer's files has a data point about that trainer, but if the same pattern appears across multiple third parties, it has a data point about its own induction, training and quality assurance. The continuous improvement cycle requires the RTO to distinguish issues that need corrective action with a specific party from systemic issues that require it to improve its own management system. Specific improvement actions might include updating induction materials to close a gap that has generated repeated questions, revising the record-review process to detect a particular non-compliance earlier, improving the materials provided to third parties to reduce information-accuracy failures, or reclassifying an arrangement to a higher risk tier after findings show elevated risk. Each should be recorded in the continuous improvement register, connected to the data that generated it, and reviewed in the next cycle.

9. A Third-Party Oversight Calendar for Compliance Teams

The following calendar distributes oversight across the year rather than concentrating it at commencement and audit, which is what the system requirement under Outcome Standard 4.2 effectively demands. The frequencies are indicative and should be adjusted to each arrangement's risk tier.

10. What ASQA Looks for When Auditing Third-Party Oversight

An auditor assessing Outcome Standard 4.2 is looking for evidence of a functioning system, not a populated document library, and the distinction is critical. Many RTOs have arrangement templates, credential matrices and oversight policies that look like a well-designed system on paper; the audit question is whether it is operating. ASQA asks the RTO to demonstrate, by reference to specific evidence, that third parties delivering services on its behalf are meeting the requirements, which means producing records of oversight that was actually conducted, not merely confirming that processes exist. A completed file-review report that shows findings is worth more than a blank template, and a feedback analysis that identifies issues and documents the response is worth more than a summary asserting no issues with no analytical trail. Common gaps at audit include arrangements that are comprehensively drafted but not operationally maintained, oversight calendars populated at commencement with no evidence of later activity, assessment reviews conducted but producing no documented findings or actions, and student feedback collected from third-party cohorts but never disaggregated for analysis. Each reflects a system designed but not operated. The following table sets out common audit requests and what the RTO needs ready.

Conclusion: The Contract Is the Start Line, Not the Finish

The recurring failure in third-party compliance is mistaking the agreement for the obligation. A signed arrangement, however well drafted, is a statement of intent; Outcome Standard 4.2 is satisfied by what happens afterwards, in the reviews conducted, the records read, the inaccurate brochure corrected, the lapsed credential caught, and the finding acted upon. The breadth of the definition is the first thing to get right, because an RTO that does not recognise its education agents, its pathway partners and its fee-collecting intermediaries as third parties will not be overseeing them at all. The second is to build oversight that is proportionate to risk and distributed across the year, so that the system produces a continuous trail of activity rather than a flurry before audit. Done that way, the RTO can answer the auditor's real question, not whether a system exists but whether it works, with the only evidence that counts: the record of having actually looked. Delegation of the work is never delegation of the responsibility, and the contract is the start line, not the finish.

References and Further Reading

Federal Register of Legislation (2025). National Vocational Education and Training Regulator (Outcome Standards for NVR Registered Training Organisations) Instrument 2025. https://www.legislation.gov.au

Australian Skills Quality Authority (2025). Practice Guide: Third Party Arrangements (Quality Area 4). https://www.asqa.gov.au

Australian Skills Quality Authority (2025). Practice Guide: Information. https://www.asqa.gov.au

Federal Register of Legislation. National Vocational Education and Training Regulator (Compliance Standards for NVR Registered Training Organisations and Fit and Proper Person Requirements) Instrument 2025. https://www.legislation.gov.au

Department of Employment and Workplace Relations (2025). Revised Standards for RTOs: Frequently Asked Questions. https://www.dewr.gov.au/standards-for-rtos/revised-standards-rtos-frequently-asked-questions