There’s a clean line between a system that tracks courses and a system a Registered Training Organisation can actually run on. A completion tracker answers one question: did this person finish? An RTO carries obligations that start the moment a learner enrols and don’t end when they leave — verify the student’s identifier and keep it off the printed credential, report enrolments to the regulator in a fixed file format, honour a privacy access request, issue a tax-compliant invoice, and dispose of records on a defensible clock.
Most platforms treat all of that as someone else’s problem — a bolt-on, an export, a quarterly scramble in a spreadsheet. We treated it as the spec. The LMS lives inside the compliance schema, which means the records law lives there too.
Hold the USI in the records layer, then protect it
Australian VET runs on the Unique Student Identifier. The Student Identifiers Act 2014 makes that USI protected information, not a general-purpose key you get to scatter through your logs. The platform holds the USI in the records layer, where it is available for the certificate-issue workflow and regulatory reporting without leaking into unrelated surfaces.
The live USI registry check (verifying the number against the national registry before issue) is wired in as a DSP onboarding step and activates when a tenant completes that configuration. Until then the platform stores and protects the identifier it holds. Either way the number stays contained: it is never printed on the testamur (F2025L00355 cl.12(1)(a) bars any student identifier on a VET qualification or statement of attainment) and never leaks into audit-log entries or the public verification page. Most systems let the USI bleed into every record because the form had a box for it. We drew a hard line around where it can go.
Report to the regulator in the format it expects
A completion table is not a regulatory return. RTO tenants in Australia report enrolment and outcome data to NCVER through AVETMISS — a fixed-width NAT-file specification, not a friendly CSV you invent yourself. Get a column wrong and the submission bounces.
We generate AVETMISS / NCVER NAT-file exports straight from the same tables that drive day-to-day enrolment, so the data that runs the courses is the data that files the return. There’s no second system to reconcile, no nightly job mapping a learning record onto a reporting shape it was never built for. The export is a view over the source of truth, not a translation.
Treat data-subject rights as a feature, not a ticket
When a learner asks “what do you hold on me?” or “this is wrong, fix it,” that’s a privacy obligation with a clock on it — not a support ticket someone forwards to legal. We built data-subject-rights self-service in: an individual can trigger a privacy access export of their own record and lodge a correction request against it, and the workflow that handles both is part of the product, not an email thread.
Pair that with a data-breach console — a structured place to register, triage, and track the notification obligations that attach to a breach — and the awkward parts of the records law stop being fire drills. They’re screens. The full reasoning on where this data lives and under whose jurisdiction is in building for Australian data sovereignty.
Keep records exactly as long as you must, then dispose
Retention is where good intentions go to die in a junk drawer. RTOs and councils both carry retention obligations that say keep this long — and, just as importantly, don’t keep it forever. So disposal is tiered: different record classes age on different schedules, and a deletion runs against a defensible clock rather than a guess.
Crucially, disposal isn’t a trapdoor. There’s a cooling-off period before a scheduled disposal actually executes, so a record that’s been flagged for deletion can be pulled back before it’s gone for good. The clock disposes; the cooling-off period forgives the mistake.
Bill for it the way the ATO expects
The moment a course is something you sell — to another council, to an external learner — you’ve crossed into commerce, and commerce in Australia has rules. A receipt is not a tax invoice. We issue ATO-compliant tax invoicing for course commerce: the document a buyer can actually claim against, generated as part of the transaction rather than typed up afterwards. When one course authored once is distributed to many councils, the money side has to be as clean as the content side.
Why “inside the schema” is the whole argument
None of these are bolt-ons because the LMS isn’t a bolt-on. A course completion writes into employee_courses and trips a live compliance recalculation — the council’s score moves on its own. That same completion materialises into a skills record that a gap view diffs against the competencies a position requires. A high-risk-work licence minted from an LMS-verified competency is enforced at the PPE pre-start gate under OHS Regs reg 129 — an uncertified operator is simply blocked from the task.
Many suites treat the LMS as a swappable module wired in through SCORM export and manual reconciliation. That’s a fine way to track courses. It is not a way to run an RTO, because the regulatory depth — USI handling, AVETMISS, data-subject rights, retention, tax invoicing — can’t be reconciled in afterwards. It has to be the same system, not connected to one.
For how the learning layer is welded to compliance, see the LMS that lives in your compliance schema. For how we prove a person genuinely did the work, see proving someone actually did the training.