RTO Due Diligence: The Compliance Debt Financials Miss

A clean financial audit and a clean legal review can both say yes while the training and assessment file says no. That's the trap sitting inside RTO acquisitions right now: the Standards for RTOs 2025 test evidence of practice, not paperwork, so a target can tick every item on a conventional due diligence checklist and still be carrying compliance debt that only shows up at its next ASQA audit — by which time you own it.

Why this hits your desk

You're the one who signs off on the multiple, and you're the one who has to explain it to the board if the number turns out to be wrong. If you're buying, the price you pay is meant to reflect the risk you're taking on — and right now, deal data shows compliance documentation is already being priced into RTO valuations, whether buyers ask about it directly or not. If you're selling or raising capital, the same logic cuts the other way: a weak audit trail is a discount you didn't budget for.

Either way, a retrospective non-compliance finding or a qualification cancellation doesn't land on the trainer's desk. It lands on yours, months or years after the deal closed, in a market where NCVER's 2025 data already shows commencing government-funded enrolments down 11.0% and continuing enrolments down 6.2% — a shrinking pool that makes any unbudgeted compliance cost far harder to absorb than it was during growth years.

What actually changed on 1 July 2025

The 2025 Standards for RTOs replaced the 2015 framework and shifted the compliance test in a specific way: from written policy to demonstrated outcomes and evidence of practice within real delivery and assessment contexts, per ASQA's own guidance material and Final Practice Guides. A provider that had a compliant-looking policy manual under the old Standards can be non-compliant under the new one, without anything in its written documentation changing at all. That gap between paper compliance and demonstrated practice is exactly where deal risk now hides — and it's invisible to a standard financial and legal audit, because financial and legal audits are built to test different things entirely.

The Gills College precedent: what compliance debt actually costs

This isn't a theoretical risk. In November 2024, ASQA cancelled Gills College's registration for critical non-compliance, and the fallout included invalidating qualifications and statements of attainment issued to more than 3,300 individuals, according to reporting from thesector.com.au and the Department of Employment and Workplace Relations. That's not a fine or a licence suspension — it's a liability that materialises well after the fact, hits real people's qualifications, and would not have appeared in a pre-acquisition balance sheet review before the cancellation occurred.

ASQA has also flagged an ongoing, sector-wide investigation program targeting poor-quality and fraudulent providers, with further cancellations expected. That means the risk pipeline is live, not historical — a target's clean record today doesn't guarantee a clean audit outcome next quarter.

Why the standard due diligence checklist misses it

Most RTO acquisition due diligence — and most legal and advisory checklists built for it — focus on contracts, leases, IP, litigation history, and whether policy documents exist. Those things matter. They also don't tell you whether the assessment evidence a target's trainers actually collected would stand up against the 2025 Standards' evidence-of-practice test, because that requires sampling delivery and assessment records, not reading a policy folder.

The multiple already prices this — are you asking the right questions?

Independent market reporting from Infinity Business Brokers' 2025 RTO State of the Market Report puts generalist RTO valuations at roughly 2.8–3.6x EBITDA and CRICOS providers at 2.5–3.0x — with one online-only CRICOS RTO selling in 49 days at a 4.1x multiple attributed specifically to its audit-ready trainer logs and delivery compliance. That gap between a mid-range multiple and a 4.1x outcome is the market telling you what a demonstrably clean evidence trail is worth. If your due diligence process can't distinguish a target with genuine audit-ready evidence from one with tidy policy documents and thin practice records, you're negotiating blind on the single variable the market has already learned to price.

Key-person risk turns into audit risk fast

The same market report notes 67% of RTOs are experiencing trainer shortages, in areas including aged care and WHS, with 43% expecting the shortage to worsen. In a target with one or two compliance-literate staff or trainers, succession risk and audit risk are the same risk. If a trainer or assessor's own qualification is later found deficient or cancelled, the training and assessment they delivered can no longer be relied on as evidence of the RTO's own learners' competency — turning a staffing gap into a reissue and reputational problem that outlives the person who caused it.

Key takeaways

• The Standards for RTOs 2025 test demonstrated evidence of practice, not written policy — a target can look compliant under the old model and still carry undisclosed risk under the new one.
• ASQA's cancellation of Gills College's registration and the invalidation of over 3,300 qualifications shows compliance debt converts into real liability well after the fact, and ASQA has signalled more enforcement action is coming.
• Reported valuation multiples of 2.5–4.1x EBITDA already reflect the strength of a provider's audit trail — treat compliance evidence as a priced deal variable, not a legal formality.
• With 67% of RTOs facing trainer shortages, key-person risk in compliance and assessment roles is also succession risk to any acquirer or board.
• Standard financial and legal due diligence checklists don't sample assessment evidence or trainer credential currency — that gap is precisely where compliance debt hides.

Our take

Compliance due diligence on an RTO acquisition can no longer stop at 'does the policy exist'. It has to test whether the evidence behind that policy would survive an audit under the current Standards, sampled the way ASQA now samples it — assessment files, trainer records, mapping back to units of competency. That's slower and more specialised work than a standard legal checklist, and it's worth doing before you sign, not after ASQA does the sampling for you.

FAQ

What's the single biggest blind spot in RTO acquisition due diligence right now? Most due diligence processes verify that policies and procedures exist, but the Standards for RTOs 2025 test evidence of practice — actual delivery and assessment records — not policy documents. A target can have a compliant-looking policy manual and still fail an audit on evidence of practice.

Does ASQA's Gills College cancellation actually affect buyers of other RTOs? Directly, no — it's specific to that provider. But it demonstrates the mechanism: a critical non-compliance finding can retrospectively invalidate qualifications already issued (more than 3,300 in that case), which is exactly the kind of post-acquisition liability standard financial and legal due diligence won't surface.

How should compliance standing factor into the price I pay or accept for an RTO? Market reporting already shows valuation multiples ranging from roughly 2.5x to as high as 4.1x EBITDA, with the top end tied specifically to audit-ready trainer logs and delivery compliance. Treat a target's demonstrated evidence of practice, not just its policy set, as a factor that should move the multiple.

Is trainer shortage really a compliance risk, or just an operational one? Both. With 67% of RTOs reporting trainer shortages, a small compliance-literate workforce means a single trainer's credential issue can undermine the evidence base for multiple units of competency at once — which is an audit and reissue risk, not just a staffing gap.