AssureLog

1. One-liner

Turns the data already sitting in your student system into the dated monitoring trail ASQA now asks to see.

2. Trend signal — why now?

The Standards for RTOs 2025 took effect 1 July 2025. The 2026 audit cycle is the first one where the change actually bites, and the change is not cosmetic. ASQA moved from checking whether a document exists in a folder to checking whether your systems work in practice — what the regulator calls self-assurance.

What that means in the field, per compliance practitioners writing about the 2026 audit round: RTOs are getting caught with “perfect” policies but zero evidence of internal monitoring. The specific failure named is treating self-assurance as a periodic task rather than a continuous one. If you cannot show a log of internal audits, feedback-driven adjustments, or risk-mitigation actions taken in the last six months, you are high risk.

Three more specifics that matter:

• Assessment is where RTOs die. 34% of ASQA non-compliance findings relate to assessment practices (ASQA 2022–23 report).
• Validation went risk-based, and nobody documents the reasoning. The 2025 Standards replaced the old prescriptive validation schedule with a risk-based approach. A frequent gap in late 2025: RTOs claim a risk-based approach but do not document the risk reasoning behind priorities, scope, or sample size — which undermines the compliance claim entirely.
• Trainer currency is now expected to be continuously monitored, not confirmed once at induction.

The money side is unambiguous. An ASQA performance assessment is billed at $21,500 ($250/hour × 86 hours). Internal audits run $1,500–5,000 a year. RTO consultants charge $2,000–10,000 to review compliance. RTOSafe sells RTO compliance software at $395–995/month. This is a sector that already pays real money for audit safety.

Provenance:

• Signal 1 (demand): ASQA 2026 audits shifted to Performance Assessments testing self-assurance in practice; RTOs caught with “perfect” policies and no evidence of internal monitoring in the last six months — https://compliantlearningresources.com.au/blog/asqa-audit-model-and-rto-self-assessment-in-2026/ and https://www.vetadvisorygroup.com.au/blog/asqa-audit-trends-in-2026-what-rtos-should-expect-under-the-new-asqa-standards/ — observed 2026-08-15
• Signal 2 (feasibility): Every major RTO student management system (aXcelerate, VETtrak, Wisenet) exposes REST APIs and AVETMISS NAT file exports, so the underlying compliance data is already machine-readable — https://rtobase.com.au/compare/axcelerate and https://www.wisenet.co/data-migration — observed 2026-08-15
• Signal 3 (economic): ASQA performance assessment fee is $21,500; internal audits $1,500–5,000/yr; consultants $2,000–10,000; RTOSafe compliance software $395–995/mo — https://www.rtoadvisoryperth.com.au/blog/cost-to-start-an-rto-in-australia/ and https://rtosafe.com.au/pricing/ — observed 2026-08-15 Category: Regulatory arbitrage

3. The opportunity

The existing RTO compliance tools — Complynce, RTOSafe, Vivacity ComplyHub, Qualticks — are registers. They give you a place to record that you did a thing. Somebody still has to do the thing, remember to record it, attach the evidence, and set the next review date. Complynce’s own material describes mapping evidence to obligations and flagging overdue actions; RTOFlow states plainly that it organises resources and that human review and final compliance decisions remain the RTO’s responsibility.

That is a filing cabinet with reminders. It solves the storage problem. It does not solve the problem RTOs actually fail on, which is generation — nobody in a 6-person RTO has time to run a monthly internal audit, so the register sits empty, and an empty register is worse at audit than no register because it proves you had a system and ignored it.

The gap: the evidence ASQA wants is largely derivable from data the RTO already has. Completion and withdrawal patterns, assessment turnaround, trainer credential expiry against units delivered, validation coverage versus scope — all of it lives in the student management system. Nobody is turning that into a dated, narrated monitoring record on a schedule.

Reframe the product from “somewhere to file your evidence” to “the thing that produces the evidence whether or not you remembered.” That flips the buyer’s mental model from a chore they avoid to a subscription that quietly accrues audit defence.

4. Target market

• Primary customer: Owner/CEO or Compliance Manager of a private RTO with 50–1,500 annual enrolments and 3–25 staff. Australia-wide, ASQA-regulated. The buyer is usually the person who would personally sit in the audit.
• Why they buy: Not “compliance” in the abstract — the specific fear of a performance assessment finding that costs $21,500 in assessment fees plus rectification, sanctions on scope, or in the bad case, conditions on registration that kill enrolments. They buy the same way people buy insurance after a neighbour’s house burns down: when a peer RTO gets a bad outcome.
• Rough TAM reasoning: ~4,000 RTOs registered in Australia, the large majority private and small. Strip out TAFEs, schools, and enterprise RTOs that have in-house compliance teams, and the realistic serviceable base is ~2,000–2,500. At $299/mo that is a ~$8M/yr ceiling — small for a VC, exactly right for a bootstrapper.
• Why now for them: The 2025 Standards are in their first full audit cycle. Every RTO in the sector is currently being told by consultants and industry newsletters that periodic self-assurance is now a finding. The market is pre-educated on the problem, which is the expensive half of selling compliance software.

5. Product sketch (MVP)

• Read-only connection to the student management system (aXcelerate, VETtrak, Wisenet to start; AVETMISS NAT file upload as the universal fallback so no RTO is locked out).
• Monthly monitoring pack, generated automatically — completion and withdrawal trends by cohort and trainer, assessment turnaround outliers, units delivered by trainers whose currency evidence is stale, scope items with no validation in the current cycle. Dated, versioned, exportable.
• Risk-based validation planner that shows its working — ranks scope items by risk using enrolment volume, trainer changes, complaint/appeal history and time since last validation, and writes out the reasoning, sample size and priority in the language ASQA expects. This is the single highest-value artefact in the product.
• Trainer currency watch — credential and industry-currency expiry tracked against the units each trainer is actually delivering, not a generic HR expiry list.
• “What would an auditor ask” gap report — flags the obligations where you have no evidence at all in the last six months, ranked by how commonly ASQA finds against them.
• Evidence timeline — an immutable, timestamped record showing monitoring happened continuously rather than being assembled the week before the audit.
• One-click audit bundle — everything above exported as a dated PDF/folder structure mapped to the 2025 Standards quality areas.

6. AI angle — what’s load-bearing

Two places, and both are real work rather than decoration.

Narration of evidence. The raw signal is a table of numbers. What ASQA wants is a documented reasoning trail: why this scope item was prioritised for validation, what the completion dip in the October cohort was attributed to, what action was taken. An LLM turns structured deltas into the written rationale a compliance manager would otherwise spend a day drafting. Remove the AI and you are back to a dashboard nobody writes up — which is precisely the failure mode being sold against.

Assessment tool review. Given a unit of competency and an uploaded assessment tool, flag where the tool fails to cover performance criteria, lacks sufficiency, or does not assess in the required context. Assessment is 34% of findings; this is where the pain concentrates. This is retrieval plus structured comparison against training package rules — genuinely hard to do well, genuinely valuable, and not a chatbot.

Honest limit: AI output here is a draft for a compliance professional to approve, never a filed determination. Anyone shipping this must say so plainly in the product, the way RTOFlow does.

7. Localization angle (if any)

Australia-only by construction, and that is the moat rather than a limitation. The product encodes ASQA’s 2025 Standards, the practice guides, AVETMISS data structures, and training.gov.au scope data. None of that transfers to another jurisdiction. A US or UK competitor cannot casually extend into this; the adjacent expansion is sideways into other ASQA-regulated segments (CRICOS providers, which carry an extra ESOS layer) or into New Zealand’s NZQA regime as a separate build.

Payment rails and language are non-issues — standard AUD card/direct debit, English.

8. Business model — path to $1M–$5M ARR

• Pricing: $249/mo (up to 300 enrolments), $399/mo (301–1,000), $649/mo (1,000+ or multi-scope). Annual prepay discount of ~15%, which matters because RTO budgeting is annual.
• ACV: ~$3,600 blended.
• Rough math to $1M ARR: 280 RTOs at $299/mo average. That is 7% of the ~4,000 RTO base, or ~12% of the realistic serviceable base. Demanding but not fantasy for a category where the alternative is a $21,500 assessment fee.
• Rough math to $5M ARR: ~1,150 customers at a higher blended ACV — realistically requires the CRICOS/ESOS module, an assessment-tool review upsell, and probably a consultant/reseller channel carrying a third of the volume. I would not underwrite $5M on the core product alone; $1.5–2.5M is the honest ceiling for the base offering.
• Expansion path: enrolment-band creep, assessment-tool review as a per-unit or tiered add-on, CRICOS module, and a multi-client console for compliance consultants (see GTM below) priced per managed RTO.

9. Go-to-market wedge — first 100 customers

• training.gov.au is a public, complete, structured register of every RTO in Australia — code, legal name, scope, registration expiry, contact details. That is the entire market as a scrapeable list with no gaps. Filter to private RTOs with registration renewal falling in the next 18 months (renewal is when audit anxiety peaks) and you have a prioritised target list of a few hundred with a real trigger event.
• Sell through RTO compliance consultants, not around them. There are dozens of small consultancies (VET Advisory Group, 360RTO, Compliant Learning Resources and many one-person operators) already charging $2,000–10,000 per engagement. The product makes their engagements faster and their retainers stickier. Give them a multi-client console and a revenue share. This is the highest-leverage channel because they already have the trust and the client list — and their public content is the very content teaching the sector that this problem exists.
• Ride the existing content wave. The sector is saturated with “ASQA audit trends 2026” articles and LinkedIn commentary from compliance consultants. A free self-assurance gap check — upload an AVETMISS NAT file, get back a report on which obligations have no monitoring evidence — is a natural, concrete lead magnet in a market where every competitor’s lead magnet is a static PDF checklist.
• Velg Training and ITECA run the industry conferences and member networks. National VET conferences are the one place the entire buyer set physically gathers; a sponsored session on evidencing self-assurance under the 2025 Standards is a direct line to hundreds of owner-operators.
• Trigger-based outreach: ASQA publishes regulatory decisions. RTOs in a peer’s sub-sector immediately after a published sanction are the warmest cold audience in this market.

10. Build complexity — justification

Medium. The integrations are the work: three SMS APIs with inconsistent data models, plus AVETMISS NAT file parsing as the fallback (well-documented, stable, and the reason no RTO is unreachable). The compliance logic — mapping evidence to the 2025 Standards quality areas, encoding the risk-based validation model — is genuine domain work and the main reason this needs either a VET compliance co-founder or a paid advisor from day one. The AI layer is off-the-shelf. Realistic v1 for a technical founder plus a domain advisor: 12–16 weeks. The assessment-tool review feature should be deferred to v2; it is the hardest piece and the product sells without it.

11. Gating checklist

Gate	Pass?	Note
Legal in target market	✅	Compliance support tooling. Explicitly not a regulator-approved determination; output is advisory and requires RTO sign-off.
Ethical — no harm / dark patterns	✅	Helps providers genuinely evidence quality. Must not be positioned as a way to manufacture evidence retrospectively — see risk flags.
Market exists (evidence above)	✅	~4,000 RTOs; incumbents charging $395–995/mo; consultants charging $2K–10K.
1–5 person team can build this	✅	Technical founder + VET compliance advisor.
Launchable with <$50K / ₹40L	✅	Well under. Main cost is the domain advisor and conference presence.

12. Feasibility score

Axis	Weight	Score	Notes
Problem intensity	20	16/20	Real, expensive, and currently being felt — $21,500 assessment fees and scope sanctions. Docked because it is felt acutely at audit/renewal rather than daily; between audits it is easy to ignore, which is exactly why registers sit empty.
Demand evidence	15	12/15	Multiple incumbents charging real money, consultants with established fees, regulator-published standards change, sector-wide content wave. Docked: no direct verbatim RTO-owner complaints found — the evidence is practitioner and vendor commentary, not raw customer voice.
Build feasibility	15	11/15	APIs and NAT files exist and are documented, but three-way integration plus encoding the Standards is real work. 12–16 weeks, not 6.
Distribution clarity	15	13/15	training.gov.au is a complete public target list with renewal-date triggers; consultants are a ready-made reseller channel; conferences concentrate the buyers. Rare clarity for a compliance product.
Revenue mechanics	15	12/15	Pricing benchmarked directly against RTOSafe. $1M path is credible; the $5M path needs modules and channel, so I am not scoring it as proven.
Time to first revenue	10	7/10	12–16 week build, then a sales cycle measured in weeks not days — RTOs buy on annual budget cycles and want a demo with their own data. Realistically 4–6 months to first paid.
Defensibility	10	5/10	Regulatory domain knowledge and SMS integrations are a genuine 6–12 month head start, and accumulated evidence history creates switching cost. But an incumbent register vendor could bolt this on — Complynce and RTOSafe already own the customer relationship. This is the weakest axis and the honest reason this is a GO and not a STRONG GO.
Total	100	76/100

13. Qualitative modifiers

Founder-fit tags

technical-heavy · domain-expertise-required

This is not a solo generalist build. The compliance logic has to be right or the product is actively dangerous to its customers. A VET compliance co-founder or a well-paid advisor is a hard requirement, not a nice-to-have.

Key assumptions to validate (3–5)

1. Assumption: RTOs will grant read-only API access to their student management system to a new vendor. How to test: 15 discovery calls; ask directly and watch the reaction. If they baulk, the AVETMISS-upload fallback becomes the primary path and the product gets meaningfully weaker (batch, not continuous).
2. Assumption: The generated monitoring pack is accepted by auditors as genuine evidence of continuous self-assurance. How to test: Pay 3 independent RTO compliance consultants to review a sample pack and state whether they would put it in front of ASQA. This is the single most important validation and it is cheap.
3. Assumption: Consultants will resell rather than treat this as a threat to their billable hours. How to test: Pitch 10 consultancies on the multi-client console with revenue share; measure how many will take a pilot client.
4. Assumption: $299/mo clears the bar for a 6-person RTO. How to test: Price-test against the $395 RTOSafe Starter anchor in the same discovery calls.

Risk flags

1. Incumbent bolt-on risk: Complynce, RTOSafe and Vivacity already hold the customer relationship and the register data. If one of them ships automated evidence generation, the wedge narrows sharply. Mitigation is speed and depth on the validation-reasoning artefact, which is the hardest piece to copy well.
2. Regulatory interpretation risk: ASQA could publish guidance that changes what counts as acceptable self-assurance evidence, or take a dim view of auto-generated narration. The product must be built so a human compliance officer reviews and signs every artefact — both because it is right and because it is the defensible position.
3. Ethical/positioning risk: There is a version of this product that is “generate the evidence you never collected,” which is evidence fabrication with extra steps. That version is a fraud enablement tool and would eventually destroy the business. The product must generate evidence from data that reflects what actually happened and must never backfill activity that did not occur. This constraint has to be enforced in the product design, not just the marketing copy.
4. Market timing risk: The audit anxiety peak is now, in the first full cycle of the 2025 Standards. By 2028 the sector will have adapted and the urgency premium decays. This is a 24-month window to establish position.
5. Small TAM: ~4,000 RTOs total. Fine for $1–2M ARR, structurally capped below $5M without adjacent expansion. That is acceptable for this operator profile but should be entered with eyes open.

14. Structured verdict

Score:                  76/100
Verdict:                GO
Confidence:             Medium
Best-fit builder:       Technical founder paired with a VET compliance specialist (advisor or co-founder)
Time to revenue:        4–6 months
Capital to launch:      $15–25K AUD (domain advisor, conference presence, incorporation)
Top 3 assumptions to validate first:
  1. Auditor acceptance — pay 3 independent RTO consultants to review a sample monitoring pack and say whether they would file it
  2. SMS API access — 15 discovery calls testing willingness to connect aXcelerate/VETtrak/Wisenet read-only
  3. Consultant channel — pitch 10 consultancies on a revenue-share console; measure pilot uptake
Kill criteria:
  - Abandon if fewer than 2 of 3 independent compliance consultants say the generated pack is audit-credible
  - Abandon if fewer than 10 of 40 targeted RTOs will take a discovery call in the first month — this sector is reachable, and silence means the pain is not where I think it is
  - Abandon if an incumbent register vendor ships automated evidence generation from SMS data before v1 ships

15. Next step — 1-week validation sprint

• Day 1–2: Pull the full RTO list from training.gov.au. Filter to private providers with registration expiry in the next 18 months. Build the target list and confirm it is as complete and structured as expected — the entire GTM thesis rests on this list being real.
• Day 3–4: Hand-build one monitoring pack from a real (anonymised) AVETMISS NAT file — no product, just the artefact. Send it to 3 paid independent RTO compliance consultants with one question: would you put this in front of ASQA as evidence of continuous self-assurance?
• Day 5: Run 8–10 discovery calls with RTO owners off the target list. Ask what they did for self-assurance in the last six months and whether they could produce it today.
• Go/no-go: Proceed only if ≥2 of 3 consultants say the pack is audit-credible AND ≥5 of 10 RTO owners cannot produce six months of monitoring evidence on request. Both are falsifiable in a week and the second one is the real test — if they can all produce it, there is no product here.