Newbery Consulting Newbery Consulting Newbery Consulting
 

 
 

 

VET News

Wednesday 26th of February 2025

 

Hello and welcome to VET News,

 

Ok, last reminder from me on your annual AVETMISS report which is due by the 28th February. To everyone who has completed this already, great job! To those who have not completed this, you either need to get it done in the next two days or start putting some money aside to pay the fine. Seriously, get it done! Annual Declaration on Compliance opens on the 3rd March and it due by the 31st March.

 

There are a couple of other issues I wanted to mention:

 

Delivering Elective Units

 

Over the last three to four weeks, I have had an unusual number of questions from clients and other consultants about the rules relating to the delivery of elective units of competency. I don’t mind these questions because they are pretty easy to answer but it does surprise me that the rules around the delivery of elective units are not better understood. So, I just thought I would clarify it for our readers. Firstly, I should just point out that ASQA has published (in 2015) a fairly useful fact sheet on its website that explains all of the rules. You can access that here: delivering-elective-units. The only downside of this fact sheet is that some of the language is a little cryptic and therefore even after people have read it, they still don’t quite understand. OK, here are the basic rules in a nutshell:

  1. If the packaging rules of a qualification that you deliver indicate that you can select a number of units of competency (usually 1-3) from any other training package or accredited course, you do not need to have these units of competency on your scope of registration to include them in your delivery. The qualification packaging rules have given you permission to select a relevant unit from literally anyway. They usually insert a caveat to require that these imported units of competency are consistent with the AQF level of the qualification and meet a specific industry need. I also usually point out to clients that these imported units should not duplicate the function or the occupational outcome of units of competency which are already part of the qualification.
  2. Following on from point 1, if you are importing units of competency from outside the qualification you have on your scope of registration, you are only permitted to deliver these units of competency as part of that qualification delivery and you are not permitted to deliver these unit individually. Makes sense!
  3. Noting point 2, you are allowed to deliver any of the units of competency which are individually named in a qualification on your scope of registration. I think this is probably one of the least utilised assets within any registered training organisation. Most RTOs who have a number of qualifications on their scope of registration could literally have 100+ individual units on their implicit scope of registration. You can deliver these units of competency either individually or as a skill set to your clients without needing to add these units of competency separately to your scope of registration or notify ASQA. Personally, I think it’s a no brainer that training organisations should be offering a wide range of unit only courses to offer options to the market and compliment their longer courses.
  4. If you have units of competency in a qualification that are identified as superseded but are still current in that qualification, you must continue to deliver that unit of competency even though it is superseded because, it is still current in the qualification that is on your scope for registration. This is particularly the case for units of competency which are identified as “core units”. There is obviously a little more discretion with elective units because you can choose to, not select them in preference for a unit of competency that is not superseded or if the qualification allows a flexibility mechanism to import a number of units from anywhere else (point 1), you could simply select the most current unit as long as that was selected in accordance with the packaging rules.

 

Cyber Security – Protect yourself!

Last point on something completely different, in the last few weeks one of our lovely clients has been responding to quite a serious cybersecurity event. The exact cause or mechanism of the cyber security breach is still being investigated, and they are responding both immediately and professionally in cooperation with relevant agencies. This was a ransom attack demanding payment to prevent the release of information. I won’t go into any further details, but the client has kindly allowed me to mention this in VET News to benefit others in the prevention of a cyber security breach in your own business. No one is immune from these types of incidents so; you need to get in front and make sure you have used every strategy to prevent this from happening to you. Here are a number of basic strategies that everyone should be applying:

  1. Implement strong access controls. Use multi-factor authentication for logins to add an extra layer of security. Enforce strong, unique passwords and use a password manager to assist staff to use complex passwords without the need to remember them. Restrict staff access to sensitive information. Only provide access on a need-to-know basis. Set a reminder to regularly review and update access permissions.
  2. Keep software and systems updated. Regularly update operating systems, applications, drivers and firmware to patch vulnerabilities. Enable automatic updates for critical software. Remove outdated software that is no longer supported or secure. You can use a software like Nortons to regularly scan your software for available updates to applications and drivers used in your network.
  3. Train staff on cybersecurity awareness. Conduct regular training on phishing attacks, social engineering, and safe browsing habits. Simulate phishing tests to help staffs recognise suspicious emails. Establish clear policies on handling company data, using personal devices, and reporting security incidents. We are a Australian Cyber Security Centre (ACSC) Partner and I would strongly recommend some of the great resources that are available for this training through the ACSC https://www.cyber.gov.au/learn-basics.
  4. Use robust security software and firewalls. Install and maintain antivirus and anti-malware software on all devices including computers, phones and tablets. I recommend Nortons. Set up firewalls to protect websites from unauthorised access. We use the Wordfence firewall on both of our websites. It is affordable, easy to set-up and extremely effective. If you have a WordPress website, I strongly recommend it.
  5. Regularly backup data and develop an incident response plan. Schedule automatic backups of critical data (on-site and cloud-based). Encrypt backups and store them securely to prevent ransomware attacks. Develop a cyber incident response plan so staff know what to do in case of a breach. Test backups regularly to ensure they can be restored when needed.

I know this stuff can seem a bit heavy, but seriously, do not become a victim to these criminals just because you put it off. Do it now. You can find so much more guidance on protecting yourself at https://www.cyber.gov.au/.

 

Good training,

Joe Newbery

Compliance & Regulatory News

Other VET News

Reports, Articles, Papers and Research

Training Package Updates

Upcoming Events

 
 

 

 

 

Back to Articles

Webinar Series

Recent News

Recent Posts

Yada

© 2025 Newbery Consulting