Compliance Architecture

QMS structure for training providers

Move beyond copy-pasted paper manuals. Learn how to architect a Quality Management System (QMS) that drives actual operational compliance, survives SETA/QCTO audits, and scales with your enrolments.

The four layers of a working QMS

A QMS is not just a policy document. It is a four-part engine spanning rules, execution, proof, and improvement.

Policy framework

The foundational rules. What the institution promises to do regarding assessments, moderation, appeals, and learner support.

Standard Operating Procedures (SOPs)

The step-by-step instructions. How staff actually execute the policy framework when dealing with real learners and files.

Evidence and records

The proof. The templates, logs, register sheets, and system databases that prove the SOPs were followed.

Continuous improvement

The feedback loop. How the institution identifies non-conformances, fixes them, and updates the policies over time.

How to construct your QMS framework

Follow this sequence to build a QMS that staff actually understand and verifiers trust.

1

Draft policies that match your actual capabilities

Do not promise complex electronic biometric attendance if you currently use a paper register. Write the policy for the reality of your current operations, ensuring it meets minimum compliance.

2

Establish a Document Control Register

Every policy must have a unique code (e.g., POL-ASS-01), a version number, a creation date, and a next-review date. A central register must track these.

3

Map SOPs to QMS Policies

If you have an Assessment Policy, you need an SOP showing the receptionist how to receive a PoE, the assessor how to sign it out, and the admin how to record the result.

4

Standardize evidence templates

Your QMS must include the actual blank templates staff will use: Attendance Registers, Assessment Feedback Forms, Assessor Declaration Forms.

5

Schedule the audit calendar

Decide exactly when internal audits will happen (e.g., every quarter). Book these dates. A QMS without internal audits is just a pile of paper.

6

Digitize where possible

Move from paper binders to a Training Management System (TMS) that forces your staff to follow the QMS rules automatically (e.g., locking assessments until attendance is met).

Core policies and where they break down

Every QMS must contain these foundational policies. Here is what they cover—and how providers usually fail them.

Policy Area

Assessment Policy

What it covers

Pre-assessment briefings, formatting of instruments, competency decision rules, reassessment limits.

Where it usually breaks

The policy states assessors have 48 hours to grade, but the actual turnaround is 3 weeks.

Policy Area

Internal Moderation Policy

What it covers

Pre-moderation of tools, sample sizes for post-moderation (e.g., 25%), handling disputes between assessor and moderator.

Where it usually breaks

Moderators rubber-stamp 100% of files just before verification, defeating the purpose of sampling.

Policy Area

Appeals Policy

What it covers

Timeframes for learner appeals, the constitution of an appeals committee, reporting structures.

Where it usually breaks

Learners don't know the policy exists, so they complain to the SETA/QCTO directly instead of internally.

Policy Area

Recognition of Prior Learning (RPL)

What it covers

Intake interviews, evidence alignment rules, gap training procedures.

Where it usually breaks

RPL is treated identical to standard assessments, ignoring the candidate's existing workplace evidence.

Policy Area

Learner Support Policy

What it covers

Remedial interventions for learners deemed 'Not Yet Competent' (NYC), counseling, academic guidance.

Where it usually breaks

Providers drop NYC learners from the register instead of documenting the remedial steps taken.

Policy Area

Staff Management Policy

What it covers

Recruitment criteria for facilitators, performance reviews, continued professional development (CPD).

Where it usually breaks

Assessor credentials expire because there is no system tracking their registration end-dates.

Policy Area

Health, Safety & Environment (OHS)

What it covers

Evacuation plans, first aid readiness, specific workshop/clinical safety protocols.

Where it usually breaks

A generic template is submitted that mentions factory floors while the provider teaches IT in an office.

Policy Area

Data and Records Management

What it covers

Backup rules, POPIA compliance, NLRD upload schedules, learner confidentiality.

Where it usually breaks

Assessment results are kept in an unprotected Google Sheet accessible to anyone with the link.

Fatal QMS flaws

The fastest ways to fail a compliance review.

  • Buying a generic 'off-the-shelf' QMS

    Verifiers ask staff how a specific policy works. When they don't know, the QMS is ruled 'non-operational' and accreditation is withheld.

  • Policies contradicting each other

    The Learner Support policy says appeals are handled in 7 days, but the Appeals policy says 14 days. This signals sloppy quality control.

  • No evidence of Management Review

    A QMS requires evidence that directors actually meet to discuss quality. Without meeting minutes, the QMS lacks executive enforcement.

  • Ignoring the Learner Code of Conduct

    Providers try to expel a disruptive learner but realize they never had the learner sign the Code of Conduct during induction.

  • Over-complicating continuous improvement

    Creating a massive corrective action process that nobody uses. A simple register of 'what went wrong and how we fixed it' is all that's required.

Signals of a weak QMS

Auditors spot these patterns instantly.

  • Copy-pasting an older provider's QMS and leaving their name in the headers.
  • Including 100 pages of advanced university-level policies for a 5-person training company.
  • Having a policy for digital backups but storing all PoEs in a single filing cabinet.
  • Describing a massive 'Quality Assurance Committee' when the provider only has two staff members.
  • Ignoring the document control index, meaning staff use version 1 while management uses version 3.
  • Failing to review and date the QMS annually. Verifiers immediately flag policies dated 5 years ago.
  • Treating the QMS as an accreditation hurdle rather than the actual operating manual for the business.

Frequently asked questions

Deepen your QMS knowledge

Move into specific policies and operational evidence tracking.

Assessment Policy Template

Deep dive into the core assessment rules.

Evidence Management

How to structure the files your QMS generates.

Compliance Framework

The overarching structure of training compliance.

QCTO Accreditation

See how the QCTO relies on your QMS.