Compliance Reporting & Audit Exports
When an auditor, regulator, board or insurer asks “show me your staff are compliant”, you want an answer in minutes, not a week of collecting spreadsheets. Attestation Core’s reports pull the current state of your compliance records into tables you can sort, filter, print, save as PDF and export to a spreadsheet. Every report shows when it was generated and who generated it.
This guide is for administrators and compliance managers who prepare reports. With Pro, it also covers the staff self-export feature that lets each staff member download their own record.
Reports help you gather and present evidence. They don’t decide whether your organisation meets a particular standard. That judgement stays with you and your auditor.
Where to find reports
Go to Attestation Core → Reports (page title Compliance Reports). The page lists every available report with a short description. Click a report’s name to open it.
Who can see it: users with the “view reports” permission. Administrators have it by default. Staff members (the Trainer / Assessor role) don’t. With Pro, department coordinators also don’t get it, because reports cover the whole organisation. See User roles and permissions.
Reports always show live data. Nothing is cached, so refreshing the page gives you the current position.
Free reports
Free includes three reports. Each opens on its own page with:
- Back to all reports, Print / Save as PDF and Download CSV buttons in the toolbar.
- A metadata box: Generated (date and time in UTC), Generated by (your display name), Rows (the count) and, when you’ve used them, the Filters applied.
- A sortable table. Click any column heading to sort, and click again to reverse. Under each heading is a Filter… box that narrows the visible rows as you type.
- If nothing matches: “No rows match. The report ran successfully — there just isn’t anything to show for the current filters.”
Column headings that say “Staff Member” follow your terminology settings. On RTO sites, for example, they read “Trainer / Assessor”. See Settings.
Credential Compliance
Every credential on file for each staff member, with its verification status and category.
| Column | Content |
|---|---|
| Staff Member | Name |
| Credential | Credential name |
| Category | Credential category label |
| Verified | verified or unverified |
| Working towards | working towards when the credential is still being worked towards, otherwise blank |
| Attained | Date attained |
Covers active compliance profiles only. There are no report-level filters, so use the column filter boxes.
Document Status
Every compliance profile × required active document type, with status and expiry.
| Column | Content |
|---|---|
| Staff Member | Name |
| Document type | Name of the document type |
| Status | The latest upload’s status: current, expiring 90 / 60 / 30 / 7, expired, review due, no expiry, missing expiry |
| Expiry | Expiry date |
| Verified | verified or unverified |
One row per active staff member for each active document type their workforce type requires, based on their most recent upload. A required document that has never been uploaded still gets a row, shown with status missing expiry, blank expiry and unverified. That way gaps are visible rather than hidden. To list every gap, type “missing” in the Status filter box.
Evidence Audit Trail
Every evidence submission with date, type, validation outcome, reviewer, and linked units.
| Column | Content |
|---|---|
| Staff Member | Name |
| Type | Evidence category |
| Title | Submission title |
| Activity date | The date the activity took place |
| Status | Submission status (for example submitted, validated, returned) |
| Validated on | Date and time of validation |
| Linked units | Codes of the units the evidence was validated against (RTO) |
Filters: this report has Status and Type drop-downs above the table. Choose values and click Filter, or click Clear filters to reset. The reviewer’s name isn’t a column, despite what the report’s description says.
Downloading CSV
Download CSV saves the report as a spreadsheet file named like attestation-core-document-status-20261005-031407.csv.
- It includes every row the report returned, with the drop-down filters (Status, Type and so on) applied. The Filter… boxes under the column headings only change what’s on screen and don’t affect the download.
- The file is UTF-8 with a byte-order mark, so Excel shows accented names correctly.
- To protect against spreadsheet formula attacks, any value that starts with
=,+,-or@is saved with a leading apostrophe.
Print / Save as PDF
Print / Save as PDF opens your browser’s print dialog with a print layout: buttons and filter boxes are hidden, and the title, generation metadata and table are kept. Choose Save as PDF as the destination to file a copy, or print it on paper. Landscape orientation usually suits wider reports.
Limits
- The Credential Compliance and Document Status reports include up to the first 500 active compliance profiles.
- The Evidence Audit Trail shows the 1,000 most recent submissions. Names are looked up from the first 500 profiles, and anyone beyond that appears as “Trainer #ID”.
- Large organisations should filter the Evidence Audit Trail by status or type, and use the Pro audit bundle for complete records.
Pro reports
🔒 Pro feature — requires the Pro plugin.
Pro adds these reports to the same list:
| Report | What it shows | Columns | Availability |
|---|---|---|---|
| Annual Plan Status | Plan status and the submission audit for every plan on file | Trainer, Year, Status, Due, Submitted, Submitted IP, Declaration hash | All sites. Filters: Plan year, Status |
| Administrative Staff Compliance | Upskilling plan status and completion rate for administrative staff | Name, Email, Plan Year, Plan Status, Total Activities, Completed, Completion %, Plan Due | All sites |
| Competency Matrix | One row per trainer × unit with current currency status | Trainer/Assessor, Unit code, Unit title, Scope, Currency, Latest evidence | RTO module |
| Currency Gaps | Every assigned trainer × unit where currency is Gap or Approaching Gap | Trainer/Assessor, Unit code, Unit title, Currency, Latest evidence | RTO module |
| Under Direction Register | Trainers working under the direction of a supervisor, per the ASQA Credential Policy | Trainer, Supervisor, Working-towards start, Days elapsed | RTO module |
| Qualification Delivery Risk | Red/amber/green risk rating for each qualification | Code, Qualification, Total Units, Active Trainers, Validated Units, Validation %, Risk | RTO module |
See Units and the competency matrix, Annual plans and Administrative staff and upskilling plans.
Report PDF export and toolbar
With Pro, each report’s toolbar changes:
- Download PDF replaces the browser-based Print / Save as PDF. The plugin generates the PDF on the server, in A4 landscape, with a header band showing the report title and generation details, your logo and brand colour (from Branding), and colour-coded statuses (green, amber, red, grey). Current drop-down filters apply. The file is named like
12345_report-document-status-20261005.pdf, where the prefix is your RTO code (Settings → General) when one is set. - Download XLSX replaces Download CSV (see below).
Excel export
🔒 Pro feature — requires the Pro plugin.
With Pro active and licensed, the Download CSV button becomes Download XLSX and produces a formatted Excel workbook. The workbook has:
- An information bar (row 1) with your organisation name, RTO code (if set) and generation details.
- A header row in your brand colour, with auto-filter drop-downs.
- Frozen panes, so the header row and first column stay visible as you scroll.
- Colour-coded status cells: green for current, approved or verified; amber for expiring, review due, returned, working towards or submitted; red for expired, overdue or missing expiry; grey for no expiry or unverified.
- A summary footer with the total row count and a “% compliant” figure for each status column.
- Print setup for A4 landscape, fit to width, with the header row repeated on each page.
The file name is prefixed with your RTO code when one is set. As with CSV, drop-down filters apply and the on-screen column filter boxes don’t. Free shows Download CSV here. If the Pro licence becomes inactive, the button goes back to CSV.
Audit preparation bundle
🔒 Pro feature — requires the Pro plugin.
The audit bundle puts every report into one ZIP file, ready to hand to an auditor or file away.
Who can run it: anyone with the “view reports” permission (administrators by default, not department coordinators). Each user can download it up to 5 times per hour. After that they see “You have exceeded the maximum number of audit bundle downloads per hour. Please try again later.”
How:
- Go to Attestation Core → Reports.
- Click Download Audit Bundle (ZIP) at the top of the report list.
- The bundle is built straight away, while you wait, and downloads as
attestation-core-audit-bundle-YYYYMMDD-HHMMSS.zip. Large organisations may wait a little while.
What’s inside:
- One PDF per report, covering every report in your list (the three Free reports plus the Pro reports active on your site), each run unfiltered. Files are named like
{RTO code}_{report}_{date}.pdf. - One Excel workbook,
{RTO code}_ComplianceReports_{date}.xlsx, with a cover sheet, a Summary Dashboard and one formatted tab per report. - README.txt, with your organisation name and RTO code, the generation time (in Melbourne time), who generated it, a unique export ID, the source site address, the plugin version, the report count and a list of every file with its row count. It ends with a confidentiality notice.
The description under the button mentions CSV spreadsheets and a manifest. The bundle actually contains PDFs, an XLSX workbook and README.txt as described above. Uploaded document files themselves aren’t included.
If it fails: “The ZipArchive PHP extension is not available on this server. Contact your host to enable ext-zip.” or “Could not create the ZIP archive. Ensure the temp directory is writable.” Both are server settings your host can fix. If the Pro licence is inactive, the bundle download doesn’t work. Reactivate under Settings → Licence.
Scheduled reports
🔒 Pro feature — requires the Pro plugin.
Scheduled reports email a report as a PDF attachment on a regular cadence. A typical use is a monthly Document Status report to your board or quality manager.
Where: Attestation Core → Settings → Scheduled Reports (Pro). You need the “manage settings” permission. The tab shows your site timezone (“Schedule times are entered in your site timezone: …”) and the next automated check time.
Adding a schedule (Add schedule):
| Field | What it does | Default |
|---|---|---|
| Report type | Any report in your Reports list | “Select report” (required) |
| Frequency | Weekly, Monthly or Quarterly | Monthly is used if the value is missing |
| Recipients | One or more email addresses, separated by commas, semicolons or new lines. Invalid addresses are dropped, and at least one valid address is required. | Blank |
| First run date/time | When the first email goes out, in site time. Later runs continue from this anchor (+1 week, +1 month or +3 months). | If left blank: one period from now |
| Active (“Enable this schedule”) | Paused schedules don’t send | Ticked |
Click Add scheduled report. Configured schedules lists each one with its report, frequency, recipients, Next run (site time), Last run (site time), status (Active or Paused) and actions:
- Send now sends the report immediately without changing the schedule. You’ll see “Scheduled report sent now.” or “Could not send the scheduled report now. Check recipients and mail configuration.”
- Delete asks you to confirm first (“Delete this scheduled report?”).
Recipients must be WordPress users. For privacy, a scheduled report is only sent to email addresses that belong to a user account on your site. Other addresses are skipped without warning. If none of the recipients qualify, the report isn’t sent. To send to a board member, create a WordPress user for them first. A Subscriber account is enough.
The email: subject “Scheduled compliance report: {report name}”. The body says the report is attached and when it was generated (UTC). The attachment is the branded PDF of the whole report, unfiltered. It’s sent from your organisation name and admin contact email. This wording isn’t editable, and scheduled sends don’t appear in the Notification Log.
The scheduled reports task: a background task checks for due schedules every 15 minutes through WP-Cron and sends up to 20 per run. While a schedule is due, an administrator loading any admin page also prompts a check, at most every 5 minutes. After a successful send, the next run moves forward by one period. If a send fails (no qualifying recipients, a mail error or a missing report), the schedule stays due and is tried again on the next check.
See also Automated email notifications and, for calendar views of upcoming runs, Compliance calendar.
Staff self-export of their compliance record
🔒 Pro feature — requires the Pro plugin.
Staff members, especially contractors who work for several organisations, often need to show their compliance record elsewhere. Pro lets each staff member download a branded PDF of their own record, with no admin involvement.
Setting it up:
- Create a page (for example “My Compliance Record”) containing the shortcode
[attestation_core_my_record], or let the portal-pages setup create it. It’s listed as My Compliance Record under Settings → Portal pages. - Once the page is mapped there, a My Compliance Record tile (“Download PDF”) appears on the staff dashboard.
What staff see: the heading “My Compliance Record”, a short explanation and a Download My Compliance Record button. Clicking it shows “Generating your compliance record…” and then downloads the PDF. If it fails: “Could not generate your compliance record. Please try again.”
What the PDF contains: six sections:
- Trainer Profile
- Credentials
- Unit of Competency Assignments
- Compliance Documents
- Currency Evidence History
- Annual Currency Plan History
It carries your organisation’s name, logo, brand colour and generation details. The file is named like {RTO code}_trainer-record-{first-last}-{date}.pdf.
Who can use it (the export-own-record permission): the “export own record” permission is granted automatically to any logged-in user who has an active compliance profile linked to their WordPress account. You don’t assign it by hand. The export only ever covers the signed-in user’s own record, because there’s no way to ask for someone else’s.
- Not logged in: “Please log in to view your compliance record.”
- Logged in without a linked, active profile: “Your account does not have a trainer record. Please contact your RTO administrator.”
- More than 10 downloads in an hour by the same person: “You have exceeded the maximum number of record exports per hour. Please try again later.”
Behind the button (the record export route): the button calls the plugin’s own secure endpoint for the signed-in user. The endpoint checks the export-own-record permission and a security token, builds the PDF and streams it back. Nothing is stored on the server afterwards.
When Pro is missing or unlicensed: without Pro, WordPress doesn’t recognise the shortcode and shows it as plain text, so only add the page once Pro is active. With Pro installed but the licence inactive, staff see an empty space where the shortcode is. Administrators see a notice (“Attestation Core Pro — licence inactive”) with a Manage licence button.
Worked example
A registered training organisation gets an audit notice with ten working days’ notice.
- The compliance manager opens Reports → Document Status, types “expired” into the Status filter box, and contacts the three trainers listed.
- She opens Evidence Audit Trail, sets Status to validated, clicks Filter and downloads the file to check that last year’s industry-engagement evidence is complete.
- With Pro, she clicks Download Audit Bundle (ZIP) the day before the audit. The ZIP contains a PDF of every report, a single workbook with a Summary Dashboard, and a README with the export ID and generation time. She files it as the “as at” snapshot.
- Two trainers who also work at another RTO use Download My Compliance Record on the portal to give that RTO their own PDF.
- Afterwards she sets up a Monthly scheduled Currency Gaps report to her own and the CEO’s WordPress accounts.
Troubleshooting
- “You do not have permission to export reports.” Your account lacks the “view reports” permission. Ask an administrator.
- A staff member is missing from a report. The Credential and Document reports only include active profiles, and only the first 500. The Document Status report only lists document types required for that person’s workforce type.
- The CSV doesn’t match what I filtered on screen. The column filter boxes only affect the screen. Use the report’s drop-down filters (where available) before downloading.
- A scheduled report never arrives. Check that each recipient’s address belongs to a WordPress user, that the schedule is Active, and that your site can send email (use Send test email on the Notifications tab). Then try Send now.
Related guides: Automated email notifications, Frontend staff portal, Privacy, security and data.