Currency Attestation & Annual Plans

This guide covers two related ways staff confirm their professional currency:

Sign & Attest (free plugin). A one-click declaration on the staff portal dashboard. The staff member confirms that the credentials and documents on record are current and accurate, and the plugin stores a tamper-evident record of that declaration.
Annual plans (Pro). A yearly plan of the professional development and practical or vocational activities each staff member intends to complete. Staff build and submit the plan from the portal, and an administrator approves it or returns it for changes.

Both features help you gather evidence for internal reviews and external audits. Neither one makes your organisation compliant by itself. They record what staff declared and when, so the evidence is ready when you need it.

Wording follows your industry preset. The generic defaults are “staff member”, “Professional development” and “Practical experience”. With the Pro RTO module, these become “Trainer/Assessor”, “Training & Assessment currency activities” and “Vocational currency activities”, and plans are called “Currency Plans”.

Sign & Attest currency declaration

What it is and who uses it

Staff often need to confirm, at a point in time, that everything on file about them is still true: their licences are current, their checks are valid and nothing has lapsed without being reported. Sign & Attest captures that confirmation in the portal. It does not need email or paper forms.

Staff members sign the declaration from their portal dashboard.
Administrators review the full history on each staff member’s profile.

Sign & Attest is part of the free plugin and needs no licence.

Where it appears

The declaration panel sits at the bottom of the Compliance Portal (Dashboard) page, which is the page that contains the [attestation_core_dashboard] shortcode. It is headed Sign & Attest credentials current. See Frontend staff portal for how to set up the portal pages.

How a staff member signs

Sign in and open the portal dashboard.
Scroll to Sign & Attest credentials current. If you haven’t signed today, the form is already open. If you have, the panel shows “✓ You attested today. Your declaration is on record — there is nothing more to do right now.” and the form is folded away under Re-sign today.
Tick the declaration: “I declare that the credentials and documents on record are current, accurate, and complete to the best of my knowledge.”
Select Sign & Attest.
A status message confirms the result: “Attestation recorded. Your declaration has been signed and stored.” The panel then shows Last signed: with the date and time in UTC.

Staff can sign as often as they like, including more than once a day. Each signature creates a new record, and earlier records are never overwritten.

What is captured

Every signature stores:

Item	Detail
Date and time	When the declaration was signed, recorded in UTC
IP address	The visitor’s direct connection address. Forwarded headers are ignored, so behind some proxies this may be the proxy’s address.
Credential hash	A 64-character fingerprint (HMAC-SHA-256, keyed with a secret unique to your site). It covers the staff member, the timestamp, the IP address and a snapshot of every document on their profile at that moment: document type, status, expiry date and verification state.
Algorithm	Stored as `hmac-sha256-v1`, so future versions can tell how the hash was made

The hash shows exactly what state the documents were in when the staff member signed. If those records are later changed, the stored fingerprint no longer matches them.

Where administrators see the history

Go to Attestation Core › Compliance Profiles and open the staff member’s profile.
Select the Attestations tab (after Credentials, Documents and Evidence).
The Currency attestation history table lists the 50 most recent signatures, newest first. Columns are Date & time (UTC), IP address, Hash (first 16 chars) and Algorithm.

If the staff member has never signed, the tab says: “No attestations on record yet. The staff member can sign their first currency attestation from the compliance dashboard portal.” The history is read-only, and administrators can’t add, edit or delete entries.

Permissions

Anyone linked to an active compliance profile can sign. They get this right through the profile link, not through their WordPress role.
Visitors who aren’t signed in see a Sign in required panel instead of the dashboard.
Signed-in users without a linked active profile see No compliance profile on file.

Notifications

Sign & Attest sends no emails, and no scheduled job is attached to it. Reminding staff when to attest is up to you, for example before an audit or at each review cycle.

Data and privacy

Attestation records are included when a site administrator runs the WordPress personal data export (Tools › Export Personal Data), under “Currency Attestations”. Erasing a staff member’s personal data (Tools › Erase Personal Data) removes their attestation records, because those records contain an IP address.

Troubleshooting

Message	Cause and fix
“Please confirm the declaration before submitting.”	The checkbox wasn’t ticked. Tick it and select Sign & Attest again.
“No profile is linked to your account.”	The WordPress account isn’t linked to an active compliance profile. An administrator needs to link the user on the profile, or set the profile’s status back to Active.
“A network error occurred. Please try again.”	The browser couldn’t reach the site, or the page had been open so long that its security token expired. Reload the page and sign again.
Nothing happens when you select Sign & Attest	The portal’s scripts only load when the `[attestation_core_dashboard]` shortcode is in the page content itself, not in a widget or theme template. Move the shortcode into the page body.

🔒 Pro feature — requires the Pro plugin.

Submitting an annual plan

What it is

Each year, staff record the activities they plan to complete to keep their skills current. The plan has two sections:

Section	Generic wording	RTO module wording
First section	Professional development	Training & Assessment currency activities
Second section	Practical experience	Vocational currency activities

Administrators can rename both headings under Settings › Labels (that tab appears once you tick Show advanced label customisation tab under Settings › General).

Where to find it

Staff use a portal page that contains the [attestation_core_submit_plan] shortcode. With an active Pro licence, the page appears as Annual Plan under Attestation Core › Settings › Portal pages, and Auto-create missing portal pages creates it for you. Once the page is mapped, the portal dashboard shows a Development plan tile linking to it.

Filling in the plan

Open the Annual Plan page. The heading shows the year, for example “2026 annual compliance plan”, with a status badge: Draft, Submitted, Approved or Returned.
Under the first section, add at least one activity. For each one, enter:
- Activity description (required to keep the row). Rows with an empty description are dropped when you save.
- Planned date (optional).
Select Add activity for more rows, or × to remove one. A screen reader announces “Activity row added.” or “Activity row removed.”
Under the second section, add the activities you plan for your practical or vocational area. Each row also has a Unit dropdown listing the units assigned to you, so you can link the activity to the relevant unit.
- If you have no units assigned, this section is optional. The hint says you can submit with the first section alone.
- If you do have units assigned, at least one activity is required in this section.
Select Save draft at any time. You’ll see “Plan saved as draft.” and you can come back later.
When the plan is ready, tick the declaration checkbox and select Submit plan. The draft is saved and submitted in one step. You’ll see “Plan submitted. Your administrator will review it.” and the form locks.

The default declaration reads: “I declare the information above is accurate and was prepared by me. I understand submission captures my IP address and a checksum of the plan for audit purposes.” Administrators can change this text (see Settings below).

What is captured on submission

When a plan is submitted, the plugin records:

the submission date and time (UTC)
the submitter’s IP address
the WordPress user who submitted it
a declaration hash: a tamper-evident fingerprint (HMAC-SHA-256) of the plan, its activities and the submission details

A permanent snapshot of the activities is also stored for each submission, so earlier versions survive if a plan is returned and resubmitted.

Once submitted or approved, the plan page is read-only. It shows a Declaration audit table with the Submitted time and the Declaration hash, followed by the activity list. Staff don’t need to note the hash down; the page says so.

Plan years

The plan defaults to the current year. When more than one year is available, a Plan year navigation shows every year you already have a plan for, plus the current and next year. You can also open a specific year by adding ?attestation_core_plan_year=2027 to the page address. Only years from 10 years ago to 5 years ahead are accepted; anything else falls back to the current year.

Drafts and returned plans

A plan can be edited while it is Draft or Returned.
When an administrator returns a plan, their comment is shown above the form under Administrator comment:.
Saving a returned plan moves it back to Draft, and the administrator’s comment is no longer shown on the form. Copy the comment somewhere first if you’ll need to refer to it.

Settings that affect plans

These settings live in the free plugin under Attestation Core › Settings › General. They only take effect when Pro is active.

Setting	What it does	Default
Annual plan due date (Day and Month)	The day and month each year’s plan is due. It is copied onto each plan when the plan is first created, so changing it later doesn’t move the due date of existing plans.	28 February
Plan declaration statement	The text shown beside the declaration checkbox on the plan form. Plain text only; HTML is stripped. Leave it blank to use the shipped default. Changing the wording doesn’t affect how the IP address and hash are captured.	Blank (shipped default used)

Note: the help text under this field mentions the Sign & Attest form, but the statement is actually used on the annual plan form. The Sign & Attest declaration wording is fixed.

The plan REST route (for integrators)

The portal form talks to a REST endpoint. You only need this if you’re building your own front end.

Endpoint: POST /wp-json/attestation-core/v1/plan
Who can call it: signed-in users linked to an active profile, with a valid WordPress REST nonce
Parameters:
- action: save (the default) or submit
- plan_year: a whole number; defaults to the current year
- items: a list of activities, each with section (ta or vocational), description, planned_date (YYYY-MM-DD) and unit_id

Saving replaces the plan’s activity list with the one you send. Submitting needs an existing draft, so save first.

Troubleshooting

Message	Cause and fix
“Please confirm the declaration before submitting.”	Tick the declaration checkbox, then select Submit plan.
“At least one … activity is required before submission.”	Add an activity with a description to the section named in the message.
“This plan cannot be edited in its current status.”	The plan has already been submitted or approved. Ask an administrator to return it or reopen it.
“Not permitted — Your account does not have permission to submit a plan.”	The Pro licence isn’t active, or the account isn’t linked to an active profile. See Licensing and updates.

Administrative staff use a separate upskilling plan instead. See Administrative staff and upskilling plans.

Reviewing and approving plans

Where to find it

Go to Attestation Core › Plans. The browser tab reads “Annual Plans”, and the page heading uses your plans label: “Compliance Plans” generically, or “Currency Plans” with the RTO module. Only users with the plan-management permission see this menu item, which administrators have by default. It also requires an active Pro licence.

The plans list

Columns: staff member, Year, Status, Due, Submitted and Updated. Twenty plans are shown per page.
Filters: All years (or one year) and All statuses (Draft, Submitted, Approved or Returned). Select Apply after choosing.
Bulk actions: Approve selected, Return selected and Delete draft selected. Approve and Return only affect plans that are currently Submitted, and Delete only affects Drafts. Any other plans you selected are skipped. Bulk actions don’t send emails and don’t record a reviewer or comment. If you want the staff member notified, approve or return the plan from its own page.
Add Compliance Plan (Add Currency Plan with the RTO module) creates a plan for a staff member. Choose the staff member and Plan year, and optionally a Due date, which defaults to the next occurrence of the plan due date from Settings.

Reviewing one plan

Open a plan to see:

Due date, Submitted at and Submitter IP
Declaration hash, with a check badge: Verified (the plan matches what was submitted), Tamper Detected (the stored record has changed since submission) or Legacy — Unverifiable
Reviewed by and the Admin comment
both activity sections, with linked units

While a plan is Draft or Returned, administrators can also add items (Add a plan item), remove items, submit the plan on the staff member’s behalf (Submit plan) or delete a draft (Delete draft plan).

Approving, returning and reopening

Action	Available when	What you enter	Result
Approve plan	Submitted	Approval comment (optional)	The status becomes Approved and is locked for editing. Your name and the time are recorded.
Return to staff member (the button names your staff label, e.g. “Return to trainer/assessor”)	Submitted	Return comment (required)	The status becomes Returned and the staff member can edit and resubmit. If the comment is left empty, you’ll see “A comment is required when returning a plan.”
Reopen plan	Approved	Reason for reopening (required)	The status becomes Returned. The reason is added to the top of the admin comment as “[Reopened by Name on date UTC] reason”, so the history is kept.

Approved plans are retained and can’t be deleted. Only drafts can be deleted.

Plan lifecycle emails

The status changes below send an email through the standard notification system. Each one can be switched on or off, and its subject and body edited, under Attestation Core › Settings › Notifications. See Automated email notifications.

Notification	Trigger	Recipient	Default subject
Annual plan submitted	A plan is submitted, from the portal or by an admin	The Admin contact email from Settings › General, or the WordPress site admin email if that’s blank	[Organisation] Annual plan submitted — awaiting review
Annual plan approved	Approve plan on the plan page	The staff member	[Organisation] Annual plan approved
Annual plan returned for revision	Return or Reopen plan on the plan page	The staff member (the email includes your comment)	[Organisation] Annual plan returned for revision

The default “submitted” email body is worded to the staff member (“Thank you — your annual development plan … has been submitted”), but it goes to the admin contact address. You may want to reword it under Settings › Notifications.

Templates for Annual plan due soon and Annual plan overdue also appear in the notifications list, but this version doesn’t send them automatically. A daily check flags overdue plans internally without emailing anyone. Until that changes, use the Annual Plan Status report (under Reports) or the plans list filtered by status to chase late plans.

Reporting

The Annual Plan Status report lists the status and submission audit (timestamp, IP address and declaration hash) for every plan on file. See Compliance reporting and audit exports.

What a Free user or an unlicensed Pro install sees

Free only: there is no Plans menu. The [attestation_core_submit_plan] shortcode isn’t recognised, so WordPress shows the shortcode text as written on the page. The due date and declaration settings appear but have no effect.
Pro installed, licence inactive: the Plans menu is hidden. The plan page still loads, but staff see “Not permitted — Your account does not have permission to submit a plan.” Existing plan data is kept and becomes available again once the licence is reactivated.

Worked example

Riverbend Training College, an RTO with the RTO module active, sets Annual plan due date to 31 March. In February, a Trainer/Assessor opens the Annual Plan page. They add two Training & Assessment currency activities: an assessment validation workshop in April, and a TAE upgrade webinar in June. They also add one Vocational currency activity: an industry placement in August, linked to their assigned unit. They save a draft, come back a week later, tick the declaration and select Submit plan.

The compliance manager receives the “Annual plan submitted” email. She opens Attestation Core › Plans, filters by Submitted and opens the plan. The hash badge shows Verified. She returns the plan with the comment “Please add a planned date for the placement.” The trainer gets the “returned” email, adds the date and resubmits. The manager then approves the plan. Throughout the year, the trainer also uses Sign & Attest on the dashboard each time they upload a renewed document, which builds a dated history on their profile’s Attestations tab.

Was this helpful?