GRC For School Leaders: What The Compliance Job Looks Like Now

HR and compliance professionals in a school are the unrecognised architects of safety, structure and accountability. The role runs from onboarding staff to updating workplace policies, delivering mandatory training and recording serious incidents.

Essential, and increasingly complex. This page is about what the job actually involves now, why it grew, and what makes it manageable.

This article is general information for Australian schools, not legal advice. Obligations differ between states and territories, and between school types. Confirm what applies to your school with a qualified professional.

What Lands On The School Compliance Desk

Written as a position description it looks manageable. Written as what lands in a week, it looks different.

The area	What it means in practice	What it produces if done properly
Onboarding	Screening, contracts, induction, policy acknowledgement and initial training, for staff, casuals, contractors and volunteers	A complete record from day one, rather than a gap you discover later
Policy	Writing, updating, distributing and re-collecting acknowledgements when a version changes	A named person acknowledged a named version on a date
Mandatory training	Assigning by role, chasing completion, renewing before it lapses	Completion visible by campus and role, not one organisation-wide figure
Incidents and concerns	Receiving, escalating, investigating, closing, and noticing patterns across terms	A trail from report to closure, and a re-rated risk where it applies
Registers and expiry	Clearances, registrations, first aid, insurances, accreditations	A list of what expires in the next 30, 60 and 90 days, without a manual check
Reporting	Board packs, regulator returns, accreditation evidence and audit preparation	Retrieval rather than reconstruction

Why The Job Grew, And What Was Added

Compliance requirements in Australian education have grown consistently over the past decade. The role did not expand to match. Five things were added, and none were taken away.

What was added	What it asks of the school	Where to read it
Child safe standards	Screening, training, acknowledgement and a documented pathway for concerns, evidenced rather than asserted	National Principles · AHRC resources
Psychosocial hazard duties	Identify, assess and control psychosocial risks with the same discipline as physical ones. Duties now apply in every Australian jurisdiction	Safe Work Australia
Data protection	Student and staff data held under controls, and a breach response that starts on awareness	Privacy Act · NDB scheme
Industrial relations change	Award interpretation, record-keeping and pay slip obligations that shift	Awards · Record-keeping
Work health and safety	Duties on the school, and a personal due diligence duty on officers that cannot be delegated	Duties under WHS laws

Two of those five are worth putting a number against, because they are the ones school leaders most often treat as paperwork. Safe Work Australia’s Key Work Health and Safety Statistics, released in October 2025, reports the national picture.

The second number is the one that matters for a school. Psychosocial claims are not only rising, they cost far more working time per claim than anything else, which is why psychosocial hazard duties are now written into every jurisdiction rather than left as good practice.

This applies to Catholic systemic schools, independent schools, religious schools and government schools alike. The governance structures differ; the obligations largely do not. With increased scrutiny comes a larger surface to track, more people to support and more to report on, usually with the same headcount, the same budget and the same timeframes that managed a third of it ten years ago.

A Week In The Role

Not a bad week. An ordinary one, in a school of around 600 students.

Day	What lands	What it actually requires
Monday	Two casual relief teachers start; one clearance expires Friday	Verify, induct, assign training, and set a renewal reminder that will not be missed
Tuesday	A staff member raises a concern about a colleague’s conduct	Record it, escalate correctly, check the jurisdiction’s reporting requirements, and keep the trail intact
Wednesday	The child protection policy is updated	Re-issue for acknowledgement to every staff member, volunteer and contractor, and track who has not
Thursday	An excursion risk assessment is due, and a parent complaint arrives	Two different processes, two different records, both time-bound
Friday	The board pack is due Monday	Assemble training completion, incidents, expiries and risk movement from wherever they live

Nothing in that week is unusual and nothing in it is optional. The question is whether Friday is a report that gets produced in an hour, or a day spent reconstructing four sets of records from spreadsheets and email.

Where The Role Breaks

The breaking point	What it looks like	Why it happens
Everything depends on one person	When they take leave, renewals stop and nobody notices for a fortnight	The process lives in their head and their spreadsheets rather than in a system
Casuals and volunteers slip through	They arrive between induction cycles and miss the process entirely	Onboarding is built around permanent staff and a calendar
Version drift on policies	The policy was updated; the acknowledgements were never re-collected	Acknowledgement is not tied to the version, so an update does not reopen it
Reporting eats the week	The board pack takes a day, every time	Data lives in four places and has to be joined by hand
Multi-campus averages	One number that looks fine and hides one site	Reporting was built organisation-wide because that was easier
Chasing instead of owning	One person following up everybody else’s overdue actions	Actions route to compliance rather than to the manager responsible

The Invisible-Work Problem In School Compliance

The hardest part of GRC for school leaders is that the work is judged almost entirely by its absence. A term with no incidents, no findings and no complaints looks like a term where nothing happened, which makes it very hard to argue for resourcing.

The way out is to make the work measurable rather than to describe it. Four numbers do more than any narrative:

• Time to produce evidence for one staff member and one obligation. Baseline it, then show it falling
• Expiries caught before they lapsed, rather than after
• Proportion of corrective actions closed on time, term on term
• Hours spent assembling the board pack, which is the number an executive understands immediately

Those four turn an invisible job into a visible one, and they are the same four that tell you whether the compliance position is genuinely improving. The board-level version of this conversation is in what your school board should be asking about compliance.

What Actually Helps A School Compliance Role, In Order

1. One register for every person in a child-related role, regardless of employment type. Casuals, contractors and volunteers included. This closes the most common gap on its own.
2. Expiry visibility at 30, 60 and 90 days, produced without a manual check. Anything with a date attached is the highest-value thing to automate first.
3. Acknowledgement tied to policy version, so an update automatically reopens the requirement rather than relying on someone remembering.
4. Reporting by campus and role as the default, never organisation-wide only. Build it this way even with one campus, because it costs nothing now and a rebuild later.
5. Overdue actions routed to the manager who owns them, not to the compliance inbox. This is the change that makes the role sustainable.
6. A protected fifteen minutes a week to review what is overdue. Nothing forces it, which is why it is the first thing to lapse and the thing whose absence undoes the rest.

Software supports every one of those. It creates none of them.

What A GRC System Holds For A School Compliance Team

Once those six decisions are made, the question becomes where the records live. This is the practical shape of GRC for school leaders: one place holding six things that currently sit in five.

What it holds	What it replaces	What it produces
Training and completion records	Completions tracked in spreadsheets, chased by hand	Completion by role and campus, with automatic reminders before a renewal lapses
Policy distribution and acknowledgement	Revised policies sent as email attachments	Digital acknowledgement against a named version, monitored as responses come in
Incident and concern handling	A filing cabinet, or an inbox nobody else can see	A secure, confidential workflow with consistent follow-up and a documented trail
The risk register	A document that is opened once a year	Mitigation tasks assigned to named people, with progress visible between meetings
Leadership and board reporting	A week of assembling numbers from four places	Audit-ready reports drawn from live data rather than rebuilt each term
The audit trail	Nothing, in most schools	The record that makes every row above provable rather than asserted

Two things follow that are easy to underrate. The first is assurance: leadership can see that governance processes are holding, rather than trusting that they are. The second is time. A compliance role that stops chasing paperwork goes back to supporting the educators and staff who do the actual work of the school.

That is the difference between a reactive responder and a strategic partner, and it is why this is more than compliance box-ticking. The sequence for getting from spreadsheets to a system is in from spreadsheets to a GRC system.

Where To Go Next For School Compliance

If you are asking	Go to
What must we be able to evidence for child safety	Child safety compliance for Australian schools
What should our board be asking	What your school board should be asking about compliance
How do we get off spreadsheets, and in what order	From spreadsheets to a GRC system
What is GRC, in plain terms	What is GRC? Governance, risk and compliance explained
What do we gain by joining governance, risk and compliance up	The benefits of integrating GRC
What goes wrong when we implement a system	Overcoming GRC implementation challenges
We need compliance training for staff	Workplace compliance courses
What would a school system look like	Sentrient’s GRC system for schools

Frequently Asked Questions About GRC For School Leaders

1. What does GRC mean for school leaders?

Governance, risk and compliance run as one job rather than three. In a school that means child safe standards, work health and safety including psychosocial hazards, privacy, employment law and records, held together so an incident updates the risk, the policy update reopens acknowledgements, and the board pack is a view of live data rather than a reconstruction.

2. Who is usually responsible for compliance in an Australian school?

Most often the HR or compliance manager, frequently alongside a full operational role. Business managers and deputy principals carry it in smaller schools. The role is rarely titled ‘compliance’ and almost always broader than the title suggests, which is part of why it is under-resourced.

3. Why has school compliance work grown so much?

Five things were added over roughly a decade and none were removed: child safe standards, psychosocial hazard duties which now apply in every jurisdiction, data protection obligations, industrial relations change, and evolving work health and safety law. The obligations grew; the roles holding them generally did not.

4. What is the most common compliance gap in schools?

Casual relief staff, contractors and volunteers. They arrive between induction cycles and sit outside the main staff record, so nothing tracks their screening, training or expiry dates. One register for everyone in a child-related role, regardless of employment type, closes it.

5. How do I show the value of compliance work when nothing goes wrong?

Make it measurable. Time to produce evidence for one staff member and one obligation, expiries caught before they lapsed, corrective actions closed on time, and hours spent assembling the board pack. Those four turn invisible work into a trend an executive can act on.

6. Should overdue compliance actions go to the compliance manager?

No, and this is the single change that makes the role sustainable. Route overdue actions to the manager who owns the work rather than to the person who noticed. Compliance holding everybody else’s follow-up does not scale past one person, and it is a governance decision rather than a software one.

7. How often should mandatory training be refreshed in a school?

It depends on the topic and your jurisdiction, so confirm rather than assume. What matters operationally is that the renewal date is visible before it lapses, tracked by role and campus, and owned by someone. A training record that was accurate at induction and never revisited is the most common form of lapsed compliance.

Disclaimer: This article is general information for Australian schools, not legal advice. Obligations differ between states and territories and between school types. Confirm the requirements that apply to your school with a qualified professional.

Sources

National Office for Child Safety – National Principles for Child Safe Organisations

Australian Human Rights Commission – Child Safe Organisations resources

Safe Work Australia – Psychosocial hazards

Safe Work Australia – Key Work Health and Safety Statistics Australia 2025

Safe Work Australia – Duties under WHS laws

OAIC – The Privacy Act

OAIC – Notifiable Data Breaches scheme

Fair Work Ombudsman – Record-keeping

Fair Work Ombudsman – Awards

ACNC – Governance Standard 5: Duties of Responsible People

Read More

• Child Safety Compliance For Australian Schools
• What Your School Board Should Be Asking About Compliance
• From Spreadsheets To A GRC System
• What Is GRC? Governance, Risk And Compliance Explained