Staff Certificate and Licence Tracking Software: Complete Guide

Why This Is a Control, Not Admin

In most workplaces an expired certificate is paperwork. In regulated Australian sectors it is a breach, and the distinction matters because it changes who carries the consequence.

NDIS providers operating under the NDIS Practice Standards, overseen by the NDIS Quality and Safeguards Commission, must ensure workers delivering risk-assessed supports hold a current Worker Screening Clearance. Deploying an uncleared worker is a Practice Standards breach and the Commission can act on registration.

Aged care providers answer to the Aged Care Quality and Safety Commission against the Aged Care Quality Standards, which require a process for verifying that the workforce has the skills and qualifications to deliver care safely. Note that Australia's aged care legislative framework has been undergoing substantial reform, so check the current Act and Standards applying to your service rather than relying on any secondary source, this one included.

Childcare and early education services operate under the Education and Care Services National Law and the National Quality Framework, which set qualification requirements for educators and ratios that must hold throughout the operating day. A service operating outside its qualified ratios is in breach of its approval. Our Children's Services Award rostering guide covers the rostering consequences.

Security workers must hold a current state-issued licence for their class, and employing an unlicensed guard exposes the employer to prosecution under state legislation.

Different regulators, same underlying structure. The obligation sits with the employer, it is assessed at audit, and the evidence has to exist at the time the work happened rather than being assembled afterwards.

The Reason Spreadsheets Fail

Not laziness. Arithmetic.

Look at the second column. Twelve months, three years, five years, two to three years, one to five years. None of those cycles align. A worker who joined in March 2022 has credentials falling due in completely unrelated months for the rest of their employment, and every new hire adds another set of unsynchronised dates.

That is why the quarterly spreadsheet review fails. It is not that nobody looks. It is that a periodic review only catches what happens to be expiring near the review, and the whole problem is that expiry dates scatter. Around twenty staff with three credentials each you are managing sixty independent dates, and the failure becomes a matter of when rather than whether.

The CPR certificate deserves specific mention because it is the one most often missed. A twelve-month cycle renews four times as often as first aid, and because people mentally bundle the two together as first aid training, the CPR component quietly lapses while the first aid certificate is still current.

What Tracking Software Actually Does

Three functions, and it is worth being precise about the third because it is routinely oversold.

A credential record per person. Certificate type, issue date, expiry date, and ideally the reference or licence number, held in one place rather than across a filing cabinet, an inbox and someone's memory.

A review you can actually run. Be precise about what your system does here, because vendors blur it. GetMyRoster records expiry dates; it does not send automated reminders. That means somebody has to open the list on a schedule. Thirty days of lead time is a sensible target for anything with a long cycle, because renewals like screening clearances are not same-day processes, so set the review cadence tight enough to give that runway.

A check before the roster goes out. The value is in catching a lapse while the roster is still being built, when it is cheap to fix, rather than after the shift has been worked. That check is a human step supported by the record, not something the software performs on your behalf.

On that last point, be clear about what the software is doing. GetMyRoster stores each credential and its expiry date so the status can be checked before a roster is published. It does not remove your obligation under the NDIS Practice Standards, the aged care Standards or the National Quality Framework to deploy appropriately qualified people. Any vendor implying that a green tick in a rostering tool constitutes compliance is overselling, and providers who treat it that way have misread where liability sits. The flag catches the Friday-afternoon error made under time pressure, which is a genuinely valuable thing and a different claim from guaranteed compliance. NDIS providers in particular should hold that distinction clearly.

Staff certificate management is included on the free plan, which covers up to 5 users at a single location along with the web dashboard, mobile apps and notifications. The GPS time clock, award costing and staff availability management are paid.

Setting It Up So It Survives Contact With Reality

Audit before you configure. Collect every credential for every currently rostered worker into one sheet first. This pass is the point of the exercise, because providers routinely find two or three credentials that already lapsed. Finding them on a Tuesday is enormously better than finding them at audit, and it is also the moment the business case makes itself.

Load rostered staff, not the whole payroll. The casual who worked four shifts two years ago can wait. Get the active workforce correct and expand from there.

Name who runs the review. A credential list nobody owns is decoration. Write down who checks it, how often, and the window they act in. Then write down what happens if the renewal does not arrive before expiry, because that decision, standing the person down or finding cover, is far better made as policy in advance than as an argument on the morning.

Record the reference number, not just the date. At audit you will be asked to evidence the credential, not assert it. A clearance number lets you verify against the issuing register; an expiry date on its own does not.

Re-verify, do not just trust the stored date. Clearances can be suspended or revoked mid-term without the expiry date changing, which is a scenario a date-based system cannot detect on its own. Periodic verification against the issuing authority remains necessary, and it is the gap most providers do not realise they have. Further context in the SCHADS Award guide and Fair Work rostering requirements.

What Auditors Actually Ask For

Providers prepare for credential audits by assembling certificates. Auditors tend to ask something slightly different, and the gap is where findings come from.

Not just what you hold, but what you held then. The question is rarely whether a worker is qualified today. It is whether they were qualified on the shifts they worked. That is a historical question, and a system holding only current status cannot answer it. Keep the history, including superseded certificates and their date ranges, rather than overwriting a record at renewal.

How you knew. Sighting a certificate is not the same as verifying it against the issuing authority. For clearances with an online register, verification is the stronger evidence and takes a minute. Record that you did it and when.

What happened when something lapsed. Auditors are realistic; credentials lapse in every organisation. What they examine is what followed. A provider who can show the alert fired, the worker was stood down from affected shifts, cover was arranged and the renewal was verified before return is demonstrating a functioning system. A provider with no record of any of it is demonstrating the opposite, even if the outcome happened to be fine.

Who was accountable. Named roles, not "the team". If nobody owns the alert, the process does not exist in any meaningful sense.

The useful reframe is that an audit tests your process, not your paperwork. A perfect set of current certificates with no evidence of how it is maintained reads as luck. An imperfect set with a clear trail of detection, action and verification reads as control, and control is what is actually being assessed.

Which is also the argument for getting this out of a spreadsheet. A spreadsheet records a state. It does not record that an alert fired on the 14th, who saw it, or what they did about it. That trail is the difference between saying you manage credentials and being able to show it. For the rostering side of these obligations, see staff availability management.