Complaints & Appeals Handling Policy

This policy sets out how AusISA receives, handles, reviews, and decides outcomes for complaints and appeals made in relation to AusISA activities, decisions, conduct, and related administration.

This policy applies to all AusISA activities, including trainings, certification courses, events, competitions, and gated or vetted courses.

This policy applies to all persons involved in an AusISA activity, including participants, facilitators, helpers, staff, and third parties.

This policy does not apply to matters covered by a facilitator engagement agreement, except where that agreement expressly incorporates this policy.

This policy does not apply to privacy complaints, which are handled under the Privacy Policy and any applicable privacy process.

This policy does not apply to academic or assessment decisions where the Assessment Policy provides a separate review process (such as moderation); it does apply to appeals of assessment outcomes on the grounds in clause 12.2 once those processes are complete.

This policy applies during an activity and to post-delivery conduct that arises from, or is connected with, the engagement, including follow-up communication, handling of participant information, and use of AusISA materials.

This policy must be read with the Participant Conduct Policy, Facilitator Conduct Policy, Assessment Policy, Privacy Policy, Record Management Policy, and any other AusISA policy or procedure that applies to the engagement.

If this policy conflicts with another AusISA policy, the more specific policy applies to the extent of the inconsistency.

If a requirement in this policy cannot be followed, the issue must be raised with the policy owner at the time of identification so that an alternative course of action may be decided.

This policy operates subject to applicable Australian law, including the Australian Consumer Law. Nothing in this policy excludes, restricts, or modifies any right or remedy that cannot lawfully be excluded.

Where a participant is under 18 years of age, AusISA must handle any complaint or appeal in a way that complies with applicable Commonwealth, state, and territory law. A parent, guardian, or other legally authorised representative must lodge, support, or participate in a complaint or appeal for a person under 18 where required by law, or where AusISA considers it necessary to protect the person's interests, and AusISA must notify a parent or guardian where required by law or where the matter concerns a material risk, safety issue, or serious allegation involving a person under 18.

Complaint means an expression of dissatisfaction about an AusISA activity, decision, service, person, process, or outcome.

Feedback means a suggestion, comment, or observation that does not seek a remedy, review, or investigation. Feedback is welcomed and handled under the Continuous Improvement Policy.

Report or allegation of misconduct means a statement that a person may have breached an AusISA policy, code, rule, or legal obligation.

Safety incident means an event, circumstance, or near miss that creates or may create a risk to health, safety, or welfare. Safety incidents are handled under the WHS Policy.

Appeal means a request for review of a Reviewable Decision under this policy.

Reviewable Decision means a decision listed in clause 13.1, and does not include a decision that this policy, another AusISA policy, or applicable law makes final.

Notifiable incident means an incident that must be notified under applicable work health and safety law.

Conflict of interest means a situation where a person's private interest, relationship, or involvement could improperly influence, or reasonably be seen to influence, their judgment or decision-making.

Vexatious or bad-faith complaint means a complaint made mainly to harass, obstruct, intimidate, or cause unnecessary burden, rather than to raise a genuine issue.

Respondent means the person whose conduct, decision, or action is the subject of a complaint, report, or appeal.

Support person means a person who accompanies a party to provide emotional support or help with communication, but who does not speak on the party's behalf unless AusISA allows it.

Endorsing Entity means an organisation that endorses, controls, or sets requirements for an AusISA activity, including the Australian Signals Directorate (ASD) for IRAP training.

Facilitator means a person engaged by AusISA to deliver, assess, facilitate, or support an AusISA activity.

Participant means a person who enrols in, books into, attends, or otherwise participates in an AusISA activity.

AusISA Administration means the personnel authorised by AusISA to receive, triage, record, investigate, decide, or refer complaints and appeals under this policy.

AusISA must handle complaints and appeals fairly.

AusISA must give each person affected by a complaint or appeal a reasonable opportunity to be heard.

AusISA must manage complaints and appeals impartially.

AusISA must keep complaint and appeal information confidential to the extent reasonably practicable, subject to the need to investigate, decide, report, or comply with law, and consistent with the Privacy Policy.

AusISA must not retaliate against a person for making a complaint, raising a report, or lodging an appeal in good faith, and a person must not suffer detriment for doing so.

AusISA must provide a clear, plain-language process for lodging complaints and appeals.

AusISA must respond in a way that is proportionate to the seriousness, impact, and urgency of the issue, and must deal with complaints and appeals promptly.

AusISA must keep the cost to the complainant as low as reasonably practicable.

AusISA Administration must maintain the complaints and appeals register, consistent with the Privacy Policy and the Record Management Policy.

The policy owner must maintain this policy and review it when required.

The Complaint Handler must receive, triage, and manage complaints in accordance with this policy.

The Appeals Officer must review appeals, and must not be the original decision-maker for the decision under appeal.

The Endorsing Entity liaison must handle any issue that requires contact with, or coordination of, ASD or another Endorsing Entity.

A deputy or alternate must handle a matter where the assigned Complaint Handler or Appeals Officer has a conflict of interest, is unavailable, or is the subject of the complaint or appeal.

A complaint about the Complaint Handler or Appeals Officer must be handled by the policy owner or another person nominated by AusISA for that purpose.

AusISA Administration must escalate any unresolved or serious matter to the accountable person or governance board.

The Complaint Handler, Appeals Officer, and any deputy must record their actions in the complaints and appeals register.

A participant, a representative of a participant, or another external person may make a complaint by emailing courses@ausinfosec.academy.

A complaint may also be made anonymously, including without contact details, through the end-of-training survey, end-of-challenge survey, or the website contact form.

A facilitator or staff member may make an internal complaint through the trainer or staff meeting process, the internal survey, or the post-activity review process.

For a live event or competition, AusISA must identify a named on-site duty contact for real-time complaints and urgent issues.

AusISA must not require a person to use only one complaint channel if another channel is more suitable for the issue.

A person may bring a support person to any complaint meeting, unless AusISA reasonably refuses that request for a specific reason.

A person may request an interpreter or other reasonable adjustment to make a complaint or participate in the complaint process.

AusISA must record anonymous complaints and consider them. Where a complaint is made anonymously, AusISA may be limited in the feedback it can provide and the investigation steps it can take.

AusISA must acknowledge a complaint within 3 business days after receipt (P-001), unless the complaint is anonymous and cannot reasonably be acknowledged.

AusISA must triage the complaint within 5 business days after receipt (P-002).

During triage, AusISA must classify the matter as a complaint, feedback, report or allegation of misconduct, safety incident, or appeal, as defined in section 3, and route it to the correct process.

AusISA must assess whether the matter requires immediate action, a formal investigation, referral to another policy, or closure without further action.

Where an investigation is required, AusISA must investigate within a timeframe that is reasonable in the circumstances, having regard to the seriousness and complexity of the matter.

AusISA must make a decision once it has enough information to do so.

AusISA must communicate the outcome and reasons to the complainant within 10 business days after the decision (P-003), unless the complaint is anonymous or law prevents disclosure.

If the matter is a notifiable incident or otherwise requires reporting to an Endorsing Entity or another authority, AusISA must make the required report as soon as reasonably practicable.

AusISA must close the complaint once it has communicated the outcome or otherwise completed the required action, and must record the complaint and the outcome in the complaints and appeals register.

AusISA must classify each complaint during triage by type and severity using the definitions in section 3. A complaint may be classified under more than one type if the same matter raises multiple issues.

The main types are: content, facilitator, venue, sexual harassment, injury or safety, cost or refund, accessibility, certification or assessment integrity, privacy or data, and discrimination.

The classification must determine the lead process, the person responsible for handling the matter, whether an Endorsing Entity or another authority must be notified, and whether any mandatory reporting obligation applies.

Where a matter falls into more than one process, AusISA may run those processes concurrently if that is appropriate and lawful.

Where a complaint involves a safety issue, suspected criminal conduct, or a notifiable incident, AusISA must prioritise the relevant safety, reporting, or legal process.

Where a complaint is primarily about a decision under another AusISA policy, AusISA must route it to that policy first if that policy provides the relevant review or appeal process.

AusISA must record the classification and routing decision in the complaints and appeals register.

AusISA must handle complaints about delivery, venue, conduct, administration, and other matters within AusISA's control.

AusISA must forward or redirect complaints about Endorsing Entity–owned syllabus content, IRAP rules, assessor certification requirements, or other matters the Endorsing Entity controls, unless AusISA is authorised to decide the matter.

AusISA must notify the relevant Endorsing Entity of any matter that meets the notification threshold. The threshold includes any suspected security incident, certification integrity issue, or serious conduct issue involving an endorsed assessor.

AusISA must notify the Endorsing Entity immediately if the matter may affect security, certification integrity, or the standing of an endorsed assessor, or if DISP or other security obligations require prompt notification.

AusISA must record the steps taken to manage the matter, including whether AusISA handled the matter, referred it, or managed it jointly with the Endorsing Entity.

AusISA must provide a periodic governance update to the Endorsing Entity on matters that meet the reporting criteria set by AusISA or agreed with the Endorsing Entity.

Only an authorised AusISA representative may respond publicly on behalf of AusISA.

Where a complaint is raised publicly or online, AusISA must consider whether the matter can be moved to a private channel, and may ask the person to continue the matter by email or another private channel, provided AusISA does not dismiss the underlying issue without review.

AusISA may correct factual misinformation publicly if it is necessary to protect the integrity of the record or prevent ongoing confusion.

AusISA must not retaliate against a person for making a public complaint in good faith.

If a complaint names an individual staff member or facilitator, AusISA should give that person a reasonable opportunity to respond (with review and approval of content by an authorised AusISA representative) before any final public statement is made.

If a complaint may give rise to a defamation issue, AusISA must obtain legal advice before taking enforcement or litigation steps.

AusISA must not treat a complaint as vexatious or bad faith merely because it is difficult, repetitive, emotional, or unsubstantiated.

AusISA may issue a standard clarification and acknowledgement response where a complaint is unclear, incomplete, or lacks enough information to assess.

AusISA must record the complaint in the register before deciding whether any special handling is needed.

AusISA may apply a framework for unreasonable complainant conduct where a person makes serial, abusive, or excessively burdensome complaints. Any restriction on contact, format, frequency, or channel must be proportionate to the conduct and limited to what is necessary.

An unsubstantiated complaint made in good faith remains protected under this policy.

A complaint known to be false, malicious, or made in bad faith may itself be treated as misconduct or a breach of another AusISA policy.

A person may appeal only a Reviewable Decision, as listed in clause 13.1.

A person must identify at least one ground of appeal. The available grounds are: procedural error; new evidence that was not reasonably available at the time of the decision; a decision not supported by the evidence; bias or conflict of interest; and a disproportionate penalty.

A person may not appeal merely because they are unhappy with the outcome.

A person may not appeal a decision that is owned by an Endorsing Entity, a matter of professional judgement where no procedural error is alleged, or a decision made by a third party outside AusISA's control, unless another policy or written agreement gives a right of review.

A person must lodge an appeal within 1 month after being notified of the Reviewable Decision (P-004), unless AusISA allows a later lodgement for good reason.

The Appeals Officer must be independent of the original decision-maker. AusISA may use a panel for a serious or complex appeal.

The Appeals Officer or panel may uphold, vary, overturn, or remit the decision for reconsideration.

A person has one internal appeal right under this policy unless another AusISA policy or applicable law provides a further internal review. After AusISA completes the internal appeal process, the person may seek any external review or remedy available under law.

During an appeal, the original decision remains in force unless AusISA decides otherwise. A safety suspension remains in force during an appeal unless AusISA decides that a different interim measure is appropriate.

AusISA may hold an assessment result, impose a no-contact direction, stand a person down, or apply another interim measure while it investigates or determines an appeal, if that is necessary to manage safety, fairness, or the integrity of the process.

Appeals under this policy are free. This clause does not apply to a candidate-requested third moderation of an assessment, which is a marking review under the Assessment Policy, is charged in accordance with that policy, and is quoted before it takes place.

The following decisions are Reviewable Decisions for the purposes of this policy:

Competition appeals must be lodged within the shorter time limit stated for the relevant competition, and must be decided by the judges panel or other arbiter named for the relevant competition. Competition appeals must be decided quickly, because competition results must finalise without unnecessary delay.

If another policy or the relevant activity terms state that a decision is final or not reviewable, that statement applies to the extent permitted by law.

If a matter under this section also involves a complaint, AusISA may deal with the complaint and the appeal separately or together, depending on the issue and the applicable process.

AusISA must tell the respondent the substance of the complaint or appeal, unless doing so would create a safety risk, breach a legal duty, or compromise an active investigation.

AusISA must give the respondent a reasonable opportunity to respond and provide counter-evidence.

The respondent may bring a support person, subject to any reasonable limits needed to keep the process orderly.

AusISA must not decide a matter on the basis of unsupported accusation alone.

AusISA must keep complaint and appeal information confidential to the extent reasonably practicable, subject to mandatory reporting, safety, legal obligations, and any Endorsing Entity notification requirement.

A person must not retaliate against a complainant, respondent, witness, or support person for participating in a complaint or appeal in good faith. A person who retaliates may be subject to separate action under this policy or another applicable AusISA policy.

Any person involved in triage, investigation, or appeal must declare any actual or perceived conflict of interest as soon as they become aware of it, and AusISA must manage any conflict of interest by reassignment, delegation, or another reasonable control measure.

This policy operates subject to applicable law. If a legal requirement applies to a matter involving a person under 18 years of age, the legal requirement prevails to the extent of any inconsistency.

AusISA must keep a complaints and appeals register.

The register must record, at minimum: the date received; the complainant or appellant if known; the subject matter; the classification; the assigned handler; the response taken; the outcome; any conflict of interest declared; and any referral or escalation.

AusISA must record the status of each matter and the steps taken to manage it.

AusISA must retain complaint and appeal records in accordance with the Record Management Policy and any applicable law.

Access to complaint and appeal records must be limited to persons who need the information to perform their role.

AusISA may use de-identified complaint and appeal information for reporting, monitoring, and continuous improvement.

AusISA must review complaints and appeals trends on a periodic basis, and must report complaint and appeal trends to leadership at intervals set by AusISA.

AusISA must use complaints and appeals data to support continuous improvement and related policy review. This section operates in conjunction with the Continuous Improvement Policy.

A person who remains dissatisfied after AusISA completes the internal process may seek any external review, complaint pathway, or statutory remedy available to them.

Depending on the subject matter, that may include the Office of the Australian Information Commissioner, SafeWork or Comcare, the Australian Human Rights Commission or a state or territory equal opportunity body, a consumer protection or fair trading authority, police, or the relevant Endorsing Entity.

Nothing in this policy limits any right, obligation, or remedy under applicable law.

If the matter is within an Endorsing Entity's remit, AusISA may refer the person to the Endorsing Entity or assist with the referral where appropriate.

This policy is reviewed at least every 12 months (P-016), and earlier where an incident, legal change, or continuous-improvement finding warrants an out-of-cycle review.