Vocational Training Sector
Hands-on support for accredited bodies, training agencies and corporate training academies: maintaining regional accreditation, managing and reporting on public and inter-professional funding, certification of competences, the 231 Model, data protection and quality management systems.
Sector challenges
Legal and financial standing, management capability, logistical and professional resources, designated process managers: the requirements have to be overseen every day, notified whenever premises or roles change and demonstrated during inspections, with suspension or withdrawal as a possible outcome.
Providers working in more than one Region live with accreditation schemes that differ in requirements, categories of training activity, designated roles, deadlines and control arrangements: several sets of documents to keep aligned without multiplying the work of the same people.
Class registers, attendance signatures, tracking of distance learning, trainers’ timesheets, supporting documents for expenditure: financial reporting on the basis of actual costs or of standard unit costs holds up only if the data is correct at source. Reductions in grant, withdrawal of funding and recovery of sums paid can arrive years later.
ESF+ and the regional programmes; the measures under the PNRR, Italy’s national recovery and resilience plan, now in their closure and control phase; the funding calls and training accounts of the inter-professional joint funds: each channel has its own eligibility rules, publicity obligations, prohibition on double funding and rules on cumulation, and they all bear on the same training project.
Handling public grants exposes the provider to liability under Italian Legislative Decree 231/2001: improper receipt and misappropriation of grants, aggravated fraud to obtain public funding, computer fraud and forgery of electronic documents, certain tax offences and bribery in dealings with funding bodies. The disqualification penalties include exclusion from grants and the withdrawal of those already awarded.
Personal records, data on vulnerability or disability among learners with special needs, registers, results and certificates, recorded lessons and e-learning platform logs, relations with client companies: data protection roles to be defined and retention periods to be reconciled with financial reporting obligations.
Areas of work
We check the requirements of the applicable scheme, put the accreditation file in order, clarify the duties of the designated process managers and how those roles are covered, and prepare the provider for documentary checks and on-site visits, with a single calendar for those accredited in more than one Region.
We map the cycle running from the funding call to final payment: application, start-up, management of classroom and distance learning, variations, physical and financial monitoring, financial reporting. We introduce controls at the points where findings arise, and indicators that management reads every month.
We analyse the predicate offences relevant to a training organisation, draft protocols on course design, selection of trainers and suppliers, attendance management and financial reporting, and provide support for the Supervisory Body (Organismo di Vigilanza, OdV) and for the whistleblowing channel required by Italian Legislative Decree 24/2023.
We build a plan of sample checks that mirrors the logic of first- and second-level controls: consistency between registers, timetables, certificates and expenditure, the keeping of supporting documents, documented corrective actions. A finding picked up in time is corrected; picked up later, it is repaid.
We define the roles in relation to client companies and funding bodies, the agreements with platform suppliers, the legal bases for learners and trainers, the processing of data on minors and of special categories of data, the retention of registers and the handling of breaches.
We build the management system on ISO 9001 and, for those who want a dedicated scheme, on ISO 21001 for educational organisations or ISO 29993 for learning services outside formal education, with satisfaction and outcome indicators that can be reused for accreditation and for funding calls.
We review the LMS platforms, portals and videoconferencing tools used in teaching: access rights and profiles, backup and restore, procedures for carrying on activities in the event of a cyber incident. We clarify which accessibility requirements apply to the individual provider and to the service delivered, since funding calls often refer to them as well.
Vocational training operates under a double constraint: it is an educational service, judged on the outcomes of those who take part, and it is an activity largely funded from public money, subject to rules on access, traceability and control. An accredited provider therefore lives with two sets of requirements: those of accreditation, which allow it to operate, and those of each funding call, which govern the individual project.
Accreditation is a regional matter. The national framework, from Italian Ministerial Decree 166/2001 to the State-Regions Agreement of 20 March 2008 on minimum standards, set out the families of requirements: legal and financial standing, management capability, logistical and professional resources, effectiveness of the activities carried out. But the scheme that counts is the one adopted by the Region or autonomous province in which the provider operates, with its own categories of training activity, designated roles, deadlines and verification arrangements: a status to be maintained and demonstrated when checks are made, not acquired once and for all. Many providers are also accredited for employment services under Italian Legislative Decree 276/2003, which brings a second set of requirements to oversee.
On funding, channels that follow different rationales sit side by side: ESF+, the European Social Fund Plus, and the regional programmes; the measures under the PNRR, Italy’s national recovery and resilience plan, now in their closure and control phase; the funding calls and training accounts of the inter-professional joint funds provided for by Article 118 of Italian Law 388/2000. The way expenditure is reported changes, whether on actual costs or through standard unit costs, but the underlying need does not: attendance, hours, trainers and expenditure must be traceable and consistent, and the documentation has to be kept for the period the programme requires. First- and second-level controls can lead to reductions in grant, withdrawal of funding and recovery of sums paid, even years later.
Added to this is the certification of competences governed by Italian Legislative Decree 13/2013, with the regional repertoires mapped onto the National Qualifications Framework and onto the Atlante del lavoro e delle qualificazioni, the national atlas of work and qualifications. Mandatory training for companies is a chapter in itself: Italian Legislative Decree 81/2008 and the State-Regions Agreements set requirements for trainers, rules on how training is delivered and record-keeping duties, and the applicable content has to be checked against the agreement in force, because the framework has been revised over time.
We start from real projects rather than from manuals: a sample of closed and ongoing files, the inspection reports already received, the findings and the reductions incurred. From there it becomes clear where the data goes wrong at source, and that is where it pays to act.
The first task is one of order: a single project file used for all funding calls, and an accreditation file that is always up to date. We apply the techniques of business process engineering to the management cycle: explicit responsibilities, controls built into the flow rather than added downstream, indicators on hours delivered, drop-outs, reporting times and findings received.
Public grants are the heart of the risk. With the 231 Model we turn the most exposed stages into protocols: who designs the course, who validates attendance, who signs off the financial report, how trainers and suppliers are selected. Alongside the Model we set up sample checks following the same logic as the external controls, and quality systems that serve both for ISO certification and as evidence for accreditation and funding calls. On the data side we define roles, legal bases and retention periods between the provider, client companies and platform suppliers, aligning data protection with financial reporting obligations.
The scope is defined together: a specific issue, such as a finding to be handled or a new scheme to be implemented, periodic oversight of obligations, or support during reporting peaks. The decisions remain with the provider’s own people: we bring regulatory insight, method and the ability to deliver, with responsibilities and timescales agreed at the outset and an engagement proportionate to the organisation.
Frequently asked questions
By first reconstructing what the inspector will ask for: constitutional documents and powers of representation, financial position and compliance with social security contribution obligations, contracts and appointments of the designated process managers, curricula and qualifications of the trainers, floor plans and conformity of premises and equipment, evidence of the activities carried out and of their results. On that basis we run a dry-run check against the same grid used by the regional scheme, close the gaps and leave the provider with a file that can be kept up to date, so that the next visit does not mean starting from scratch.
By separating what is common from what is local. We build a single framework of procedures, roles and records, calibrated to the strictest requirement among the applicable schemes, and onto that we graft the specific annexes for each Region, with a shared calendar of deadlines, renewals and notifications of change. The benefit is not merely formal: people work with a single set of documents and the differences stay confined to where they are needed.
The decree sets no size thresholds: what matters is the nature of the entity, because Article 1 excludes from its scope the State, territorial public entities and other non-economic public entities. For a private training organisation the risk area is inherent in the activity itself: the offences concerning public grants are committed in the very stages in which the provider works every day, that is, course design, attendance management and financial reporting, and the disqualification penalties strike precisely at the ability to continue accessing funding. In a small organisation the Model is a lean one: few sensitive activities, short protocols on financial reporting and on dealings with funding bodies, a Supervisory Body of proportionate size and information flows that genuinely work.
This has to be assessed case by case rather than settled by habit, by looking at who determines the purposes of the processing. Where a company commissions a course in order to meet training obligations of its own, and the provider designs, delivers, certifies and reports on it, each of them will as a rule act as an independent controller for its own purposes. In other cases, where the provider merely handles data on the company’s behalf, appointment as a processor under Article 28 of the GDPR is the right course. We reconstruct the actual flow of data, classify the roles, update privacy notices and contracts, and avoid one recurring mistake: signing a processor appointment in every agreement, regardless of who decides on the purposes.
It depends on the objective. ISO 9001 remains the basis and is the standard most often referred to by funding calls and regional schemes, in some cases as an alternative or a complement to specific accreditation requirements: the point has to be checked against the applicable scheme. Providers wanting to measure themselves against what is specific to training can adopt ISO 21001, designed for educational organisations and centred on learners and their outcomes, or ISO 29993 for learning services outside formal education. ISO 9001 and ISO 21001 share the harmonised structure of the management system standards and can therefore sit within a single set of documents, with an integrated audit; ISO 29993, which sets service requirements rather than management system requirements, should be tied into the existing system rather than layered on top of it.
Related services
Design, implementation and maintenance of certifiable management systems: ISO 9001, 14001, 45001, 27001, 37001, 50001 and the main sector and supply chain schemes.
Find out moreOrganisation, Management and Control Models under Italian Legislative Decree 231/2001, predicate offence risk assessment and support for the Supervisory Body (OdV).
Find out moreCompliance with EU Regulation 2016/679 and the Italian Privacy Code: assessment, record of processing, DPIA, policies and training.
Find out moreAn internal audit function delivered on an outsourced or co-sourced basis: risk-based audit plans, testing of controls and reporting to the board.
Find out moreMapping, analysis and redesign of business processes: we remove waste, reduce operational risks and prepare the ground for digitalisation.
Find out moreLet’s talk
Tell us your business priorities: in a first meeting with no obligation we look at your context and propose a concrete way forward, with clear timescales and measurable results.