Notice

Imposition of a monetary penalty on Innovate Awarding Limited

Published 27 October 2026

Applies to England

Introduction

1. 1. This notice sets out the final decision, made by The Office of Qualification and Examinations Regulation (“Ofqual”) on 2 October 2026, to issue Innovate Awarding Ltd (“IAO”) with a monetary penalty under section 151A of the Apprenticeships, Skills, Children and Learning Act 2009 (“ASCLA”) in the sum of £185,000 for breaches of Ofqual’s General Conditions of Recognition (“the Conditions”).

2. 2. In accordance with section 151A (4) of ASCLA, Ofqual served IAO with a Notice of Intention to impose a monetary penalty on 30 September 2026.

3. 3. Ofqual determined it was not necessary to publish the Notice of Intention. On 1 October 2026, and in accordance with the settlement agreement, IAO confirmed it had no representations to make and was content for Ofqual to proceed to final decision.

Executive Summary

1. 4. On 1 April 2010, Ofqual recognised IAO Qualifications as an awarding organisation under section 132(1) ASCLA. IAO has a broad scope of recognition to develop, deliver and award a range of vocational and technical qualifications.

2. 5. In April 2024 IAO submitted an event notification to Ofqual explaining that it was investigating potential malpractice / maladministration in relation to 108 Learners studying Level 3 Diploma in Business Administration (“the Qualification”) at an IAO approved Centre, namely Centre A.

3. 6. IAO provisionally approved Centre A in April 2023, on the basis that the Centre had been approved by a different awarding organisation (“AO”) and upon the Centre providing External Quality Assurance / Assurer (“EQA”) reports showing no concerns had been raised by the other AO. IAO approved the Centre and permitted it to register and certificate Learners using Direct Claims Status (“DCS”) after conducting its own EQA visit in May 2023.

4. 7. In January 2024 IAO discovered Centre A was registering and certificating Learners within 24 hours, contrary to IAO’s policy that Learners must be registered when they are 25% of the way through their qualification. IAO removed the Centre’s DCS and in February and April 2024 carried out EQA activity. IAO were informed that a further 108 Learners were registered and due to be certificated. IAO therefore scrutinised 80 of these Learners’ portfolios and identified significant concerns in all portfolios. IAO suspended the Centre from registering additional Learners.

5. 8. IAO focused its initial enquiries on the 108 Learners that were due to be certificated.

6. 9. Ofqual carried out an investigation into IAO (“the Investigation” or “Ofqual’s Investigation”) on 25 March 2025. The Investigation included a review of records relating to a number of Centres responsible for delivering the Qualification, including Centre A.

7. 10. It was identified that between 1 January 2021 and 31 December 2024, IAO certificated 858 Learners for the IAO Level 3 Diploma in Business Administration. 851 of those Learners were registered by Centre A.

8. 11. The Investigation made the following key findings:

   1. 11.1 Weak governance, planning and Centre approval controls: IAO lacked effective systems of planning and control to identify and assess risk before approving Centres. Due diligence was limited, higher-risk indicators were not systematically assessed, and [Centre A] was approved and permitted to register Learners before key governance, compliance and fraud prevention arrangements had been adequately reviewed.

   2. 11.2 Ineffective quality assurance and risk management: IAO failed to operate a sufficiently robust risk-based quality assurance framework. Learner identity checks were not applied effectively, compliance with key Centre Agreement requirements was not consistently verified, and concerns identified through EQA activity were not appropriately escalated or managed as potential malpractice risks.

   3. 11.3 Failures in assessment, certification and DCS controls: IAO did not ensure Learner evidence was assessed and certificated in accordance with the Qualification requirements. It awarded Direct Claims Status (DCS) contrary to its own policies and without sufficient evidence of compliance, failed to identify invalid assessment decisions promptly, and did not take timely action where Learners had been certificated based on non-compliant assessment evidence.

   4. 11.4 Insufficient monitoring and malpractice investigations: Despite holding management information and receiving multiple warning signs, IAO failed to detect and investigate unusual registration and certification activity in a timely manner. When concerns were identified, its investigations were not sufficiently robust, did not adequately consider the full scale of potential impact, and were not conducted in accordance with its own malpractice procedures.

   5. 11.5 Weak data management, record keeping and oversight: IAO failed to maintain accurate, reliable and auditable records to demonstrate that key controls, approval decisions and investigations had been carried out effectively. Weaknesses in data quality, documentation, evidence retention and internal oversight limited its ability to monitor compliance, demonstrate effective control, and manage risks to the integrity of its qualifications.

9. 12. Further to paragraphs 9 and 11 above, IAO only expanded its investigations into all previously certificated Learners once prompted by Ofqual during the Investigation. IAO fully completed revocation of invalid certificates in August 2026, over 2 years after it first became aware of concerns in January 2024.

10. 13. IAO has admitted that in relation to those matters, it breached the following Conditions: A5.1, A5.2, A6.1, A6.2, A8.1, A8.2, A8.3, B4, C1, C2, G8.1(b), H2, H5.3(b).

Allegations

Allegation 1

1. 1.1 Before provisionally approving one or more Centres, IAO did not undertake adequate checks and take reasonable steps to understand the extent to which the ownership and control of the Centres posed a risk to IAO’s ability to comply with its Conditions of Recognition.

2. 1.2 In circumstances where one or more Centres had previously been approved to deliver qualifications via another AO, IAO required those Centres to provide at least 2 recent EQA reports for review, prior to IAO approval. In relation to one or more of those Centres, IAO did not, prior to provisional approval, undertake adequate checks with those AO’s regarding:

   1. a.    The authenticity and accuracy of those EQA reports;

   2. b.    Whether there had been any historic instances of malpractice and/or maladministration involving those relevant Centres;

   3. c.     Whether the relationship between the relevant Centre and original AO had ceased.

3. 1.3 IAO granted full approval to one or more Centres in circumstances where:

   1. a.    IAO had failed to remedy the issues at Allegations 1.1 and/or 1.2;

   2. b.    EQA activity conducted before granting full approval, did not, either adequately or at all, verify Centre compliance with Centre Agreement obligations, and IAO had not sufficiently assured itself that Centre(s) did not pose a risk to its ability to comply with the Conditions of Recognition.

4. 1.4 IAO permitted one or more Centres to claim certificates under its Direct Certification Scheme (DCS) in circumstances where:

   1. a.    The Centre had not been subject to EQA checks for a period of 12 months, as mandated under its CASS strategy;

   2. b.    IAO had not completed sampling in relation to at least 10 Learner portfolios, as required under IAO’s DCS Policy;

   3. c.     EQA activity conducted before granting full approval, did not, either adequately or at all, verify Centre compliance with Centre Agreement obligations, and IAO had not sufficiently assured itself that Centre(s) did not pose a risk to its ability to comply with the Conditions of Recognition.

   4. 1.5 By approving Centres in the manner as may be found proved at 1.1, 1.2, 1.3 and/or 1.4, IAO:

   5. a.    Failed to have in place and follow a sufficiently robust Centre approval process, contrary to Conditions A5.1 and A5.2;

   6. b.    Failed to:

      1. i.         Take all reasonable steps to identify the risk of an incident occurring that could have an adverse effect, contrary to Condition A6.1, and/or

      2. ii.         To take all reasonable steps, where such a risk was identified, to prevent the incident from occurring or, where it could not be prevented, reduce the risk of that incident occurring as far as is possible, and to prevent or mitigate any Adverse Effect that may arise as a result, contrary to Condition A6.2;

   7. c.     Take all reasonable steps to prevent the occurrence of malpractice or maladministration in the development, delivery and award of the Qualification which it makes available or proposed to make available, contrary to Condition A8.1;

   8. d.    Follow its own CASS strategy as required under Condition H2.

Allegation 2

1. 2.1 The Centre Agreement that IAO had in place with one or more Centres was inadequate in that it did not:

   1. a.    Specify what Learner contact details Centres must collect and retain;

   2. b.    Require Centres to gather, retain and provide such information to IAO as it needed to undertake reasonable EQA including authenticating Learner evidence;

   3. c.     Require Centres to retain and provide such information to IAO as it needed to undertake reasonable malpractice investigations; As a consequence, IAO failed to have in place and enforce suitable third-party arrangements, contrary to Conditions C1 and C2.

2. 2.2 In relation to Centre A, once DCS was granted, IAO did not undertake Centre monitoring in line with its CASS strategy and/or commensurate with:

   1. a.    The level of risk that Centre A posed to IAO’s ability to comply with its Conditions of Recognition, for the reasons set out at Allegation 1, and identified in monitoring activity completed to that date;

   2. b.    The higher than anticipated volume of Learner registrations received via Centre A;

   3. c.     Centre A’s behaviour in registering Learners and certificating them in quick succession. As a consequence, IAO acted contrary to Conditions A6, C1 and/or H2.

Allegation 3

1. 3.1 Between January 2024 and October 2025, IAO failed to promptly undertake rigorous and effective investigation into potential malpractice and/or to establish whether malpractice had occurred through Centre A, in relation to all Learners certificated for the Qualification, despite cumulating information forming reasonable suspicion of malpractice. Contrary to Conditions A8.2 and A8.3 of the General Conditions of Recognition.

2. 3.2 IAO did not identify that it had certificated 6 learners in circumstances where the EQA identified that assessment decisions were based on evidence not permitted in the specification, and did not revoke those certificates. Contrary to Conditions A8, G8.1(b) and/or H5.3(b) of the General Conditions of Recognition.

Allegation 4

1. 4.1 Between 17 April 2025 and 25 July 2025, IAO failed to ensure that all of the information provided in response to a written notice dated 2 April 2025 was accurate. Contrary to Condition B4 of the General Conditions of Recognition.

2. 4.2 IAO failed to take all reasonable steps to ensure that it undertook the development, delivery and award of the Qualification efficiently, contrary to Condition A5.1, in that:

   1. a.    IAO did not establish and maintain arrangements for the retention of data which would ensure that adequate information was available to it all times (A5.2(b));

   2. b.    IAO did not establish and maintain appropriate systems of planning and internal control (A5(e)).

Analysis

Allegation 1 and Allegation 2

Centre Approval

1. 14. The Investigation identified significant weaknesses in IAO’s Centre approval arrangements, including deficiencies in due diligence, record keeping, quality assurance and decision making. Although some checks were undertaken, IAO maintained limited evidence of the checks completed, risks identified, or the rationale for approval decisions. Due diligence relied heavily on Companies House information, Centre-supplied documentation and staff knowledge, with limited assessment of wider risk indicators such as links to sanctioned Centres, phoenix organisations or connected businesses.

2. 15. The approval process also relied on information provided by Centres without adequate independent verification. In particular, Centre A supplied external EQA reports which contained clear anomalies but were accepted without authentication. In addition, Centre A received provisional approval before IAO had reviewed its policies, procedures, governance arrangements or premises, enabling Learner registrations before appropriate assurance had been obtained.

3. 16. The Investigation found that IAO did not adequately assess whether Centre Agreement requirements relating to Learner registration, certification controls, fraud prevention and Learner identity verification were understood and implemented before approval was granted. These weaknesses extended into the quality assurance process, where EQA guidance did not require verification of key Centre Agreement obligations during approval activity.

4. 17. Further concerns were identified in relation to the award of Direct Claims Status (DCS). Centre A was awarded DCS approximately 30 working days after provisional approval and after sampling only 4 Learners’ portfolios, despite IAO’s CASS Strategy requiring Centres to be monitored for at least 12 months and its DCS Policy requiring review of 10 Learner portfolios. The remote sampling report itself recorded that “not everything has been checked yet”, yet Centre A was still graded green (low risk) and awarded DCS. IAO subsequently acknowledged that this decision was an error and should have been identified through internal quality assurance and governance processes.

5. 18. Overall, Ofqual’s Investigation concluded that IAO’s approval process did not provide sufficient assurance that risks had been adequately assessed or that Centre A had demonstrated compliance before approval and DCS was granted.

Centre Monitoring

1. 19. Ofqual’s Investigation identified significant weaknesses in IAO’s monitoring of Centre A following approval and the award of DCS. EQA sampling and Learner identity verification arrangements did not consistently provide assurance regarding the authenticity of Learner evidence or compliance with Centre Agreement requirements. Learner identity checks were applied inconsistently and, in some cases, were undertaken on Learners who were not the same individuals whose work had been selected for sampling.

2. 20. The Investigation also found failures to recognise and appropriately escalate warning signs identified through quality assurance activity. An April 2024 EQA report highlighted significant warning signs, including evidence lacking authenticity, redacted Learner evidence, incorrect Learner names, evidence appearing several years old, and evidence purportedly generated by Learners in the workplace although their roles were unrelated to the content of the Qualification. However, the report was not reviewed by a Lead EQA and these indicators were largely treated as assessment issues rather than potential malpractice risks.

3. 21. IAO’s monitoring of Centre activity was similarly ineffective. Following the award of DCS, Centre A exceeded forecast Learner registration volumes within a matter of months and Learners were frequently being registered and certificated within one or two days despite the Qualification requiring 580 hours of Total Qualification Time. Although this information was available through IAO’s management information systems, there was no routine monitoring of registration and certification data, and concerns were not escalated until January 2024 when exceptionally high Learner volumes were identified. IAO confirmed that it had no routine reporting process in place and that Centres assessed as low risk, including Centre A, were not closely monitored. During the Investigation, IAO stated that it had no concerns about Centre A because the Centre responded promptly to requests and made payments on time.

4. 22. The Investigation further found weaknesses in IAO’s Centre Arrangements relating to Learner records, Learner contact information and the authentication of Learner evidence. Centres were not subject to clear requirements regarding the retention of Learner records, identity verification processes or evidence authenticity controls. As a result, IAO was unable to independently verify Learner identities, effectively validate Learner evidence, or contact Learners directly where concerns arose.

5. 23. Overall, the Investigation concluded that IAO did not effectively monitor Centre A or respond appropriately to emerging risks. These weaknesses limited its ability to identify potential malpractice, investigate concerns promptly and ensure that qualifications and certificates issued through the Centre were valid and based on genuine Learner achievement.

Mitigation

1. 24. The Investigation recognised that, following the concerns identified at Centre A in January 2024, IAO took a number of immediate steps to mitigate risk and strengthen oversight. In relation to at least 2 other Centres, IAO refused Centre approval due to multiple risk indicators, and carried out additional assurance activity and approval visits where links to Centre A were suspected, removing DCS, and increasing monitoring and EQA sampling.

2. 25. Building on these immediate measures, IAO subsequently strengthened its Centre approval arrangements. Key changes included ending provisional approval arrangements from 1 August 2025, requiring all Centres to undergo a full approval visit before Learner registrations can commence, applying greater scrutiny to Centre applications, undertaking approval visits before final approval decisions are made, and implementing enhanced oversight and monitoring where risk indicators are identified. These changes were intended to strengthen governance, improve assurance over Centre suitability, and reduce the risk of malpractice occurring after approval.

Allegation 3

Failure to Undertake Rigorous and Effective Malpractice Investigation(s)

1. 26. The Investigation found that IAO failed to recognise and act upon clear indicators of potential malpractice identified during the April 2024 EQA activity at Centre A. The EQA identified a number of significant concerns within all 80 sampled Learner portfolios, including:

• Evidence for which authenticity could not be assured;

• Redacted Learner evidence and witness testimonies;

• Evidence containing incorrect Learner names;

• Documentation that appeared to be several years old, including material predating the COVID-19 pandemic; and

• Learners undertaking administration qualifications despite occupying roles unrelated to administration.

1. 27. The EQA disagreed with the assessment decisions made for all 80 Learners sampled.

2. 28. With respect to the EQA findings in April 2024, IAO confirmed during Ofqual’s Investigation that signs of potential malpractice were overlooked, but considered that on reflection, at the relevant time IAO was more concerned with ensuring Centre A correctly assessed Learners so they could be certificated, rather than considering potential malpractice.

3. 29. As stated at Allegations 1 and 2 above, IAO first identified concerns regarding Centre A in January 2024 following registration and certification of 130 Learners within 24 hours. Prior to that, IAO did not effectively monitor Centre A’s activity despite holding management information in its Quartz system. Centre A had projected a maximum of 250 Learner registrations per year, yet this figure had already been exceeded by 8 September 2023, approximately 4 months after DCS was granted. Learners were also frequently certificated within one or two days of registration from July 2023 onwards. However, IAO did not routinely monitor Centre A due to having attributed it a “low risk” status.

4. 30. IAO did not adequately assess the cumulative significance of these warning signs or consider whether they warranted a formal malpractice investigation. IAO subsequently acknowledged that these indicators had been “overlooked” and accepted that, in hindsight, they should have triggered a malpractice investigation.

5. 31. Ofqual’s Investigation identified that a significant limitation in IAO’s ability to investigate the concerns effectively was its inability to independently contact Learners. IAO was reliant upon Centre A to supply Learner contact information; however IAO’s Centre Agreement did not clearly specify the Learner contact information Centres were required to obtain and retain, and Centres were not required to provide Learner contact details at the point of registration.

6. 32. IAO initially requested both personal and work email addresses for the 108 Learners, on the basis that work email addresses would provide greater assurance that Learners were genuine and linked to legitimate employment. However, Centre A took approximately 2 months to provide any Learner contact information and supplied only personal email addresses.

7. 33. When IAO eventually contacted Learners, it asked Learners:

• Which course they were studying;

• When they had enrolled on the course;

• Their date of birth; and

• General feedback on their experience with Centre A.

1. 34. Ofqual’s Investigation found that these enquiries were insufficient to determine whether malpractice had occurred. In particular, the questions were not capable of establishing:

• Whether the Learner evidence submitted for certification was genuine;

• Whether Learners had participated in, facilitated, or been aware of any malpractice;

• Whether Learners had undertaken the required learning and assessment activities; or

• Whether Learners had met the requirements for the Qualification.

1. 35. Of the 108 Learners IAO contacted, only 19 responded and 27 email addresses were undeliverable. The majority did not respond.

2. 36. Ofqual’s Investigation found no evidence that IAO took steps to verify whether the email addresses provided by Centre A belonged to genuine Learners, notwithstanding that the stated purpose of obtaining those details was to establish that the Learners existed and had genuinely undertaken the Qualifications in question.

3. 37. IAO acknowledged that, where serious concerns arise, it would ordinarily undertake more direct and intrusive investigative measures, including conducting a site visit. However, despite experiencing significant difficulties obtaining Learner records and contact information from Centre A, and despite already possessing information that provided reasonable grounds to suspect malpractice, IAO did not:

• Conduct a site visit to the Centre;

• Undertake further fact-finding or investigative enquiries;

• Seek alternative sources of Learner information or corroborating evidence; or

• Escalate its investigative response in a manner proportionate to the seriousness of the concerns identified.

1. 38. The Investigation found this to be a significant omission. Taken together, the indicators identified during EQA activity, the difficulties in obtaining information from the Centre, and the limited assurance obtained from Learner contact should have prompted a more robust and comprehensive investigative response. Instead, IAO’s actions fell far short of what would reasonably be expected where there are credible grounds to suspect malpractice.

Failure to Investigate Previously Certificated Learners

1. 39. IAO first raised suspicions about Centre A on 18 January 2024 when 130 Learners were registered and certificated within 24 hours. Whilst DCS was removed and EQA activity was scheduled, on 31 July 2024 Centre A informed IAO that 108 Learners awaiting certification had been withdrawn from the Qualification. IAO subsequently issued a Level 5 sanction, terminated its relationship with Centre A, and closed its investigation.

2. 40. IAO stated that, at the time, it did not believe any adverse effect had occurred, and it had not considered whether concerns extended beyond the 108 Learners awaiting certification. The Investigation found this conclusion was unsustainable given:

• Previous EQA findings;

• The warning signs identified within Learner portfolios;

• Centre A’s repeated breaches of registration and certification requirements; and

• The scale of Learner certifications issued under DCS.

1. 41. A key criticism identified during Ofqual’s Investigation was that IAO’s initial investigation focused exclusively on the 108 Learners awaiting certification and did not consider the 851 Learners already certificated through Centre A. The Investigation found that:

• IAO failed to review historical certifications despite evidence that Centre A had been registering and certificating Learners improperly for many months.

• Two withdrawn Learners were later identified as having already been certificated through duplicate registrations.

• Three additional Learners appeared to have completed the Qualification but never received a certificate.

• IAO made no meaningful attempt to contact these Learners to ascertain whether they had suffered detriment.

1. 42. IAO admitted that it had become focused on resolving the immediate issue concerning the 108 Learners and “didn’t look into the past.” The Investigation found that IAO only expanded its enquiry to include previously certificated Learners following discussions with Ofqual in February 2025, approximately:

• Ten months after initial concerns were identified; and

• Eleven months after the EQA findings that provided reasonable grounds to suspect malpractice.

1. 43. IAO did not issue a formal Notice of Investigation to Centre A until March 2025. By this stage, Centre A was no longer an approved Centre, Learner records and contact information were unavailable, and the opportunity to gather contemporaneous evidence had largely been lost.

Failure to Issue a Notification of Investigation

1. 44. IAO’s Malpractice and Maladministration Internal Process requires a formal Notification of Investigation letter to be sent at the outset of an investigation. Ofqual’s Investigation found that, although IAO notified Ofqual in April 2024 that it was investigating Centre A, no notification letter was sent to Centre A at that time. The only investigation letter produced was dated 11 March 2025 and related to the later investigation of previously certificated Learners.

2. 45. IAO could provide no explanation as to why this mandatory procedural step was omitted during the original investigation. Further, IAO’s malpractice procedures require the Compliance Event Manager to complete a risk assessment to evaluate:

• The integrity of assessments and certificates;

• The number of Learners affected;

• Potential adverse effects; and

• Any immediate actions required.

1. 46. Ofqual’s Investigation found no evidence that a formal risk assessment was conducted in relation to either:

• The original investigation concerning the 108 Learners; or

• The later investigation concerning previously certificated Learners.

1. 47. IAO acknowledged that a risk-assessment process and documentation existed but could not identify any completed risk assessment relating to Centre A. Although IAO stated that Centre A was discussed in several internal meetings, the Investigation found:

• No formal risk assessment records;

• No investigation planning documents; and

• No records of decisions taken during what IAO described as the most significant internal meeting on 24 April 2024.

1. 48. As a result, there was no audit trail demonstrating how investigative decisions were reached.

Failure to Comply with Assessment Requirements

1. 49. IAO’s Level 3 Diploma in Business Administration specification requires evidence of occupational competence to be generated under genuine workplace conditions. Evidence should be naturally occurring and based on the Learner’s normal employment role. Whilst simulated evidence may be used in exceptional circumstances, it is only permissible within the limits set out in the Qualification specification.

2. 50. During the EQA visit of 14 February 2024, the EQA reviewed Learner portfolios and identified 6 Learners whose evidence did not meet the Qualification requirements. The EQA concluded that:

• The Learners were not employed in suitable administration-related job roles.

• Evidence relied upon simulated activities that were not permitted by the Qualification specification.

• Assessment decisions relating to these Learners were therefore invalid.

1. 51. The EQA formally disagreed with the assessment decisions reached by the Centre.

2. Ofqual’s Investigation found that all six Learners had already been certificated before the EQA visit identified the issues, as a result:

• Qualifications had been awarded on the basis of evidence which did not comply with the assessment requirements.

• Assessments were not completed under the conditions prescribed by the Qualification specification.

• The rules regarding admissible evidence had not been applied consistently to all Learners.

1. 52. Despite the EQA identifying invalid assessment decisions, IAO confirmed that it did not (promptly) revoke certificates for those awarded. Accordingly, certificates remained in circulation despite evidence that the underlying assessments did not meet the Qualification requirements.

Allegation 4

Inaccurate Information Submitted to Ofqual

1. 53. On 2 April 2025, Ofqual issued a formal notice requiring IAO to provide comprehensive information regarding Learners registered by Centre A, including:

• Learner identifiers;

• Registration dates;

• Certification details;

• EQA activity;

• Certificate revocations; and

• Related outcomes.

1. 54. IAO responded by supplying certification and registration data extracted from its data management system together with supporting narrative explanations. Ofqual’s Investigation found inconsistencies between various figures supplied by IAO. Different datasets and communications reported:

• 879 certificated Learners;

• 877 certificated Learners; and

• Subsequently 847 certificated Learners following data revision.

1. 55. These differences arose because the original data included duplicate registrations that incorrectly appeared as separate certificated Learners. Ofqual’s Investigation established that, 28 duplicate Learner registrations existed within the data supplied to Ofqual. Each duplicate registration carried a certification date inherited from the original Learner record, which artificially inflated certification totals.

2. 56. Following notification by the Investigation team, IAO revised its information and submitted updated certification reports. Although IAO sought to correct the duplicate registrations:

• Four genuine Learners were removed in error;

• Additional inconsistencies arose between revised reports;

• Different duplicate records were removed from different datasets.

1. 57. Consequently, although the revised submissions improved accuracy, discrepancies remained.

2. 58. There is no evidence to suggest that IAO intentionally supplied misleading or inaccurate information, instead, the inaccuracies appeared to result from, weaknesses in IAO’s data management system used for registration and certification and errors introduced during manual correction exercises.

Data Retention Arrangements

1. 59. Ofqual’s Investigation reviewed a sample of 6 Centre approval applications and found that while IAO generally undertook some pre-approval checks, evidence of those checks was inconsistently documented. In particular:

• Some applications contained clear evidence of due diligence (for example, records that discrepancies had been identified through Companies House and UKPRN checks).

• However, IAO largely operated a “record by exception” approach, meaning routine checks were often not documented.

• In the case of Centre A, records contained very little evidence showing what checks had been undertaken, what risks had been identified, or the rationale for approving the Centre.

1. 60. When asked how IAO assured itself that due diligence was consistently completed across all Centres, IAO explained that the organisation largely relied on trust that staff would follow the process correctly, rather than operating a system of formal oversight or verification.

2. 61. Further, as referred to at Allegation 3 above, Ofqual’s Investigation found significant gaps in IAO’s investigation records and documentation. Although IAO’s procedures required formal risk assessments to be completed, there was no evidence that risk assessments were undertaken. In addition, IAO could not provide formal risk assessment records, investigation plans, or records of key decisions. As a result, there was no clear audit trail demonstrating how investigative decisions were made or evidencing the rationale for IAO’s actions.

Internal Control Failures

1. 62. Ofqual’s Investigation concluded that IAO’s systems of internal control were inadequate because:

• There was a lack of clear documentation relating to Centre approval checks, and malpractice investigations (as referred to above);

• Quality assurance processes were deficient;

• There was insufficient oversight to determine whether processes were being applied consistently;

• There were issues with IAO’s data management system and the data quality it produced;

• IAO did not assess whether its arrangements were effectively managing risk.

1. 63. Ofqual’s Investigation identified weaknesses within the approval and EQA process relating to Learner identity verification.

2. 64. When the first EQA sampling activity was undertaken at Centre A, there was no evidence that the EQA verified whether Learner identity checks had taken place before assessment. IAO was unable to explain the extent to which EQAs routinely checked compliance with Learner identity requirements. This indicated that IAO lacked visibility over whether key controls designed to protect qualification integrity were actually being applied.

3. 65. The Investigation found that IAO failed to identify that DCS had been granted contrary to its own requirements. IAO’s CASS Strategy required a minimum of 12 months’ monitoring before DCS could be awarded, and IAO’s DCS Policy required sampling of at least 10 completed Learners before DCS could be granted. However, Centre A received DCS only 30 working days after provisional approval and after sampling only four Learners.

4. 66. Ofqual’s Investigation identified that a Lead EQA reviewed the original EQA report and endorsed the decision to award DCS. Despite those review arrangements, neither the original EQA nor the Lead EQA identified that the DCS decision breached IAO’s own policies. As a consequence, Centre A was able to certificate Learners without routine external scrutiny.

5. 67. IAO acknowledged that granting DCS at that stage was an error that should have been identified through internal controls and team oversight.

6. 68. As referred to Allegation 3 above, IAO failed to respond appropriately to concerns raised following EQA activity in April 2024 which identified significant concerns relating to 80 Learners sampled. Despite concerns regarding authenticity of Learner evidence, incorrect names appearing in portfolios and portfolio evidence appearing to be several years old; no Lead EQA review was undertaken before the report was issued and IAO focused on ensuring Learners were being assessed correctly so they could be certificated rather than considering whether malpractice had occurred.

7. 69. As referred to above, Ofqual’s Investigation identified significant concerns regarding the reliability and accuracy of IAO’s Learner registration and certification data. The Investigation found duplicate Learner registrations, inaccurate certification records, and inconsistencies in reports submitted to Ofqual, resulting in data that did not accurately reflect Learner activity.

8. 70. The Investigation found that IAO was unaware of weaknesses within its own data management system until they were identified by Ofqual, indicating insufficient oversight of system functionality and data quality. Subsequent manual amendments to the data introduced further inaccuracies, raising concerns about the reliability of information used by IAO and reported to Ofqual.

Regulatory action

1. 71. On 25 September 2026, IAO entered a voluntary settlement by which it:

• Agreed that it had breached its Conditions of Recognition as set out in this Notice,

• Agreed to pay a monetary penalty in the sum of £185,000 in settlement of those breaches,

• Agreed to pay Ofqual’s reasonable legal costs up to a maximum of £15,000.

1. 72. On 30 September 2026 Ofqual’s Enforcement Panel considered the evidence relating to the breaches set out above, alongside the admissions made by IAO. The Enforcement Panel determined that IAO has breached its Conditions of Recognition as per the allegations set out above.

2. 73. The Enforcement Panel has considered the settlement proposal presented by IAO. In determining whether or not a Monetary Penalty is an appropriate regulatory outcome in this case and if so what amount would be proportionate to impose, the Enforcement Panel has had regard to Ofqual’s Supporting compliance and taking regulatory action policy (2025).

3. 74. The Enforcement Panel notes the aggravating and mitigating factors set out below.

Aggravating Factors

1. 75. The following factors, as taken from Ofqual’s Supporting Compliance and taking regulatory action policy, are relevant in this case:

• The seriousness of the breach, particularly in relation to its effect on standards of qualifications, public confidence and the efficiency of the qualifications system. The Qualification presented an increased risk of qualification fraud given its alternative use as evidence of competence in the English language. There was large scale impact with minimum 800 certificates remaining valid for a prolonged period before being revoked, potentially allowing those individuals to rely on such certificates and unfairly gain advantage.

• Whether the breach was prolonged or repeated – the issues in this case span a period of some 3 years from the point of Centre A’s Centre approval to the point in which invalid certificates were finally revoked.

• The circumstances of the breaches were entirely within IAO’s control and could easily have been avoided by taking basic steps before approving Centre A, when monitoring the Centre’s activities and when indications of potential malpractice came to light. IAO missed numerous opportunities to prevent Centre A being in a position to perpetrate malpractice, and potential qualification fraud, to detect that behaviour sooner and wrongly allowed Learners to retain invalid certificates for a period of years.

• The behaviour of IAO in relation to the breach, including whether it happened intentionally, whether there was any negligence on the part of the awarding organisation, and whether the breach gives rise to concerns about the organisation’s management or control systems. There were widespread system and controls issues, and a disregard of established processes and policies which appeared reckless rather than merely negligent. Although there were flaws with IAO’s policies at the time, it appears likely that Adverse Effects would have been avoided had it followed those polices.

• The failings in this case increased the opportunity for malpractice to occur and undermined the deterrent effect which prompt and effective investigation of malpractice promotes. As well as the impact on standards in relation to the particular qualifications, failings of this nature inevitably have a significant detrimental effect on public confidence in qualifications more broadly, undermining the work of Ofqual and other awarding organisations which aims to eradicate qualification fraud.

• A fine is likely to improve compliance with regulatory conditions in the future (including by other awarding organisations). Ofqual considers this to be a serious case and that there is a clear need to deter IAO and other awarding organisations from similar failings in the future. The imposition of a monetary penalty emphasises the importance of maintaining robust systems to drive malpractice from the qualifications system and to ensure awarding organisations retain accountability for the awards they make, delegating assessment to Centres only where they can be confident it is, and remains, safe to do so. It also demonstrates that Ofqual will take action where awarding organisations fail to guard against malpractice risks, given the key importance of doing so to protect the integrity of, and public confidence in, qualifications.

Mitigating Factors

1. 76. The following mitigating factors are considered relevant in this case:

• IAO has engaged and co-operated with Ofqual during the enforcement process.

• IAO accepted the breaches expressing recognition of the non-compliance.

• Following engagement with Ofqual, IAO has taken positive steps to rectify issues and there is some evidence which suggests that improvements made by IAO are working to flag issues at Centre approval / monitoring stages.

• IAO has agreed to provide an undertaking to address deficiencies identified.

Settlement

1. 77. IAO cooperated with Ofqual’s investigation, admitted the non-compliances and entered into a voluntary settlement in which it has acknowledged Ofqual’s decision in this Notice and agreed to pay the monetary penalty. In light of this settlement, Ofqual has decided to impose a lower penalty than it would have done in a contested case.

Final Decision

1. 78. Taking all of the above into account, the Enforcement Panel has confirmed its earlier notice of intention to accept the settlement proposal and imposes a monetary penalty in the sum of £185,000.

2. 79. The Enforcement Panel is satisfied, in accordance with section 151B of the 2009 Act, that a Monetary Penalty in the sum of £185,000 would not exceed 10% of IAO’s total annual turnover.

Payment

1. 80. The monetary penalty must be paid within 28 days of the date of this notice, in accordance with the payment instructions provided with this notice.

2. 81. In the event of non-payment, interest may be charged and the outstanding amount may be recovered as a debt, in accordance with section 151D of the Act.

Appeals

1. 82. An awarding organisation may appeal to the First Tier Tribunal in respect of Ofqual’s decision to impose the monetary penalty and/or in respect of the amount of that penalty, in accordance with section 151C of the Act.

2. 83. An appeal may be made on the grounds:

   1. a. that the decision was based on an error of fact;

   2. b. that the decision was wrong in law;

   3. c. that the decision was unreasonable.

3. 84. Any appeal must be made within 28 days of the date of this notice. Further information is available from HM Courts and Tribunals Service.

Signed: Susan Barratt, Chair of the Enforcement Panel

Date: 2 October 2026

Enforcement Panel: Susan Barratt, Hardip Begol CBE, David Bowden

NOTE: Ofqual will publish this Notice on its website

Annex A: Legal Provisions

Statutory powers

1. 1. IAO is recognised as an awarding body by The Office of Qualifications and Examinations Regulation (“Ofqual”) under section 132(1) of the Apprenticeships, Skills, Children and Learning Act, 2009 (“the 2009 Act”) and is subject to the General Conditions of Recognition (“the Conditions”) which Ofqual is required to set and publish under Section 134 of the 2009 Act.

2. 2. Under Section 151A(2) of the 2009 Act, Ofqual may impose a Monetary Penalty on an awarding body if it appears to Ofqual that the awarding body has failed to comply with its Conditions of Recognition.

3. 3. Under Section 151B(3) of the 2009 Act, the amount of any Monetary Penalty may be whatever Ofqual decides is appropriate in all the circumstances of the case, subject to Section 151B(1), which provides that Ofqual may not impose a Monetary Penalty in an amount which exceeds 10% of the awarding body’s turnover.

4. 4. Section 151A(4) provides that Ofqual must give notice to an awarding organisation of its intention to impose a monetary penalty. S151A(5) and (6) set further requirements in respect of such notice.

5. 5. Ofqual’s Supporting compliance and taking regulatory action Policy (2025) sets out how it will use its powers to take regulatory action, including the factors it will take into account when deciding whether to impose a Monetary Penalty and how it will determine the amount of any Monetary Penalty to be imposed.

General Conditions of Recognition

1. 6. IAO has a legal obligation to comply with its Conditions of Recognition (s132(3) of the 2009 Act), which includes the General Conditions of Recognition and any other relevant Conditions set by Ofqual.

2. 7. The General Conditions of Recognition, Qualification Level Conditions and Subject Level Conditions can be found on Ofqual’s website.