A service with a staff member employed for three years and only one child protection training record is automatically non-compliant. This is the forensic reality. Auditors treat child protection as a fixed compliance item, and their methodology is a trap for the unwary board that confuses policy liberalisation with procedural decay.

The Audit Trigger

The auditor’s opening gambit is a simple, devastating request: “Show me a child protection concern from the past 12 months and walk me through your response.” Failure to produce the documented chain—incident log, staff training records proving competency, safety check files for involved adults, and evidence of reporting to Oranga Tamariki—triggers a deep-dive. They follow a precise document sequence: Policy, then training records, then safety checking files, then incident logs. A missing van driver’s safety check or a policy that only addresses external abuse are immediate failures. They exploit the compliance paradox: services that soften policy language but fail to maintain procedural documentation appear to be operating without safeguards.

The Regulatory Hook

The framework is statutory, not discretionary. The Education and Training Act 2020 mandates the policy. The Children’s Act 2014 sets the baseline. The Education (Early Childhood Services) Regulations 2008, Regulation 57 is the specific hook that cannot be softened. It requires the exclusion of any adult whose physical or mental state poses a risk, including those displaying “strange or disturbing behaviour or aggression.” Safety checking for all workers before unsupervised contact is non-discretionary under this framework. Mandatory reporting pathways to Oranga Tamariki are not a best-practice guideline; they are a legal obligation. The board’s duty is to ensure the service’s documentation proves adherence to these fixed points, regardless of any regulatory streamlining elsewhere.