I'm in the unusual position of having worked in childcare law. I've dealt with cases involving alleged sexual behaviour between children.
First of all, this is a notifiable event under their insurance policy. You might want to make sure they've notified their insurer. Hopefully they'll pass it on to a lawyer, who'll then tell them what to do.
Second, as mandatory reporters, they do need to report this as there is a possibility that a child is being abused.
You've also got to realise that if all of this information is coming from a child and it wasn't witnessed, that no one is going to be entirely sure what happened. Plus there's no requirement for 'hawkeye' supervision so the fact it wasn't witnessed means nothing in a legal sense (that argument can actually backfire in court). Coming in cold, it could also be suggested that the child making the allegations is the one being abused and she's making it up based on something that happened at home. This is absolutely not me suggesting that's what happened, but I'm trying to let you know how this kind of thing is dealt with from a cold, objective, unemotional perspective. They look at all options. It's actually very difficult to handle this when the allegations have come only from the child.
The last thing is that I've read many psych reports on kids who've had stuff like this happen. What becomes clear is that the parents' reaction means everything. She doesn't need to understand what a terrible thing this was if she hasn't come up with that reaction herself. She needs to know that people can't touch her like that, but the kids that come out damaged are often the ones where the parents were breaking down in front of them, taking them out of care, screaming and yelling in front of them about the other child, fighting with each other and generally letting them know how bad it was.
Anyway, the centre should be notifying their insurer, DHS and have a plan in place to stop this happening again. If they're shadowing both kids it sounds like they're doing that.