How an NDIS audit runs, stage by stage
Your registration groups decide the audit. The initial scope of audit you receive after applying confirms the type, the modules and what to give your auditor. From 12 October 2026, new applications go through the new NDIS Commission Portal, and once you submit Part 2 you choose your approved quality auditor from a list in the portal. See apply for registration.
- Engage an approved quality auditor. You pay the auditor; the Commission does not set prices, so get more than one quote.
- Stage 1, desktop audit. The auditor reviews your documents and evidence, usually off-site.
- Stage 2, onsite audit. Held in the 3 months after stage 1. It opens with a short meeting, then moves to record reviews, site visits, staff and participant interviews and observation of supports.
- Closing meeting. The auditor summarises strengths and any gaps, and explains the timeframe to fix them.
- Report. You check a draft for factual accuracy. The final report goes to the Commission up to 28 days after a certification audit, and the Commission makes the registration decision.
A verification audit is simpler: a desktop review of your documentary evidence, with the report due up to 14 days after it is completed.
What auditors sample
The Commission describes audits as evidence based: auditors want real examples, not just the policy. Expect them to look at:
- Governance: how the board or owners identify and escalate risk, monitor quality and oversee restrictive practices, with meeting minutes, risk registers and incident trend reports as proof.
- Policies and procedures: read against what workers and records show actually happens.
- Worker files: NDIS worker screening clearances, qualifications, induction, ongoing training and supervision notes.
- Participant files: support plans, risk assessments, service agreements, consent and progress notes, and whether supports match the plan.
- Incident and complaints registers: auditors trace an incident from the first report through review, actions and any notification.
- Behaviour support files, where relevant: functional assessments, participant involvement and authorisation of any restrictive practice.
- Participants: private conversations about feeling safe, being listened to and knowing how to complain. Sampling is opt out: tell every participant they are included, and if someone opts out, respect it, record it and tell the auditor.
Evidence checklist by core module area
Map each item to the quality indicators in the NDIS Practice Standards so you can find it in seconds.
Rights and responsibilities
- Information for participants in their preferred language and format
- Privacy and consent records covering what is collected and why
- Evidence participants are told about advocates and supported to use one
- Records of how allegations of abuse or neglect were acted on
Governance and operational management
- Organisation chart, delegations and a conflict of interest register
- Governing body skills review and training records
- Risk register covering incidents, complaints, finance, HR, information, WHS and emergencies
- Current insurance certificates
- A documented internal audit program and continuous improvement register
- Worker files with position descriptions, checks, worker orientation module certificates and training
- Emergency and disaster plans that have been tested, reviewed and communicated
- Support plans developed with the participant and reviewed at least annually
- Risk assessments recorded in support plans
- Signed service agreements, or a record of why there is none
- Transition and exit records
Support environment
- Medication, mealtime and waste procedures, where they apply, with records
- Safe environment checks and records for participant money and property
Free download: audit readiness evidence checklist
A printable PDF for NDIS and aged care providers: the evidence auditors ask for, area by area, with tick boxes and space for where it is kept. Enter your details and we will email it to you.
We use your details to send the download and, only if you tick the box, occasional updates. See our privacy policy.Ratings, non-conformities and remediation
Auditors rate each standard and quality indicator from 3 (conforms with elements of best practice) to 2 (conforms), 1 (minor non-conformity) or 0 (major non-conformity). A non-conformity is not a fail, but it does need a fix:
- Major non-conformity: you have 3 months to fix it, and your registration will not progress until it is addressed.
- Minor non-conformity: you get longer to fix it and registration can continue. Minors still outstanding can lead to a condition audit.
Remediation works best as a corrective action plan with the root cause, the fix, an owner, a due date and the evidence that will prove it worked. Any standard that needed a corrective action plan is checked again at your mid-term audit.
Non-conformities usually trace back to an indicator you cannot evidence. Watch for policies that describe a process nobody follows, support plans past their review date, missing infection prevention and control refreshers, complaints information without external avenues, emergency plans never tested, and workers who cannot explain how to report an incident.
A 30, 60 and 90 day preparation plan
Days 1 to 30: scope and gap analysis. Confirm your registration groups and modules from your initial scope of audit. Request auditor quotes. Run a self-assessment against every applicable indicator, list the gaps and give each one an owner.
Days 31 to 60: fix and file. Update policies so they match practice. Bring worker files, screening and training records up to date. Review overdue support plans and service agreements. Run a mini internal audit of a few participant and worker files, and trace one incident and one complaint from start to finish.
Days 61 to 90: rehearse. Hold a mock audit with interviews of key personnel and workers. Organise an evidence index. Tell participants about the audit and their right to opt out, and brief staff on what to expect: answer honestly and show what you actually do.
Get help or train your team
Audits go best when your people understand the standards and use the systems every day. These courses build that capability:
90 minPreparing for Your NDIS Audit
Preparing for Your NDIS Audit takes managers, quality and compliance leads and key personnel through an external NDIS quality audit from start to finish. You will learn how certification and verification audits work, the two audit stages, the role of approved quality auditors and how sampling decides which files, workers, participants and sites are checked. We show you how to build evidence that proves practice, not just policy, across participant files, worker files, registers and governance records, and how to run a mock audit and prepare staff and participants for interviews. We then cover audit day from the opening to the closing meeting, minor and major non-conformities, corrective action plans, the deadlines for closing them and the mid-term audit. Two case studies bring it all together. Duration: 90 minutes.
50 minRunning an Internal Compliance Audit
Internal audits help us find and fix problems before they affect participants or show up at an external audit. This course shows team leaders and managers how to run a practical internal compliance audit: why we audit internally and why independence matters, how to plan the scope against the NDIS Practice Standards and our policies, how to sample files fairly and interview staff well, how to gather evidence and write strong findings, and how to build corrective action plans that close the loop. Two case studies follow a medication audit that uncovers a serious issue and a follow up audit under pressure before an external audit. Duration: 50 minutes.
45 minIntroduction to the NDIS Practice Standards
The NDIS Practice Standards set out the quality and safety outcomes that registered NDIS providers must deliver for participants. This course explains what the Practice Standards are, how they are organised into a core module, supplementary modules and a verification module, and what the four parts of the core module cover. You will learn how providers are audited against the standards, what an auditor may look at, how the standards connect to the NDIS Code of Conduct and how your everyday work shows that we are meeting them. Case studies about choice in a shared home, changing needs and a complaint show the standards in action. The standards are being reformed, so we also show you where to find the current version. Duration: 45 minutes.
50 minNDIS Registration and the Quality and Safeguarding Framework
As a team leader or manager you help keep our registration in good standing every day. This course explains the NDIS Quality and Safeguarding Framework and its developmental, preventative and corrective safeguards, the different jobs of the National Disability Insurance Agency and the NDIS Quality and Safeguards Commission, how registration groups decide whether we face a verification or certification audit, and the conditions that come with registration. It covers recent changes, including mandatory registration for supported independent living and NDIS digital platform providers from 1 July 2026 and stronger regulatory powers. Two case studies show how to respond to an unauthorised restrictive practice and how to prepare honestly for an audit. Duration: 50 minutes.
55 minIncident Management for Team Leaders and Managers
When something goes wrong, the way a team leader or manager responds shapes the safety of the participant, the quality of our reporting and what we learn. This course covers what the NDIS rules expect from our incident management system, the reportable incident types and the 24 hour and 5 business day notification timeframes, how to support the participant, and how to run a proportionate investigation and write clear findings. It also covers complaints, learning from patterns and a short overview of the Serious Incident Response Scheme for our aged care services. Two case studies follow a night shift head injury and an allegation against a worker. Duration: 55 minutes.
45 minEffective Complaint Handling for NDIS Providers
Complaints are a gift: they tell us what is not working and give us the chance to put it right. This course explains why complaints matter, the rights participants and families have to raise concerns, and what the NDIS Practice Standards and complaints rules expect of registered providers. You will learn how to receive a complaint calmly and respectfully, what you can resolve on the spot, when and how to escalate, and how complaints are recorded, investigated and used to improve our supports. The course also explains how people can take a complaint to the NDIS Quality and Safeguards Commission, and why no one should ever be treated badly for speaking up. Two case studies show these skills in action. Duration: 45 minutes.
45 minWorker Screening for Managers and HR
Worker screening is one of the most important preventative safeguards in disability and aged care, and a condition of our NDIS registration. This course helps managers and human resources staff get it right. It explains what a risk assessed role is and when an NDIS Worker Screening Check clearance is needed, the role of state and territory worker screening units and the national NDIS Worker Screening Database, and the records a registered provider must keep. It covers what to do when a worker is excluded, suspended or under an interim bar, the rules for working on application and other exceptions, and the current screening requirements for aged care workers. Two case studies show these steps in practice. Duration: 45 minutes.
50 minGovernance and Safeguarding for Boards and Executives
Boards and executives set the direction, culture and priorities that decide whether participants and older people receive safe, quality support. This course covers the Governance and Operational Management part of the NDIS Practice Standards, the duties of directors and officers in general terms, managing conflicts of interest, overseeing risk and quality, and what a board should expect to see in reports. It also looks at culture and the governing body responsibilities introduced by the Aged Care Act 2024, including the statutory duty and the due diligence duty of responsible persons. Two case studies show a board testing good news and responding to a serious allegation. This course is general information, not legal advice. Duration: 50 minutes.
Want an independent view before the auditor arrives? Provider Compliance's consultants run mock audits and help with remediation, from gap analysis through to corrective action plans. See our NDIS consultant services.
Frequently asked questions
How do I prepare for an NDIS certification audit?
Confirm your registration groups and modules from the initial scope of audit, self-assess against every applicable quality indicator, fix the gaps, organise evidence for each standard, run a mock audit and tell participants about the audit and their right to opt out.
What happens at a stage 2 NDIS audit?
The auditor checks how your policies work in practice: records, site visits, interviews with workers and participants, and observation of supports. Stage 2 should happen within 3 months of the stage 1 desktop audit.
What do NDIS auditors check in staff files?
Worker screening clearances, qualifications, induction records, completion of the worker orientation module, and evidence of ongoing training and supervision.
How long do we have to fix a major non-conformity?
3 months. Registration will not progress until the major non-conformity is addressed. Minor non-conformities have a longer timeframe and registration can continue.
Do participants have to take part in the audit?
No. Sampling is opt out: you tell all participants they are included, and if someone chooses not to take part you respect that, record it and tell the auditor.
When does the auditor send the report to the Commission?
Up to 28 days after a certification or mid-term audit, and up to 14 days after a verification audit.
Source: NDIS Quality and Safeguards Commission. Checked 11/11/2026. Provider Compliance is not affiliated with the Victorian Government.