Preparing for Your NDIS Audit

An NDIS quality audit is an independent check of how well a provider meets the NDIS Practice Standards that apply to its registration. This lesson explains who does what. Key points: audits are carried out by approved quality auditors, which are independent bodies and not part of the NDIS Commission; auditing bodies are accredited by JASANZ and follow the NDIS auditor guidelines and a code of conduct; the auditor makes a recommendation but the Commission makes the registration decision; and you choose and pay your auditor, using the initial scope of audit to get more than one quote.

The type of audit you need depends on the supports you are registered to deliver. This lesson compares verification and certification and maps out the audits that come up across a registration period. Key points: verification is a desk audit for lower risk supports; certification adds site inspections and interviews for higher risk supports; providers are generally registered for three years; certification providers have a mid-term audit that must start no later than 18 months into registration; condition, out of cycle and change of ownership audits can also apply; and re-registration can start six months before expiry.

A certification audit has two stages, and what the auditor samples is not up to you. This lesson walks through stage 1 and stage 2 and explains how sampling works. Key points: stage 1 is usually an off site review of your self-assessment and documents; you receive the stage 1 findings before stage 2; stage 2 should start within three months of stage 1; participants are included unless they opt out; the auditor selects files and people, randomly and by risk, and providers cannot pre-select; minimum sample sizes are set by the auditor guidelines; and finding a non-conformity widens the sample.

Auditors want to see that your systems work in real life, not just that they exist on paper. This lesson explains the difference between a policy and the evidence that it is followed. Key points: a policy states what you intend to do, while records, interviews and observation show what actually happens; the audit compares what your system says with what really happens; your self-assessment must describe how you actually operate; policies must reflect your real organisation, not a generic purchased template; and copied content can put your registration at risk.

Participant and worker files are among the first things an auditor samples. This lesson sets out what an audit ready file looks like. Key points: a participant file should trace the journey from service agreement and support planning to delivered supports and reviews; support plans must be current and reviewed; worker files need current NDIS worker screening clearances where required, qualifications, induction, the NDIS Worker Orientation Module, training and supervision records; key personnel are checked too; and because the auditor chooses which files to look at, every file needs to be ready.

Registers and governance records show the auditor that leaders know what is happening and act on it. This lesson covers the registers to keep current and the governance evidence to have ready. Key points: incident, complaints, risk, improvement, training and screening records should be current and show follow up; minutes and reports should show leaders monitoring quality, risk and incidents; emergency and disaster management is part of the core module; the mid-term audit focuses on governance and operational management; and an evidence map links each standard to the records that prove it.

A mock audit rehearses the external audit so there are no surprises. This lesson shows how to run one that genuinely tests your readiness. Key points: base the mock audit on your actual scope of audit and the standards that apply; hold it early enough to fix what you find; use a reviewer who is independent of the service; sample the way an auditor would, randomly and by risk, across all shifts; test whether records can be found, whether workers know the systems and whether practice matches the plan; and log every gap in your improvement register with an owner and a date.

Interviews with workers and participants are a key source of audit evidence. This lesson explains how to prepare people without coaching them. Key points: auditors interview front line workers, not only managers, and do not rely only on group interviews; help staff understand the audit and the systems they use, but never script answers; tell every participant about the audit in a way they understand, because sampling is opt out; respect, document and pass on any decision to opt out; and participants can choose whether to talk to an auditor and can have a support person with them.

Good organisation on audit day lets the auditor focus on your evidence instead of waiting for it. This lesson covers the audit plan, the opening meeting and practical set up. Key points: the auditor seeks your written agreement to the audit plan before stage 2; the audit team leader chairs the opening and closing meetings; name one audit coordinator, prepare a private workspace and confirm who is available at each site and shift; give access to records without oversharing personal information; and keep participants' routines running, because audits should minimise disruption to supports.

Most of audit day is spent in interviews, observing supports and answering document requests. This lesson explains how to handle each well. Key points: let auditors speak with people privately; log every document request and respond promptly; provide records exactly as they exist and share only the personal information needed; never create, backdate or alter records during an audit; if something cannot be found, say so and keep looking; and auditors must report critical risks to participant safety to the Commission, immediately where criminal acts or child protection concerns are suspected.

The closing meeting tells you how the audit went and what happens next. This lesson explains how to get the most out of it. Key points: the auditor summarises strengths and findings, links each finding to evidence and a standard, and gives you a written copy of the findings; ask questions to understand the evidence and offer anything that was missed, calmly; you can check the draft report for factual accuracy and disagreements are documented; reports reach the Commission within 28 days of a certification or mid-term audit; and honesty about gaps builds lasting trust.

Every standard in your audit receives a rating. This lesson explains the four ratings and the difference between a minor and a major non-conformity. Key points: ratings run from 3, conformity with elements of best practice, to 0, major non-conformity; a minor non-conformity usually means a process exists but supporting documentation, or evidence of implementation and review, is missing; a major non-conformity means systems are not in place or the gap presents a high risk; three minor non-conformities in the same module may be treated as a major; and a major prevents certification until it is resolved.

When the auditor raises a non-conformity, you must respond with a corrective action plan, and quickly. This lesson shows how to write one the auditor can accept. Key points: the auditor requires your plan within seven calendar days of written notification; a good plan fixes the immediate problem for participants and the root cause of the gap; every action needs one owner, a realistic due date and the evidence that will show it worked; the plan should reduce the risk to participants; and every action belongs in your improvement register.

Raising a non-conformity starts a set of deadlines. This lesson explains them and how they connect to the mid-term audit. Key points: a major non-conformity must be closed or downgraded within three calendar months of written notification, and for majors raised at a mid-term or recertification audit, missing this means automatic suspension of the certification decision; minors must be closed within 18 calendar months, at the mid-term or recertification audit, or they escalate to major; findings are retested at the next audit; and the mid-term audit covers governance, past corrective actions and anything the Commissioner specifies.

This case study follows Priya, the quality and compliance lead at Bluegum Supports, as she prepares for a recertification audit. You will make decisions about timing, stage 1 findings and who the auditor meets. Key points: start re-registration early so registration stays valid and there is time for the audit and any corrective action; treat stage 1 findings as a preview of stage 2 and act on them straight away; make sure plans reflect each site's real risks; keep rosters and routines as they really are; and never steer who the auditor meets, because the auditor chooses the sample.

The final case study follows Kwame, operations manager at Coastline Care, through a major non-conformity at a mid-term audit. You will decide how to respond at the closing meeting and what the corrective action plan should include. Key points: respond honestly and understand the evidence behind a finding; submit the corrective action plan within seven calendar days; fix the root cause as well as the backlog; close a major within three months with fresh evidence; and use the experience to strengthen governance. The lesson ends with the course summary and the final assessment.