The Complete Guide to NDIS Audits

Introduction

If you are a registered NDIS provider, audits are a normal part of operating within the scheme. They are not a sign that something has gone wrong. They are a structured process designed to confirm that providers are meeting the standards required to deliver safe and quality supports.

Despite this, many providers find audits stressful — particularly those who are new to registration or who have not been through the process before. A lack of preparation, or uncertainty about what auditors are looking for, is often the biggest source of difficulty.

This guide explains what NDIS audits are, why they exist, what evidence and documentation you need, and how to approach a compliance review with confidence. It also covers what happens when issues are identified, and what you can expect as the scheme evolves.

What Is an NDIS Audit?

An NDIS audit is a formal assessment of whether a registered provider meets the NDIS Practice Standards. It is conducted by an approved quality auditor — an independent organisation accredited by the NDIS Commission to carry out these assessments.

Audits are not conducted by the NDIS Commission directly. The Commission sets the standards and oversees the audit system, but the actual assessment is carried out by an independent auditing body chosen by the provider.

There are two types of NDIS audits:

Verification audit

A verification audit is a desktop review. It involves the auditor checking documentary evidence that the provider meets specific requirements. No site visit is required. Verification audits apply to providers who deliver lower-risk supports, such as assistance with household tasks or gardening.

Certification audit

A certification audit is a more comprehensive assessment. It involves document review, interviews with staff and participants, and a site visit. Certification audits apply to providers delivering higher-risk supports, including accommodation, personal care, specialist disability accommodation, and behaviour support.

The type of audit required depends on the registration groups a provider holds — that is, the categories of support they are registered to deliver. The NDIS Commission provides guidance on which audit type applies to each registration group.

Both types of audit assess whether a provider meets the NDIS Practice Standards. The Practice Standards set out the quality and safety requirements for NDIS service delivery.

Why NDIS Audits Matter

They protect participants

The fundamental purpose of NDIS audits is to protect people with disability. By confirming that providers meet minimum standards, the audit process helps ensure participants receive safe, respectful, and competent support.

They create accountability

Audits provide an external check on provider practices. Without this accountability, there would be no systematic way to verify that providers are operating as required — regardless of their intentions.

They support quality improvement

A well-run audit process does not just identify problems — it highlights areas for improvement. Providers who engage constructively with audit findings often emerge with stronger systems and better practices.

They are a condition of registration

A provider cannot obtain or maintain NDIS registration without passing the required audit. Registration is what allows providers to deliver services to agency-managed participants and to offer higher-risk supports. Maintaining registration requires continued compliance with audit requirements.

They build participant and community trust

Participants and their families rely on registration as a signal of quality. When providers meet audit standards, they demonstrate to the community that they operate with integrity.

Common Mistakes Providers Make With Audits

Treating preparation as a one-off event

Some providers only focus on compliance when an audit is approaching. This creates significant last-minute pressure and often reveals gaps that could have been addressed over time. Ongoing compliance activity — not a pre-audit scramble — is what auditors expect to see.

Incomplete or disorganised documentation

Documentation is at the heart of every NDIS audit. Providers who cannot quickly locate policies, service agreements, incident records, worker screening evidence, or staff training records are likely to struggle. An auditor who cannot find evidence of compliance will note it as a gap — regardless of what the provider claims verbally.

Policies that do not match actual practice

A provider may have a well-written complaints policy, but if staff cannot explain the complaints process and no complaints have ever been recorded, auditors will question whether the policy is implemented in practice. Documentation must reflect what actually happens in the organisation.

Inadequate worker records

Worker files are closely reviewed during certification audits. Missing qualifications, expired NDIS Worker Screening clearances, no evidence of induction or mandatory training, and absent employment agreements are all common findings. Maintaining up-to-date worker records is a continuous requirement, not something to prepare at audit time.

Not understanding which standards apply

The NDIS Practice Standards include a core module and supplementary modules that apply based on registration groups. Providers sometimes focus preparation on the core module without realising that additional standards apply to their particular services. Review the specific standards relevant to your registration groups carefully.

Failing to involve participants in continuous improvement

Auditors look for evidence that providers seek feedback from participants and use it to improve their services. Providers who cannot demonstrate participant engagement — through surveys, review meetings, or documented feedback — often receive findings in this area.

Key Requirements and Best Practices

Know your applicable Practice Standards

Before preparing for an audit, identify which NDIS Practice Standards apply to your registration groups. The NDIS Commission website lists the standards and the evidence requirements for each. Understanding exactly what is being assessed is the essential starting point.

Maintain a compliance evidence folder

Organised providers maintain a central folder — physical or digital — where key compliance documents are stored and kept up to date. This should include:

• Current NDIS registration certificate

• Policies and procedures covering each relevant Practice Standard

• Worker files including NDIS Worker Screening clearances, qualifications, and training records

• Participant service agreements

• Incident and complaint records

• Governance documents such as board meeting minutes or management review records

• Evidence of participant feedback and how it has been used

Conduct internal audits

Providers who regularly audit themselves are better prepared for external assessments. An internal audit involves reviewing your own documentation and practices against the relevant Practice Standards and identifying any gaps before the auditor does. This can be done annually or more frequently for high-risk service areas.

Brief your team

During a certification audit, auditors will interview workers and may speak with participants. Workers should understand the organisation's policies, know how to report incidents and complaints, and be able to explain their role clearly. They do not need to memorise complex documents — they need to understand the day-to-day practices that reflect those documents.

Engage your auditor constructively

The audit process is not adversarial. Auditors are assessing compliance, not trying to find failures. Being organised, responsive, and transparent during the process is in your interest. If you are unsure about a request from an auditor, ask for clarification.

Address findings promptly

If an audit identifies areas of non-compliance, the provider is typically given an opportunity to address them within a specified timeframe. Taking this seriously — with documented evidence of corrective action — is important. Ignoring or dismissing audit findings can result in more serious regulatory action.

Risks and Warning Signs

Providers should be alert to internal warning signs that an audit may reveal compliance issues. Addressing these proactively is far better than having them identified externally.

• Workers who are unsure how to report an incident or complaint — suggesting policies are not embedded in practice

• A complaints register that has never had an entry — may indicate complaints are not being recorded rather than not occurring

• Service notes that are brief, inconsistent, or completed in batches rather than at the time of service delivery

• Worker screening clearances that have not been checked for expiry

• Staff training records that exist for induction but show no ongoing professional development

• Participant feedback that is collected but never reviewed or acted upon

• Governance documents — such as policies — that have not been reviewed or updated in several years

• No documented process for managing conflicts of interest, particularly in smaller organisations where management and service delivery roles overlap

Any of these patterns suggests that compliance activity is not keeping pace with the requirements. An internal review is worthwhile before the next scheduled audit.

Practical Examples

Example 1: A small provider preparing for their first certification audit

A small registered provider delivering supported independent living to four participants is notified that their certification audit is due within three months. The organisation has two full-time support workers and a part-time manager who handles administration.

The manager begins by downloading the NDIS Practice Standards and evidence guide from the NDIS Commission website and mapping their existing documents against each requirement. They identify three gaps: no documented complaints register, worker training records that are incomplete, and a participant feedback process that has never been formally run.

Over the following eight weeks, they set up a complaints register (backdated appropriately with genuine records), complete missing training documentation, and run a simple participant satisfaction survey with support from their support coordinator.

At the audit, the organisation passes with one minor finding — a policy that referenced an outdated process. The manager updates it within the required timeframe and the provider's registration is renewed.

Example 2: A compliance review triggered by a complaint

A registered provider receives a complaint from a participant's family about the quality of personal care being delivered. The family also contacts the NDIS Commission directly. The Commission initiates a compliance review, which involves requesting documentation from the provider and conducting interviews with staff.

The review finds that while the provider's policies are adequate on paper, service notes are inconsistent and there is no evidence that the participant's support plan had been reviewed in 14 months. The Commission issues a compliance notice requiring the provider to address specific gaps within 30 days and to report back with evidence.

The provider updates its service documentation processes, conducts a plan review with the participant and their family, and provides the Commission with evidence of the corrective actions taken. The matter is resolved without further escalation.

This example shows that compliance reviews can arise outside the regular audit cycle — and that responsive, well-documented corrective action is the most effective way to resolve them.

Example 3: A verification audit for a lower-risk provider

A sole trader registered to deliver assistance with household tasks undergoes a verification audit ahead of registration renewal. The auditor requests a set of specified documents by email, including the provider's current policies, a sample service agreement, evidence of public liability insurance, and confirmation of the provider's own NDIS Worker Screening clearance.

The provider has all documents ready and submits them within two business days. The auditor reviews the documents, asks one clarifying question about the service agreement template, and provides a compliant outcome within two weeks. The registration renewal is processed.

Verification audits are significantly less intensive than certification audits. Providers delivering lower-risk supports who maintain their documentation in good order typically find these processes straightforward.

Frequently Asked Questions

How often do NDIS providers need to be audited?

NDIS providers are audited as part of the initial registration process and then at each registration renewal, which occurs every three years. Some providers delivering higher-risk supports may also be subject to mid-term audits. The specific requirements depend on your registration groups. Always confirm current requirements with the NDIS Commission.

Who conducts NDIS audits?

NDIS audits are conducted by approved quality auditors — independent organisations accredited by the NDIS Commission. Providers select and engage an auditor from the NDIS Commission's list of approved auditing bodies. The NDIS Commission does not conduct audits directly but oversees the audit framework and receives audit outcomes.

What is the difference between a verification and a certification audit?

A verification audit is a desktop document review applied to providers delivering lower-risk supports. A certification audit is a comprehensive assessment that includes document review, staff and participant interviews, and a site visit. It applies to providers delivering higher-risk supports. The type of audit required is determined by your registration groups.

What evidence do auditors look for?

Auditors look for documented evidence that a provider meets the NDIS Practice Standards. This includes written policies and procedures, worker files with current screening clearances and training records, participant service agreements, incident and complaint records, participant feedback processes, and governance documents. The specific evidence requirements for each standard are available in the NDIS Practice Standards and Quality Indicators guide published by the NDIS Commission.

What happens if a provider fails an audit?

If an audit identifies areas of non-compliance, the auditor will note these as findings. Depending on their severity, the NDIS Commission may allow the provider to address the findings within a specified period, impose conditions on registration, or in serious cases, refuse registration or take further regulatory action. Providers who address findings promptly and provide documented evidence of corrective action are generally able to resolve matters without more serious consequences.

Can a compliance review happen outside the regular audit cycle?

Yes. The NDIS Commission can initiate a compliance review at any time if it receives a complaint, identifies a concern, or has reason to believe a provider may not be meeting its obligations. Compliance reviews are separate from scheduled audits and can be triggered by incidents, complaints from participants or families, or other information received by the Commission.

Do unregistered providers need to be audited?

No. NDIS audits apply only to registered providers. Unregistered providers are not assessed against the NDIS Practice Standards and are not subject to the audit process. However, they must still comply with the NDIS Code of Conduct and can be investigated by the NDIS Commission if concerns are raised.

Future Trends in NDIS Audits and Compliance Reviews

Risk-based audit approaches

There is growing interest in moving toward more risk-based audit processes — where the frequency and intensity of audits is calibrated to a provider's risk profile, track record, and the vulnerability of the participants they support. Providers with strong compliance histories may face less intensive scrutiny over time, while higher-risk operations receive closer attention.

Digital evidence submission

The audit process increasingly accommodates digital document submission and remote interviews. Providers who maintain well-organised digital records are likely to find future audits more streamlined. Auditing bodies and the NDIS Commission are continuing to develop systems that support efficient digital evidence review.

Increased focus on participant outcomes

Regulatory interest is shifting gradually from process compliance — do you have a policy? — toward outcome-based assessment — are participants actually experiencing better lives? Future audits may place greater weight on participant feedback, goal achievement, and quality of life indicators alongside documentary evidence.

Greater integration with other regulatory activity

As the NDIS Commission's data capabilities grow, audit outcomes are increasingly being connected with other compliance and enforcement activity. Providers with audit findings may receive more targeted follow-up. The Commission's overall picture of a provider — including complaints, incident reports, and audit history — is becoming more integrated.

Final Thoughts

NDIS audits are a core part of how the scheme maintains quality and safety. For providers who stay on top of their compliance obligations year-round, the audit process is manageable and often affirming.

The key is to treat compliance as an ongoing practice — not a periodic project. Providers who maintain accurate documentation, keep their policies current, train their teams consistently, and genuinely engage with participant feedback are well placed to meet audit requirements at any time.

If you are uncertain about the specific standards that apply to your registration groups, or what evidence is required, the NDIS Commission's website is the authoritative source. The Practice Standards and Quality Indicators guide sets out exactly what auditors are assessing.

Approaching audits as an opportunity to demonstrate the quality of your work — rather than as a threat to your registration — is the mindset that tends to produce the best outcomes.