Title: The Complete Guide to NDIS Compliance for Providers

Meta Description: Everything NDIS providers need to know about compliance — registration, record keeping, obligations, and avoiding common risks. Updated for 2025.

Keywords: NDIS compliance, NDIS provider obligations, NDIS registration, NDIS record keeping, NDIS Quality and Safeguards Commission

The Complete Guide to NDIS Compliance for Providers

Introduction

Operating as an NDIS provider comes with real responsibilities. Whether you are newly registered or have been delivering supports for years, understanding NDIS compliance is essential to running a safe, lawful, and sustainable service.

This guide explains what NDIS compliance means, what is required of providers, and how to meet those requirements in practice. It is written for providers of all sizes — from sole traders to large organisations — as well as support coordinators, plan managers, and family members who want to understand the system better.

NDIS compliance is not just about avoiding penalties. It is about protecting the people you support and building a service that participants and their families can trust.

What Is NDIS Compliance?

NDIS compliance refers to the legal and regulatory obligations that providers must meet when delivering supports and services under the National Disability Insurance Scheme (NDIS).

These obligations are set out in Australian law and administered by two main bodies:

• The NDIS Quality and Safeguards Commission (NDIS Commission) — which regulates registered providers across most of Australia.

• The National Disability Insurance Agency (NDIA) — which manages funding, plans, and the overall scheme.

Compliance covers a broad range of areas, including how services are delivered, how workers are screened, how complaints are managed, how incidents are reported, and how records are maintained.

Registered providers are held to the highest standard because they must meet the NDIS Practice Standards and pass a quality audit. Unregistered providers have fewer formal requirements but still must comply with the NDIS Code of Conduct.

Why NDIS Compliance Matters

NDIS compliance matters for several practical and ethical reasons.

It protects participants

The NDIS supports some of the most vulnerable people in Australia. Strong compliance requirements exist to prevent abuse, neglect, and exploitation. When providers meet their obligations, participants receive safer and more consistent support.

It protects your business

Non-compliance can result in audits, fines, suspension, deregistration, banning orders, or referral to police. These consequences can end a provider's ability to operate in the NDIS market.

It builds trust

Participants and their families choose providers based on trust. A provider with a strong compliance record is more likely to attract and retain participants over time.

It supports scheme sustainability

When providers invoice correctly, use funds appropriately, and deliver genuine supports, they help maintain the integrity of the NDIS for everyone.

Common Compliance Mistakes

Many providers make compliance errors not from intention but from a lack of understanding. These are among the most common issues identified by the NDIS Commission.

Inadequate record keeping

Records must be accurate, up to date, and stored securely. Providers often fail to document service delivery in enough detail, or they do not retain records for the required period. Poor record keeping makes it impossible to demonstrate that supports were actually delivered.

Missing or outdated worker screening

Registered providers must ensure workers hold a valid NDIS Worker Screening clearance before they work with participants. Allowing workers to start without a clearance is a serious breach.

Failing to report incidents

Providers are required to report certain incidents to the NDIS Commission within specific timeframes. Many providers either do not report at all or report late. Both are compliance failures.

Incorrect invoicing

Billing for services not delivered, charging above the NDIS price limits, or claiming for supports that are not in a participant's plan are all serious breaches. These may constitute fraud.

Lack of documented policies and procedures

Registered providers are expected to have written policies covering areas such as complaints management, incident response, and restrictive practices. Many smaller providers have no documented procedures in place.

Not understanding the Code of Conduct

The NDIS Code of Conduct applies to all providers and their workers — registered or not. Some providers are unaware of its requirements or do not pass those requirements on to their staff.

Key Requirements and Best Practices

Registration

Not all providers need to be registered. Registration is required if you want to deliver supports to participants who are plan managed by the NDIA (agency-managed) or who have a disability that requires certain higher-risk supports.

To become registered, providers must apply to the NDIS Commission and undergo an audit against the NDIS Practice Standards. The type of audit — verification or certification — depends on the supports you deliver.

Registration must be renewed, and providers must continue to meet the Practice Standards to maintain their registration. If your services or scope change, you may need to update your registration.

The NDIS Code of Conduct

The NDIS Code of Conduct sets out seven obligations for all providers and workers. These include acting with respect and integrity, providing safe and competent support, and taking action to prevent and respond to abuse and neglect.

Providers must ensure their workers understand the Code. This includes providing appropriate training and establishing workplace expectations that align with the Code.

Worker Screening

Registered providers must verify that workers who deliver certain supports hold a valid NDIS Worker Screening clearance. This is a national check that assesses whether a person poses a risk to people with disability.

Providers should keep records of worker clearances and have a process in place to check expiry dates. Clearances are not permanent and must be renewed.

Record Keeping

Good record keeping is one of the most important parts of NDIS compliance. Providers must maintain accurate records of:

• Services delivered, including dates, times, and what was provided

• Worker details and qualifications

• Participant agreements and service bookings

• Incident reports and complaint records

• Invoices and financial transactions

Records must be stored securely, kept confidential, and retained for a minimum period. For most provider records, the required retention period is seven years, but you should check current NDIS guidance as requirements may vary by document type.

Digital record keeping systems can help providers maintain accurate and accessible records. Whatever system you use, ensure it is backed up and access is restricted to authorised staff.

Incident Management

Registered providers must have an incident management system and report certain incidents to the NDIS Commission. Reportable incidents include serious injury, death, abuse, neglect, unlawful physical or sexual contact, and use of unauthorised restrictive practices.

Initial reports must be made within 24 hours for incidents involving death or serious injury. Full written reports are required within five business days. These timeframes are strict.

All incidents — including those that do not meet the threshold for mandatory reporting — should be recorded internally and reviewed as part of continuous improvement.

Complaints Management

Providers must have a clear process for receiving, acknowledging, and resolving complaints. This process must be accessible to participants, including those with communication support needs.

Participants also have the right to raise concerns directly with the NDIS Commission. A provider that discourages or obstructs a participant from complaining is in breach of its obligations.

Restrictive Practices

Restrictive practices are interventions that restrict the rights or freedom of movement of a person with disability. Their use is tightly regulated under the NDIS framework.

Only registered providers can use regulated restrictive practices, and only under specific conditions — including authorisation by the relevant state or territory authority, a behaviour support plan prepared by a registered behaviour support practitioner, and ongoing monitoring and reporting.

Unauthorised use of restrictive practices is a serious breach and must be reported to the NDIS Commission.

Risks and Warning Signs

Understanding where compliance risks emerge is the first step to preventing them. These warning signs suggest a provider may be operating outside their obligations.

• Workers starting with participants before their NDIS Worker Screening clearance is confirmed

• Service agreements that are missing, unsigned, or not kept on file

• Invoices submitted for services that have no corresponding service notes

• Complaint processes that are not documented or not accessible to participants

• No formal induction or training for new workers on the Code of Conduct

• Managers or owners who are unfamiliar with the NDIS Practice Standards that apply to their registration

• Incident reports that are regularly overdue or not completed at all

• Participant records stored insecurely or accessible to staff who do not need them

If any of these apply to your organisation, it is worth conducting an internal review before an audit or complaint triggers external scrutiny.

Practical Examples

Example 1: Record keeping in a small support organisation

A sole trader providing community access supports to five participants keeps a paper diary with session notes. During an NDIS audit, the auditor asks for service records for the previous 12 months. The provider cannot locate notes from three months of sessions. This creates a compliance gap — the provider cannot demonstrate that the services they billed for were actually delivered.

A simple digital system — even a spreadsheet with session dates, names, support type, and notes — would have prevented this problem.

Example 2: Incident reporting in a supported accommodation setting

A participant living in supported accommodation falls and sustains a fracture requiring hospitalisation. The house supervisor calls the participant's family and takes the participant to hospital but does not submit an incident report to the NDIS Commission, believing the family notification is sufficient.

This is a reportable incident. The provider should have submitted an initial report to the NDIS Commission within 24 hours and a full written report within five business days. Failing to do so is a breach of provider obligations, regardless of how well the situation was otherwise handled.

Example 3: Worker screening and employment

A support organisation receives a last-minute cancellation from a regular worker and asks a newly hired casual worker to fill the shift. The casual worker has submitted their NDIS Worker Screening application but does not yet have a clearance number.

Under the rules for registered providers, allowing this worker to deliver supports to participants before their clearance is issued is a compliance breach. The organisation would need to find a cleared worker to cover the shift, or in some circumstances, use an interim arrangement permitted under state or territory rules. Providers should check current guidance from the NDIS Commission and their state authority on interim arrangements.

Frequently Asked Questions

Do all NDIS providers need to be registered?

No. Providers do not need to be registered to support participants who self-manage their NDIS funds. However, registration is required to support agency-managed participants and to deliver certain high-risk supports. All providers — registered or not — must comply with the NDIS Code of Conduct.

What records must NDIS providers keep?

Providers must keep records of service delivery, worker details and screening, participant agreements, financial transactions, incidents, and complaints. Records must be accurate, secure, and retained for the required period. Most records must be kept for a minimum of seven years, but providers should check current NDIS Commission guidance.

What is a reportable incident under the NDIS?

A reportable incident is a serious event that registered providers must report to the NDIS Commission. This includes death, serious injury, abuse, neglect, unlawful physical or sexual contact, and the use of unauthorised restrictive practices. Initial notification must be made within 24 hours for the most serious incidents.

What happens if a provider is found to be non-compliant?

The NDIS Commission can take a range of actions against non-compliant providers. These include issuing compliance notices, imposing conditions on registration, applying civil penalties, suspending or cancelling registration, and issuing banning orders against individuals. In serious cases, matters may be referred to law enforcement.

Does the Code of Conduct apply to workers as well as providers?

Yes. The NDIS Code of Conduct applies to both providers and their workers. Providers are responsible for ensuring their workers understand and comply with the Code. Workers who breach the Code can also be investigated by the NDIS Commission directly.

What is the NDIS Practice Standards?

The NDIS Practice Standards are a set of quality requirements that registered providers must meet. They cover areas including rights and responsibilities, governance and management, support provision, and specialist support requirements. Providers are assessed against the Practice Standards during registration audits.

How often do registered providers need to be audited?

Registered providers are audited as part of the initial registration process and then at renewal, which occurs every three years. Mid-term audits may also apply for some providers. The type and frequency of audits depends on the risk level of the supports delivered. Providers should confirm current requirements with the NDIS Commission.

Future Trends in NDIS Compliance

NDIS compliance continues to evolve. Providers should be aware of the following directions in the sector.

Stronger fraud prevention measures

The NDIA and NDIS Commission have increased their focus on fraud and incorrect billing. Data analytics are being used to identify providers who bill unusual patterns. Providers can expect increased scrutiny of claims and payment records.

Reforms following the NDIS Review

The 2023 Independent Review of the NDIS made a number of recommendations that are being progressively implemented. These include changes to how the scheme supports participants and how provider quality is assessed. Providers should monitor updates from the NDIA and NDIS Commission as reforms take effect.

Digital compliance systems

More providers are moving to digital platforms for record keeping, incident management, and reporting. Well-implemented digital systems can reduce compliance risk by automating reminders, standardising record formats, and creating clear audit trails.

Greater participant voice and self-direction

Reforms are placing a stronger emphasis on participant choice, voice, and control. Providers who embed these values into their service delivery — not just their compliance documents — will be well placed as the scheme continues to mature.

Final Thoughts

NDIS compliance is not a one-off task. It is an ongoing commitment that should be embedded into how your organisation operates every day.

Providers who invest in strong compliance practices — clear documentation, well-trained workers, robust incident management, and regular self-review — are better positioned to deliver quality supports, avoid regulatory action, and build lasting relationships with participants and their families.

If you are unsure about any aspect of your obligations, the best starting point is the NDIS Commission website and its published guidance materials. For complex compliance questions, consulting a specialist with NDIS experience is a sound investment.

The NDIS exists to improve the lives of Australians with disability. Every provider that takes its obligations seriously contributes to making that possible.