NDIS Quality and Safeguards audit preparation: a practical checklist for providers

For registered NDIS providers, the Quality and Safeguards Commission audit is one of the most consequential compliance events in the calendar. It determines whether your organisation can continue to deliver funded supports, and it tests not just your paperwork but the culture and systems behind it. Yet many providers — especially growing ones adding new support categories or staffing models — approach audits reactively rather than systematically. This checklist-based guide is designed to help practice managers and provider principals build a year-round readiness posture.

Understanding the two audit pathways

The NDIS Commission distinguishes between verification and certification audits. Verification applies to providers delivering lower-risk supports — plan management and support coordination are the most common examples. It is a documentary review: the auditor examines your policies, procedures, and evidence without necessarily visiting your premises.

Certification applies to providers delivering higher-risk supports, including specialist disability accommodation, behaviour support, early childhood, and daily personal activities. Certification audits involve both a document review and site visits, including interviews with participants, families, and staff. They assess your compliance against the NDIS Practice Standards, which are grouped into four core modules plus specialist modules relevant to the supports you are registered for.

Knowing which pathway applies to you — and which modules you are assessed against — is the starting point. If you have expanded your support catalogue since your last audit, check whether you have moved into certification territory.

The foundation: policies, procedures, and governance documents

Auditors expect to see a coherent policy framework that is current, accessible to staff, and demonstrably enacted. Documents that exist in a shared drive but have never been reviewed or trained against will not satisfy an auditor.

• A participant rights and responsibilities policy, including complaint and feedback mechanisms, updated to reflect any Commission guidance issued since your last audit.
• A risk management policy and current organisational risk register that identifies participant-facing, operational, and workforce risks.
• A code of conduct aligned to the NDIS Code of Conduct, with evidence that every worker — including offshore administrative staff — has read and acknowledged it.
• Worker screening and recruitment policies confirming that all workers in risk-assessed roles hold a current NDIS Worker Screening Check.
• A complaints and incidents policy with clear escalation pathways, consistent with your obligations under the incident management and reportable incidents rules.
• Governance documents: board or management meeting minutes from the past 12 months, evidence of management review of key compliance metrics, and any corrective action records.

Document version control and review cycles

Each policy should carry a version number, an approval date, and a scheduled review date. Auditors will ask whether policies have been reviewed in the past year and whether any reviews were triggered by legislative or Commission guidance changes. A simple document register — even a spreadsheet — showing title, version, owner, and next review date is sufficient for most providers. For larger organisations, a document management system is worth the investment.

Workforce evidence — your largest audit risk

Worker-related compliance is consistently the area where providers are found non-compliant. The Commission’s enforcement actions repeatedly identify gaps in worker screening, training records, and supervision documentation.

• Maintain a workforce register listing every worker (including contractors and offshore staff in administrative roles), their role, their worker screening status, and expiry dates. The register should be reviewed at least monthly.
• Retain evidence of induction training for each worker, including the mandatory NDIS orientation module completion certificates.
• For workers delivering behaviour support or restrictive practices, confirm they hold relevant qualifications and that their authorisation to implement regulated practices is current.
• Keep supervision records — at minimum, dates, topics discussed, and any agreed actions — for workers in higher-risk roles.
• Document any performance management actions, particularly where participant safety was a concern, and retain these records for the period specified in your state’s employment records legislation.

Participant records and service agreements

Every participant you support should have a current service agreement that reflects their current NDIS plan, the supports you are funded to deliver, and your obligations around cancellations, complaints, and advocacy. Auditors will sample a number of participant files; a consistent, complete file structure across all participants is far easier to defend than a collection of files in varying states.

Key documents in each participant file should include: the current service agreement, a participant-specific support plan or care plan, a risk assessment, progress or support notes, and any incident reports relating to that participant. If you are delivering complex supports, you will also need behaviour support plans and evidence of the authorisation process for any regulated restrictive practices.

The 90-day pre-audit sprint

If your renewal date is visible on the horizon, the 90 days before your audit window is the time to run a structured internal review. A mock audit — conducted by your compliance lead or an external consultant — against each relevant Practice Standard module will surface gaps early enough to remedy them.

• Pull a sample of ten participant files and assess them against your file-completion checklist. Identify and remedy any gaps before the auditor sees them.
• Run a workforce register reconciliation: cross-check every active worker against the Worker Screening database to confirm current clearances.
• Review all open corrective actions from your previous audit and ensure they are closed with evidence.
• Test your complaints register: does it capture every complaint received, the response provided, and whether the complainant was satisfied with the outcome?
• Brief key staff on what to expect during auditor interviews — particularly frontline workers who may not be familiar with the formal audit process.
• Prepare a one-page summary of your organisation’s key metrics: number of participants supported, support categories, workforce size, incidents reported in the past 12 months, and complaints resolved.

After the audit — managing findings and continuous improvement

A finding of non-conformity is not the end of the world. The Commission’s expectation is that providers treat findings as opportunities for systemic improvement. Your corrective action plan should identify the root cause of each finding — not just the surface symptom — and specify measurable actions, accountable owners, and target dates.

Providers who use their audit findings as the basis for a genuine improvement cycle tend to perform significantly better at their next renewal. Build a schedule of quarterly internal compliance reviews so that evidence accumulates continuously rather than being assembled in a panic.

As the sector matures, the Commission is increasing the rigour of its audit programme, particularly for providers delivering high-intensity daily personal activities and specialist behaviour support. Providers who invest in robust systems now — including well-documented offshore support arrangements — will find the audit process progressively less disruptive. This article is general guidance only. Consult the NDIS Commission’s published resources and seek independent compliance advice tailored to your registration type and support catalogue.