NDIS PROVIDER COMPLIANCE & AUDIT SUPPORT

Maintain compliance evidence throughout the year rather than collecting it shortly before an audit.

Participant files should be complete, worker screening and training should be monitored before they expire, and incident and complaints records should show what happened and what action followed. The Commission’s worker screening requirements also outline the records registered providers need to maintain.

An NDIS internal audit can then sample these systems regularly and identify problems early.

First determine whether the problem sits within the documentation, the actual service delivery or both.

If your NDIS policies and procedures are correct but staff are not following them, rewriting the policy alone is unlikely to resolve the issue.

Identify the underlying cause, implement corrective action and retain evidence showing that the change has been put into practice. The NDIS Commission provides further guidance on audit non-conformities and corrective action.

There is no useful “set and forget” approach.

NDIS policies and procedures should be reviewed when requirements change, services expand, operating practices change, an incident exposes a weakness or an audit identifies a gap.

Regular reviews also help ensure your procedures continue to align with the relevant NDIS Practice Standards and the way your organisation actually operates.

An NDIS internal audit can test areas such as participant records, incidents, complaints, worker files, training, risk controls, governance and compliance with registration requirements.

The scope should reflect the provider’s services and risks rather than using exactly the same checklist for every organisation.

It should also test implementation. Reviewing a policy without looking at the records and practices behind it may miss the actual compliance problem.

No. Mid-term audits generally apply to registered providers that completed a certification audit for higher-risk or more complex supports, subject to some exceptions.

Providers should check their registration and audit requirements rather than assuming another provider’s audit schedule applies to them. 

Address any continuing participant safety risk first, then establish what happened, when the organisation became aware of it and whether a notification remains outstanding.

The provider should also review why the incident was not recognised or escalated correctly so the same problem is less likely to recur. See the Commission’s guidance on NDIS reportable incidents.

Confirm whether the worker can continue performing the role, address any immediate compliance or participant safety risk and update the missing evidence as required.

The provider should also review its monitoring process. Expired records often indicate that renewal dates are being managed reactively rather than through an ongoing workforce compliance system.

Confirm whether the support falls within your existing registration scope and whether different Practice Standards, worker requirements or audit obligations apply.

Checking this before service delivery begins can prevent the provider from expanding into an area without the required registration or compliance systems.