NDIS audits explained: verification, certification and mid-term audits

To become a registered NDIS provider, you're assessed against the NDIS Practice Standards by an independent approved quality auditor. The audit type depends on the supports you'll provide, and registered providers can face more audits during their registration period.

Verification or certification?

Your registration groups decide your audit type:

• Verification audit: for providers who only deliver lower-risk or lower-complexity supports. It's a desktop review of your documents against the Verification module. Many verification providers already meet professional regulation, for example through AHPRA or professional bodies.
• Certification audit: for providers who deliver one or more higher-risk or more complex supports. It's assessed against the Core module plus any supplementary modules for your groups.

If you apply for groups with both audit types, you need a certification audit. When you apply, the NDIS Commission sends an Initial scope of audit that confirms your audit type.

How a certification audit works

There are two stages:

1. Stage 1, desktop audit: the auditor asks for information and evidence, usually off-site.
2. Stage 2, onsite audit: the auditor looks at how you put your policies into practice. This can include viewing records, visiting sites, interviewing staff and participants, and observing supports. Stage 2 should happen within 3 months of Stage 1.

Auditors look for evidence that your systems work, not just that they exist: incident reports, complaints records, training logs and supervision notes. They sample staff files to check worker screening clearances, qualifications, induction records and ongoing training and supervision.

The audit must be proportionate to your size, the scale of your operations (including locations) and the scope and complexity of your supports.

Other audits

• Mid-term audit: providers registered for certification groups generally need one, starting no later than 18 months into the registration period. It covers the governance and operational management standards, any standard that needed a corrective action plan, and any extra standards the Commission specifies. It doesn't apply to an individual or partnership registered only for early childhood supports, a provider registered only for SDA, or a transitioned provider.
• Condition audit: the NDIS Commission can require an audit during your registration period, for example after a provisional certification audit, outstanding minor non-conformities or a change of ownership.
• Out-of-cycle audit: you can arrange an audit at any time to support a change to your registration, such as adding registration groups.

Audit ratings

The audit report rates how well you comply with each standard and quality indicator:

• 3: conforms with elements of best practice
• 2: conforms with NDIS Practice Standards
• 1: minor non-conformity
• 0: major non-conformity.

Auditors submit their report to the Commission up to 14 days after a verification audit, and up to 28 days after a certification or mid-term audit.

Choosing an approved quality auditor

You choose an auditor from the NDIS Commission's list and use your Initial scope of audit to request quotes. The Commission recommends getting more than one quote and asking questions to make sure the auditor suits your organisation. Auditors are accredited by JASANZ. If you have a complaint about an auditor, raise it with the auditor first, then the auditing body, then JASANZ.

Participants and audits

You must tell participants about the audit and give them opportunities to talk to the auditors. Audits use an opt-out approach: participants are included unless they say no. If someone opts out, respect and record their decision and tell the auditor.

Get ready

• Use the audit checklist for your audit type.
• Self-assess against the Practice Standards.
• Estimate your audit costs.