NDIS policies and procedures: what the Practice Standards ask for

The NDIS Practice Standards don't give you a list of required policy documents. Instead, their quality indicators describe what auditors look for, and many say a policy, procedure or documented system should be in place. This guide lists those, by module, so you can check what you need.

Auditors check that your policies work in practice, not just that they exist. Many indicators also say your systems should be relevant and proportionate to your size, scale and the complexity of your supports.

Verification module (lower-risk supports)

Quality indicators in the Verification module call for:

• a documented risk management system for work health and safety risks, including emergency and disaster planning
• a complaints management and resolution system that meets the NDIS (Complaints Management and Resolution) Rules 2018
• an incident management system that meets the NDIS (Incident Management and Reportable Incidents) Rules 2018.

Core module (higher-risk supports)

Quality indicators in the Core module call for:

• policies, procedures and practices that actively prevent violence, abuse, neglect, exploitation or discrimination
• confidentiality policies, explained to each participant in a way they're most likely to understand
• conflict of interest management, documented, including through organisational policies
• a documented system of delegated responsibility and authority when a usual position holder is absent
• a documented risk management system covering incident management, complaints, financial management, governance and operational management, human resources, information management, work health and safety, and emergency and disaster management
• a quality management system with a documented program of internal audits
• an information management system
• a complaints management and resolution system, with complaint and feedback policies and procedures reviewed regularly
• an incident management system, with incident management policies and procedures reviewed regularly
• plans to source and induct a workforce if an emergency or disaster disrupts it
• emergency and disaster management plans, developed with participants and tested
• procedures for texture-modified foods and fluids, if you provide mealtime management
• policies, procedures and practices for waste and infectious or hazardous substances, and an emergency plan for clinical waste issues.

Supplementary modules

• Module 1 (high intensity daily personal activities): appropriate policies and procedures, including a training plan for workers, for each high intensity support you provide.
• Modules 2 and 2A (behaviour support): policies, procedures and practices showing commitment to reducing and eliminating restrictive practices; under Module 2A, policies and procedures that support implementing behaviour support plans.
• Module 3 (early childhood): practices and procedures to manage risk with a focus on a safe environment for children.
• Modules 4 and 5 (specialised support coordination, SDA): conflict of interest policies made available to participants; for SDA, policies and procedures on vacancies in shared living, and tenancy policies in accessible formats.
• Module 5A (supported independent living): policies and procedures for supported decision-making, safeguarding and dignity of risk, workers' responsibilities for responding to risks in the home, worker development and training, a documented vision and values for supports in the home, conflicts of interest where you provide both SIL and tenancy, and raising concerns without fear of retribution.

New legal requirements from 2026

The National Disability Insurance Scheme Amendment (Securing the NDIS for Future Generations) Act 2026 adds two requirements that your policies and procedures should cover.

• Keep records for 7 years. Since 27 August 2026, providers must keep records relating to NDIS claims for 7 years from the day the claim is made. Not doing so attracts a civil penalty. Check your information management and record-keeping procedures.
• No inducements. From 20 November 2026 (the date in the Act's commencement table; the Government's timeline says 27 November), NDIS providers must not give or offer a gift, benefit or other thing that's reasonably likely to induce someone to engage them for supports, whether or not that person is the participant. There are exceptions for legitimate pricing practices, the provider's own merchandise and conduct permitted by the NDIS rules, but the rules can't permit cash or cash-like products (such as gift cards), alcohol, tobacco, illegal drugs or electronic devices. A breach is an offence and can attract a civil penalty. Check your marketing, referral and client-retention practices.

Using templates or a consultant

The NDIS Commission expects you to be substantially involved in your application, understand what you submit, and make sure your policies accurately reflect how your organisation will deliver supports. Responses that are the same as, or very similar to, other providers' can suggest you don't understand the standards, and your application may be refused.

Next steps

• Find which modules apply to you.
• Self-assess against every outcome and note which policies you have.
• Use the audit checklist.