NDIS audit evidence and non-conformity ratings: what approved quality auditors require

Most NDIS providers understand that their audit is either a verification or a certification audit. Far fewer understand the machinery that follows: how each Practice Standard is rated, what a major non-conformity does to your registration timetable, and which additional audits sit inside a registration period.

If you are still working out which pathway applies to you, start with NDIS certification vs verification audits. This article assumes you know the pathway and covers what the auditor does with it.

The five audit types, not two

The scope of audit issued by the NDIS Quality and Safeguards Commission tells you which audit you need. There are five, and three of them occur *inside* a registration period rather than at its edges.

In a certification audit, the Stage 2 onsite audit should take place in the three months after Stage 1 is complete. Providers who allow that window to lapse restart negotiation with their auditor and their own registration timetable.

Mid-term audits do not apply to every certified provider. The exclusions include an individual or partnership that only required a certification audit to provide early intervention supports for early childhood, and a provider registered only to provide specialist disability accommodation. A condition audit can be triggered where not all certification classes of support were witnessed at the original audit, where minor non-conformities remain outstanding, where there is a change of ownership causing a significant change to the organisation or its governance, or where the Commissioner considers it necessary.

How auditors rate you: the 0 to 3 scale

The audit report rates your compliance with each NDIS Practice Standard and quality indicator, and those ratings go to the Commission. The scale is four points:

Note that the passing grade is 2, not 3. A rating of 3 is available but not required, and chasing it at the expense of closing a 1 elsewhere is a poor use of preparation time.

The full rating methodology sits in Annex B of the National Disability Insurance Scheme (Approved Quality Auditors Scheme) Guidelines 2018, which your auditor works from. Our explainer on the Practice Standards themselves covers the modules assessed.

The three-month clock on a major non-conformity

The two non-conformity ratings behave very differently, and the difference is measured in registration risk.

• A major non-conformity (0) in any area gives you three months to fix the issue. Your registration will not progress until the major non-conformity is addressed and the quality audit is successfully completed.
• A minor non-conformity (1) gives you a longer period to fix the issue, and you can continue with the registration process in the meantime.

The practical consequence is that a single major non-conformity stalls your registration decision entirely. For a provider whose current registration is approaching expiry, that is an operational emergency rather than a paperwork matter. Providers with certification audits should build a buffer of several months between the planned audit and the registration expiry date precisely so that a major finding has room to be remediated and re-tested.

Where an auditor identifies areas of improvement during a mid-term audit, the guidance is to promptly provide the information or plans requested rather than to argue the finding first. The finding is recorded either way; the response is what determines whether it becomes a corrective action plan.

The evidence pack, by Practice Standard area

Auditors test whether systems operate in practice, not whether documents exist. The table below sets out the evidence that reliably answers each area, and the failure mode that produces a non-conformity.

Providers delivering plan management intermediary supports have a specific documentary set: a list of all workers delivering plan management services, certified copies of each worker's qualifications and associated professional memberships as required by the Practice Standards, and worker screening clearances for each worker.

For worker screening in particular, see NDIS Worker Screening Check requirements and the worker screening obligation. The NDIS provider readiness tool is a reasonable way to inventory these before the auditor asks.

Participant sampling runs on opt-out

This surprises providers who assume they nominate which participants an auditor speaks to. The sampling method used in NDIS audits is opt out.

That means you must let all participants know they are automatically included in the audit process — which may involve the audit team contacting and interviewing them, or reviewing their files, records or plans. If a participant does not want to take part, you must respect that decision, document it, and communicate it to the approved quality auditor.

Two obligations follow. First, notification is your job, not the auditor's, and failing to notify participants is itself a finding. Second, you cannot curate the sample. A file that would not survive scrutiny is as likely to be selected as one that would, which is the point.

Report timeframes and who decides your registration

The auditor writes the report; the Commission makes the decision. Nothing about a good audit result binds the Commission, and the NDIS Quality and Safeguards Commission's powers extend well beyond registration.

The audit report is submitted to the Commission:

• Up to 14 days after completion of a verification audit.
• Up to 28 days after completion of a certification audit.
• Up to 28 days after completion of a mid-term audit.

Add those windows to your renewal planning. A certification audit completed four weeks before expiry may not even have reached the Commission by the time your registration lapses. See the NDIS audit cycle obligation and the NDIS provider hub for the wider registration timetable.

Choosing and complaining about an approved quality auditor

You engage and pay the auditor directly, from the Commission's published list — the Commission itself explains how to find an auditor and the types of audits that apply, and publishes the Practice Standards themselves.

Approved quality auditors are subject to the Australian Consumer Law and are accredited by the Joint Accreditation System of Australia and New Zealand, which regulates auditor behaviour through the NDIS auditor guidelines and a code of conduct for auditors. The Commission meets with the accreditation body and approved auditor bodies regularly.

If you are unhappy with your auditor, the escalation path is sequential: raise it with the auditor, then with the approved quality auditor body that employed or contracted them (which must have a complaints management system), then with the accreditation body — which will expect to see that you tried the first two steps.

One practical point from the Commission's own guidance: staying with the same approved quality auditor across an audit cycle tends to produce more consistent audits, clearer feedback and better tracking of progress, because the auditor becomes familiar with your service and your participants. Weigh that against price when you re-tender.

Providers who also operate in aged care will find the equivalent machinery set out in aged care provider registration and audits — the vocabulary differs, but the evidence sets substantially overlap.