NDIS Audit Preparation Checklist

NDIS audits are predictable. Auditors assess defined Practice Standards outcomes using a familiar set of documents, registers, and records, which means you can prepare for almost all of it in advance. This checklist covers what they ask for, organised the way audits actually run.

Last updated: 8 October 2026

Before you start: know your audit scope

Your preparation list depends on your pathway and modules. The Initial scope of audit document that the NDIS Commission emails when you submit your application tells you whether you face a desktop verification or two-stage certification audit, and which Practice Standards modules apply. Not sure yet? Our registration pathway checker gives a guide. Everything below assumes certification scope. The Verification Module covers a smaller set: human resource management, incident management, complaints management and risk management. Items that also apply to verification are marked. The outcomes and indicators auditors assess are on the Commission's NDIS Practice Standards pages, including the Core Module: Provision of supports that participant files are tested against.

The steps around the audit have their own guides: how to write your self-assessment, how to choose an approved quality auditor, what to expect in audit interviews, and how non-conformities are rated and fixed.

1. Governance and organisational documents

Business registration, ABN, and organisational structure chart
Details and roles of all key personnel
Insurance certificates of currency. The Practice Standards expect professional indemnity, public liability and accident insurance (also required for verification). Check separately what your state requires for workers compensation.
Governance framework: delegations, management meeting records, board or owner oversight arrangements
Strategic and business planning, and a documented system of delegated authority for when a usual position holder is away
Emergency and disaster management plans, developed with participants and tested. See the emergency and disaster plan page
Conflict of interest policy and register. See the conflict of interest policy page

2. Core policies and procedures

These map to the Core Module of the Practice Standards. The full list runs long, our guide to NDIS policies and procedures breaks it down by standard, but the set auditors check first:

Rights and responsibilities of participants, including dignity of risk and freedom from abuse, neglect, and exploitation
Privacy, dignity, and confidentiality
Independence and informed choice, including supported decision-making
Violence, abuse, neglect, exploitation, and discrimination prevention and response
Risk management policy with a current organisational risk register
Quality management and continuous improvement, including a documented program of internal audits
Information management: consent to collect, use and disclose information, and storage, retention and disposal of documents
Incident management system aligned to the NDIS reportable incident rules
Complaints and feedback management, including information on avenues outside your organisation
Continuity of supports, including arrangements when a worker is absent
Human resource management: recruitment, screening, induction, performance, exits
Safe environment, work health and safety, and infection control
Medication management, mealtime management, and waste management where relevant to your supports
Transitions to and from your service, planned with the participant

3. Registers and logs

Registers are where auditors test whether your system is real. A documented process that you cannot show is implemented is one of the two usual situations for a minor non-conformity under the audit rules.

Incident register (including reportable incidents and the Immediate Notification and 5 Day forms). See the incident report template page
Complaints and feedback register
Risk register, reviewed and dated
Continuous improvement register with closed-out actions. See the continuous improvement register page
Restrictive practices register, if any are used or could foreseeably occur
Worker screening register with clearance numbers and expiry dates
Training register mapped to roles
Asset/equipment maintenance log where you use equipment in supports

4. Worker records

NDIS Worker Screening clearances for everyone in a risk-assessed role (also required for verification)
Qualifications and AHPRA or professional body registrations where applicable (also required for verification)
NDIS Worker Orientation Module certificates
Position descriptions, signed contracts, and code of conduct acknowledgements
Induction checklists and role-specific training evidence (first aid, manual handling, medication, restrictive practices awareness as relevant)

5. Participant records

For each participant file sampled, auditors typically want to see:

Service agreement in accessible language, with a signed copy given to the participant. See the service agreement page
Intake and individual risk assessment, including how much the participant relies on you and what a disruption would mean. See the risk assessment page
Support plan reflecting participant goals and choices, and reviewed annually or earlier
Consent records, for services, information sharing, and emergency contact
Progress notes that match the supports billed
Evidence of plan reviews and participant involvement in them

New providers without participants should have every template ready and be able to walk the auditor through how a participant would move through intake to review.

6. Module-specific evidence

Module 1 (high intensity supports): clinical procedures for each high intensity skills descriptor you deliver, health care plans, and worker training delivered by an appropriately qualified health practitioner or a person who meets the skills descriptor.
Module 2 / 2a (behaviour support): functional assessment and plan development processes, restrictive practice authorisation evidence, implementation and monitoring records.
Module 3 (early childhood supports): family-centred practice framework, developmental assessment, and transition planning records.
Module 4 (specialised support coordination): crisis management procedures, conflict of interest controls, and multi-agency coordination records.
Module 5 (SDA): dwelling enrolment, tenancy management, property maintenance, and emergency procedures per dwelling.
Supplementary module: Supported independent living (SIL): evidence for its four outcomes: supported decision-making, safeguarding, practice governance, and agreements about tenancy, housing and support arrangements. The Commission publishes an evidence guide for it. Our package does not include documents written for this module.

7. The audit cycle and timings

You must complete your registration application within 60 days of starting it, or it is deleted.
A certification audit has a Stage 1 desktop audit and a Stage 2 onsite audit. The audit rules say Stage 2 should start within three months of Stage 1, and your auditor gives you the Stage 1 findings at least one or two weeks before Stage 2.
The auditor submits the report to the Commission within 14 days of a verification audit or 28 days of a certification audit.
You have 3 months to fix a major non-conformity, and your registration will not progress until it is fixed.
Registration is generally for three years. Certified providers have a mid-term audit around 18 months in, with some exceptions, then renew.

Sources: the Commission's quality audit process and apply for registration pages, and the Approved Quality Auditors Scheme Guidelines 2018. Your Initial scope of audit and your auditor confirm your own dates.

8. The week before the audit

Re-read your self-assessment. Stage 1 reviews it, so know what you claimed and where the evidence sits.
Check every certificate and clearance for currency, because an expired insurance certificate or screening record is easy to avoid.
Brief your staff. In Stage 2, auditors interview workers who directly provide supports, so staff who have never seen the procedures can undo months of document work. See audit interview questions.
Organise files so any document can be produced quickly, named and foldered by Practice Standards area.
Have your continuous improvement register show genuine, closed-out items. A closed item with evidence shows your quality system changes how you work.
If participants will be sampled, make sure they have been told they are included unless they opt out, and record any decision to opt out.

Using a document set

Starting from a complete, standards-mapped document set can save weeks, but the Commission expects your documents to describe how you really operate. Read our guide to adapting NDIS policy templates before you submit anything. Our registration package includes 220+ editable Word documents covering the Core Module and Modules 1 to 5, ready to customise. It does not include documents written for the SIL supplementary module and it does not guarantee registration. See how it works, the templates library, or check the FAQ. To budget for the audit, use the registration cost calculator.

This page is general information based on NDIS Commission and government sources at the date shown. It is not legal or professional advice, and the rules can change. Check the NDIS Commission's current requirements and read our disclaimer.

Frequently Asked Questions

What do NDIS auditors actually look at?

Auditors assess you against the NDIS Practice Standards for your registration groups. They review your self-assessment, policies and procedures, registers, participant files, service agreements, worker screening and training records, insurance and governance records. In certification audits they also interview staff and participants and may observe supports, to confirm the documents reflect real practice.

What is a non-conformity in an NDIS audit?

A non-conformity is a gap between what the Practice Standards require and what you can demonstrate. Under the audit rules, a minor non-conformity (rating 1) is usually a process without supporting documentation, or a documented process you cannot show is implemented or reviewed. A major non-conformity (rating 0) is where you cannot demonstrate the processes, systems or structures to meet the outcome, or the gap is high risk. The Commission says you have 3 months to fix a major non-conformity and your registration will not progress until it is addressed.

How far in advance should I start preparing for an NDIS audit?

Start before you apply. The Commission says you must complete your application, including the self-assessment, within 60 days of starting it, so gather your evidence first. For mid-term and renewal audits, preparation should be continuous, because auditors look for evidence that your systems operated throughout the period.

Do I need participants before my first certification audit?

No. A new provider that has built its systems but has not started delivering services can have a provisional audit, which results in a qualified certification decision. The audit rules say a further Stage 2 audit may be required once you start delivering services, generally before the mid-term audit, and the Commission can impose a condition audit.