How audit findings are rated
This guide builds on our audit preparation checklist. The NDIS Commission's quality audit process page explains that the audit report rates how well you comply with each Practice Standard and quality indicator, using four ratings:
- 3: conforms with elements of best practice.
- 2: conforms with the NDIS Practice Standards.
- 1: minor non-conformity.
- 0: major non-conformity.
The detailed definitions are in Annex B of the Approved Quality Auditors Scheme Guidelines 2018, and the timeframes are in Annex C. We summarise them below. Always rely on the current text and on what your auditor tells you.
Minor versus major
A minor non-conformity usually arises in one of two situations, according to the Guidelines. First, a process, system or structure is being implemented but the supporting documentation is missing. Second, a documented process exists, but you cannot show it has been implemented, reviewed or evaluated where that is required. A minor non-conformity needs a corrective action plan that reduces the risk before certification or verification can be recommended.
A major non-conformity arises where you cannot demonstrate appropriate processes, systems or structures to meet the outcome and indicators, or where the gap presents a high risk. The Guidelines add that three minor non-conformities within the same module may also constitute a major one. A rating of 0 precludes a recommendation for certification.
What happens next
- A corrective action plan. The auditor requires a corrective action plan within seven calendar days of written notification of the non-conformity.
- A major non-conformity. The Commission says you have 3 months to fix it, and your registration will not progress until you have addressed it and completed the quality audit. The auditor reviews your corrective actions, by desktop review or an onsite follow-up, within three calendar months of receiving your plan.
- A minor non-conformity. You have longer to fix it and can continue with registration. The Guidelines say a minor non-conformity must be closed within 18 months of notice at the mid-term or renewal audit, whichever comes first, or it is escalated to a major.
- Follow-up at the next audit. The outcomes where a non-conformity was raised will be audited again at your mid-term or renewal audit.
- More sampling. When an auditor finds a non-conformity within the minimum sample, the sample size increases by the number of non-conformities, to see whether it is a one-off or a system failure.
The Commission can also require a condition audit if you have minor non-conformities outstanding. Your auditor explains the classification, the corrective action expectations and the timeframes at the closing meeting.
Areas to check, by Practice Standards area
The examples below are ones we wrote to show how gaps arise and what closes them. They are not drawn from audit reports, and they are not a ranking. We do not claim any of them is the most common, because we have not found a source that says so. Each area links to a page that explains the document in more detail.
Rights and responsibilities
Gap pattern: A rights policy exists, but participants cannot say what their rights are. Evidence that closes it: information in accessible formats, consent records, and workers who can explain dignity, privacy and the Code of Conduct. See worker screening and the Code of Conduct.
Governance and operational management
Gap pattern: A conflict of interest policy with no register, or delegations that name people who left. Evidence: a current register, dated delegations and management meeting minutes. See our page on the conflict of interest policy.
Risk management
Gap pattern: A risk register nobody has reviewed, or participant risk assessments that do not match the support plan. Evidence: a dated review, treatments with owners, and assessments linked to plans. See the risk assessment template page and our risk management guide.
Quality management
Gap pattern: An improvement register with no closed actions, or no program of internal audits, which the Core Module expects. Evidence: a schedule, completed audits and closed improvement entries. See the continuous improvement register.
Information management and complaints
Gap pattern: A complaints procedure that does not tell participants how to complain outside your organisation, or consent that does not cover sharing information. Evidence: participant information that names external avenues and advocates, and consent records. See our complaints management guide.
Incident management
Gap pattern: A form that does not record when you became aware of an incident, so you cannot show a notification was on time. Evidence: a form with that field, a populated register and a trend review. See the incident report template page and the incident management guide.
Human resource management
Gap pattern: Screening clearances recorded but not checked for expiry, or no record that a worker completed the orientation module. Evidence: a worker register with expiry dates, certificates and induction records. See worker screening requirements.
Continuity of supports and emergency management
Gap pattern: An emergency and disaster plan that has never been tested or shared with workers. Evidence: a test record, consultation with participants and trained workers. See the emergency and disaster plan page.
Provision of supports
Gap pattern: Service agreements filed without evidence the participant received a signed copy, or support plans not reviewed. Evidence: copies given, reviews dated and participants involved. See the service agreement page.
Support environment and medication
Gap pattern: A medication policy that describes more than workers do, or records that cannot identify the participant and dose. Evidence: accurate records, safe storage and trained workers. See the medication management policy page.
Supplementary modules
Gap pattern: Where restrictive practices are used, authorisations or reporting records that do not line up. Evidence: authorisations, implementation records and reports. See our page on Module 2a.
How to respond to a finding
- Ask your auditor to show you the evidence behind the finding and the indicator it relates to.
- Find the root cause. Was the process missing, not followed, or not recorded?
- Write a corrective action plan with owners and dates, and send it within the required time.
- Fix the cause, not only the paperwork, and keep the evidence that you did.
- Tell your workers what changed, since interviews will test it.
- Check the fix at your next internal review, because the outcome will be audited again.
Preparing well reduces findings, but it cannot remove them all. Our audit interview guide and self-assessment guide help you prepare, and our document package covers the Core Module and Modules 1 to 5 without guaranteeing a clean audit.
This page is general information based on NDIS Commission and government sources at the date shown. It is not legal or professional advice, and the rules can change. Check the NDIS Commission's current requirements and read our disclaimer.