Free NDIS audit checklist · Updated October 2026Your NDIS Audit Readiness Checklist
Preparing for an NDIS audit requires more than simply having policies and procedures in place. NDIS providers need to demonstrate that their systems are actually implemented across the business, workers understand their responsibilities, participant records are maintained correctly, and evidence is available to demonstrate ongoing compliance.
This NDIS Audit Checklist will help registered NDIS providers prepare for an upcoming certification, verification, mid-term or renewal audit.
Applying for registration for the first time? Since 12 October 2026, new applications use the new NDIS Commission Portal. Read our step-by-step guide to the new NDIS provider application process, covering Employer ID, worker screening, Part 1 and Part 2, before you prepare for your audit.
Check your audit scope first: this checklist is general. What your auditor assesses depends on your registration groups, any modules and your audit type. As a general rule, a verification audit is for low risk, low complexity supports, a certification audit is for higher risk supports, and a mid-term audit is 18 months into registration for providers that completed a certification audit. Your Initial Scope of Audit from the NDIS Commission is the source of truth. Items below such as medication, restrictive practices, mealtime management or professional registration only apply where they are relevant to your supports and scope. See the Commission's quality audit process and types of audits.
What Does an NDIS Auditor Check?
An Approved Quality Auditor will assess your organisation against the requirements applicable to your registration, including relevant NDIS Practice Standards.
The audit is not only about reviewing documents. Depending on your audit scope, auditors may review:
- Policies and procedures
- Participant files and service agreements
- Worker files
- Training and competency records
- Incident and complaint records
- Risk assessments
- Governance and operational records
- Internal audit results
- Management review records
- Corrective actions
- Evidence that policies and procedures are actually being followed
NDIS Audit Checklist
Not every audit needs the same evidence. A verification audit is a lighter, desktop assessment proportionate to your size and services; a certification audit covers the Core Module and any supplementary modules. See how preparation differs by audit type. These 10 areas apply to most providers. If you deliver specialist supports, such as medication management, mealtime management, high-intensity daily personal activities, behaviour support and restrictive practices, or SIL, extra module requirements apply.
1Policies and Procedures
Make sure your policies and procedures are current, relevant to your organisation and consistent with the services you actually provide.
Check that:
- Policies have been reviewed and approved
- Document versions and review dates are controlled
- Policies reflect your current registration groups and services
- Workers have access to relevant policies
- Legislative and regulatory references are current
- Changes to your organisation are reflected in your documentation
- Insurance certificates are current, with cover that matches the services you deliver
Tip: Having a policy is not enough. You should also be able to demonstrate how the policy is implemented.
2Participant Files
Participant records are an important part of many NDIS audits.
Depending on the services you provide, check that participant files contain appropriate evidence such as:
- Service agreements
- Participant consent
- Participant information
- Support plans
- Risk assessments
- Emergency and disaster information
- Progress notes
- Incident records where applicable
- Complaint records where applicable
- Reviews of participant needs and supports
- Evidence of participant choice and control
Information should be current, complete and consistent across the participant's records.
3Worker Files
Review your worker and contractor files before the audit.
Check for:
- Employment or contractor documentation
- Position descriptions
- Qualifications
- Relevant experience
- NDIS Worker Screening Check for workers in risk-assessed roles
- Working with Children Check where applicable
- Police checks where applicable
- Induction records
- Training records
- Competency assessments where required
- Performance reviews
- Professional registrations where applicable
Also check expiry dates for licences, registrations and screening requirements.
Worker screening records registered providers must keep:
- A written record of your risk-assessed roles: role title, the paragraph of the risk-assessed role definition in the Worker Screening Rules, a description, the date it was assessed and the name and title of the person who assessed it
- Updates to that record within 20 business days of identifying a new risk-assessed role or reclassifying a role
- A written record of each worker in a risk-assessed role: full name, date of birth, address, their role(s), and their screening application number, clearance number and expiry date
- Records of any interim bar, suspension or exclusion, misconduct allegations and the action you took
- Records for any worker working while their screening application is pending, showing how the exception applies, including supervision arrangements
- Worker records kept for 7 years, in a format that still exists after a worker is unlinked in the portal
Source: NDIS Commission, Worker screening for registered providers. Since 12 October 2026, worker screening tasks are done in the new NDIS Commission Portal.
4Worker Training
Auditors may look for evidence that workers understand their responsibilities rather than simply checking whether a training document exists.
Consider whether relevant workers have completed training relating to:
- NDIS Worker Orientation Module (keep each worker's completion certificate)
- NDIS Code of Conduct
- Incident management
- Complaints management
- Participant rights
- Privacy and confidentiality
- Work health and safety
- Emergency and disaster management
- Infection prevention and control
- Risk management
- Mandatory reporting requirements where applicable
- Service-specific competencies
Maintain a training register so that completed and outstanding training can be easily identified.
5Incident Management
Check that your incident management system is operating effectively.
Your organisation should be able to demonstrate:
- How incidents are identified
- How incidents are recorded
- How incidents are investigated
- Who is responsible for reviewing incidents
- How corrective actions are managed
- How reportable incidents are identified and escalated
- How lessons from incidents are used to improve services
If you have had no incidents, you should still have a functioning incident management process.
Reportable incident timeframes: notify the NDIS Commission within 24 hours of becoming aware of a death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, or sexual misconduct involving a person with disability. Unauthorised use of a restrictive practice must be notified within 5 business days, or within 24 hours if it caused harm. Since 12 October 2026, new reportable incidents (24-hour and 5-day reports) are lodged in the new NDIS Commission Portal. Check the Commission's reportable incidents page for current rules.
6Complaints Management
Your complaints system should be accessible to participants and other relevant people.
Before your audit, check:
- Complaint forms are available
- Participants know how to make a complaint
- Complaints are recorded appropriately
- Complaint outcomes are documented
- Corrective actions are followed up
- Complaint trends are reviewed
A complaints register should be maintained even when complaint numbers are low.
7Risk Management
Review your organisational and participant-level risks.
Evidence may include:
- Organisational risk register
- Participant risk assessments
- WHS risk assessments
- Emergency risks
- Service delivery risks
- Financial and operational risks
- Controls for identified risks
- Regular risk reviews
Risks should not simply be identified—they should have appropriate controls, responsibilities and review processes.
8Emergency and Disaster Management
NDIS providers should ensure continuity of critical supports during emergencies and disasters.
Review:
- Emergency and disaster management plans
- Participant-specific emergency considerations
- Business continuity arrangements
- Emergency contact details
- Staff responsibilities
- Communication arrangements
- Testing and review of emergency plans
Your plans should reflect how your organisation would continue supporting participants during a real disruption.
9Internal Audit
An NDIS internal audit is one of the best ways to identify compliance gaps before the external auditor does.
Your internal audit should assess whether your systems meet applicable requirements and whether those systems have been effectively implemented.
Check that you have:
- An internal audit schedule
- Internal audit records
- Findings and observations
- Corrective action records
- Evidence that identified issues have been closed
Do not wait until immediately before the external audit to identify major gaps.
Found gaps? Our consultants can do an independent check of your documents and records against the Practice Standards. Book an NDIS internal audit →
10Management Review
Management should periodically review the effectiveness of the organisation's systems.
Topics may include:
- Internal audit results
- Incidents
- Complaints
- Participant feedback
- Worker feedback
- Risk management
- Training
- Compliance obligations
- Corrective actions
- Business performance
- Opportunities for improvement
Keep minutes and evidence of decisions and actions resulting from management reviews.
How NDIS Audit Preparation Differs by Audit Type
Your Initial Scope of Audit tells you which audit you need. The evidence you prepare, and how the auditor checks it, depends on that audit type.
VNDIS Verification Audit
For providers who only deliver lower risk or lower complexity supports. The approved quality auditor does a desktop review of the required documents.
Focus on:
- Qualifications, professional registration (for example AHPRA) and professional association evidence
- The documents listed in the Commission's required documentation guide for verification
- Current worker screening and key personnel details
- Incident management, complaints and risk management documents
CNDIS Certification Audit
For providers who deliver one or more higher risk or more complex supports. It has two stages: Stage 1 is a desktop audit, usually off-site, and Stage 2 is an onsite audit, which should happen within 3 months of Stage 1.
Focus on:
- NDIS audit evidence that policies and procedures are used in practice, not only written
- Participant and worker records the auditor can review onsite
- Staff ready for interviews about their role, incidents, complaints and risks
- Telling participants about the audit. They are automatically enrolled unless they opt out of interviews
- Sites ready for visits and observations
- Evidence for every module in your scope
MMid-term Audit
For providers who completed a certification audit and deliver higher risk or more complex supports (some exceptions apply). It covers the Practice Standards for provider governance and operational management, any standard that needed a corrective action plan, and any extra standards the Commission requires.
Focus on:
- Engaging an approved quality auditor around 12 months after your registration date
- Governance and operational management evidence
- Closing out earlier corrective actions
- Letting staff and participants know the auditors will visit
- Making sure the final report reaches the Commission by 18 months after registration
Source: NDIS Commission, The quality audit process. An NDIS internal audit can be scoped to match your audit type.
Common NDIS Audit Problems
Some common issues providers should look for before an audit include:
- Policies that have not been reviewed
- Missing signatures or dates
- Incomplete participant files
- Expired worker screening checks
- Missing worker induction evidence
- Training records that are incomplete
- Risk assessments that have not been reviewed
- Incident or complaint registers not being maintained
- Internal audits not completed
- Corrective actions remaining open
- Policies that do not match actual business practices
Finding these issues before your external audit gives you an opportunity to correct them.
How Early Should You Prepare for an NDIS Audit?
Audit preparation should ideally be an ongoing process rather than something completed in the final few days before an audit.
Before the audit date, providers should allow enough time to:
- Review documentation
- Check participant and worker files
- Complete an internal audit
- Identify gaps
- Implement corrective actions
- Verify that corrective actions are effective
- Prepare staff for auditor interviews
Don't Just Prepare Documents — Prepare Your Team
One of the most overlooked parts of NDIS audit preparation is staff readiness. Workers should understand the policies and procedures relevant to their role and be able to explain how they apply them in practice. For example, workers should understand what they would do if:
- A participant makes a complaint
- An incident occurs
- They identify a new participant risk
- A participant requests access to their information
- There is an emergency affecting service delivery
The goal is not to memorise policies. Workers should understand the processes they are expected to follow.
Final NDIS Audit Readiness Check
Before your audit, ask yourself:
Can we demonstrate that our policies and procedures are actually implemented?
If the answer is yes—and you have evidence across your business, worker and participant records—you will be in a much stronger position for your audit.
Need Help Preparing for Your NDIS Audit?
ISO Professionals assists NDIS providers across Australia with NDIS internal audits, gap assessments, audit preparation, policies and procedures, registration and renewal support.
Our consultants can review your systems before your external audit, identify potential gaps and help you prepare the evidence required for your audit.
Prepare Before the Auditor Finds the Gaps
If your NDIS audit is approaching, contact ISO Professionals to arrange an NDIS Internal Audit or Gap Assessment and make sure your organisation is audit-ready.
