From the Rostery team in Sydney. This is a rewritten, expanded version of our blog post, the NDIS audit evidence checklist: what auditors actually ask for.
An audit finding often isn't about a missing policy. It's about a missing record, the one that shows the policy being followed. The auditor reads your incident procedure, then asks to see three incidents from last quarter and what happened after each one. If those records are thin, the policy doesn't help much.
This guide is a working checklist. It's grouped by the areas auditors spend the most time on, so you can hand each section to the person who owns it. It also covers how the two audit stages differ, how ratings work, and how long you get to fix a gap.
General information only. Your auditor and the NDIS Quality and Safeguards Commission have the final say for your registration.
The audit at a glance
Here are the basics, checked against the NDIS Commission's quality audit page and the NDIS (Approved Quality Auditors Scheme) Guidelines 2018 on legislation.gov.au:
- Who needs a certification audit: providers delivering higher risk or more complex supports. Lower risk supports usually go through a verification audit instead. Your initial scope of audit from the Commission tells you which one applies.
- Who does it: an approved quality auditor that you choose and pay. The Commission doesn't set audit prices, and it suggests getting quotes from more than one auditor.
- Who decides: the auditor sends a report with a rating against each Practice Standard and quality indicator. The Commission makes the registration decision.
- Two stages: Stage 1 is a desktop review of your documents. Stage 2 is onsite and should start within three months of Stage 1 finishing.
- After registration: a mid-term audit must start no later than 18 months into your registration, and recertification happens in the third year of the cycle.
Not sure which audit type you're facing? Our guide to NDIS verification vs certification audits explains the difference.
Stage 1 and Stage 2 test different things
Stage 1 asks: do you have the system? The auditor reviews your self-assessment and the documents you supply. Policies, procedures, registers and templates are all in play. Stage 1 is usually off-site, though it can be done on-site for certification if you agree in writing.
Stage 2 asks: does the system work? The auditor looks at records, visits sites, interviews workers and participants, and watches supports being delivered. The Commission says the focus moves quickly from what your policies say to what happens in practice.
Two details in the guidelines are worth knowing:
- You get your Stage 1 findings before Stage 2. If the auditor found or suspects a non-conformity, they must send the findings at least two weeks before Stage 2 starts. If not, at least one week before. Use that gap to fix what they flagged.
- Stage 2 can be delayed. If the audit team thinks you're not ready for Stage 2, they tell you and the Commission that it's likely to be pushed back while you fix things.
Participants are part of Stage 2. The Commission says you need to let participants know they're automatically included in the audit unless they opt out. Build that step into your timeline early.
The evidence checklist, area by area
1. Governance and operational management
This is the area the mid-term audit focuses on, so it matters for the whole three-year cycle, not just your first audit.
- [ ] Organisational chart that matches who actually makes decisions
- [ ] Position descriptions for key personnel
- [ ] Every policy shows a version number, an approval date and a review history
- [ ] Risk management framework, plus a risk register with dated reviews
- [ ] Continuous improvement register with recent entries: the issue, the action and the result
- [ ] Conflict of interest policy and signed declarations
- [ ] Financial records that show the business is viable and participant funds are used properly
- [ ] Current certificates of currency for your insurance
Where providers slip: review dates. If a policy says it's reviewed every year and the last review was in 2023, the date itself is evidence that your governance process isn't running.
2. Workers and screening
Auditors sample staff files. The Commission lists what they check: screening clearances, qualifications, induction records, and evidence of ongoing training and supervision.
- [ ] NDIS Worker Screening Check clearance for each worker in a risk-assessed role, with the date you verified it
- [ ] Proof the clearance was verified before the worker started delivering supports
- [ ] Qualifications and any required certifications
- [ ] Induction and onboarding records
- [ ] A training log that includes the Commission's worker orientation module and role-specific training
- [ ] Supervision and performance review notes
- [ ] Reference and work history checks
Where providers slip: order of events. The clearance exists, but nobody can show it was checked before the first shift. Our guide to the NDIS Worker Screening Check in every state covers how the check works where you operate.
3. Participant files and service delivery
At Stage 2 the auditor pulls a sample of participant files and compares them with your documented process and with what workers tell them.
- [ ] A signed, dated service agreement that matches the supports being delivered now
- [ ] A support plan showing the participant was involved, with review dates
- [ ] Consent records, including consent to share information
- [ ] Progress notes written at the time, sticking to facts, with dates
- [ ] A clear line from day-to-day supports back to the participant's NDIS plan goals
- [ ] Risk assessments specific to that person
Where providers slip: a file that says one thing while the worker on shift says another. If the plan describes a morning routine and the rostered worker can't explain it, the auditor notices. Keeping rosters, shift notes and participant records in one place makes that link much easier to show.
4. Incident management
Incident management is a common source of findings. The Commission's own description of Stage 2 includes the question, "Can you show me how incidents are managed from start to finish?"
- [ ] Incident management policy and procedure, naming who notifies the Commission
- [ ] An incident register with dates, categories and severity
- [ ] An investigation and an outcome recorded against each incident
- [ ] Reportable incidents notified to the Commission on time
- [ ] Corrective and preventive actions, and what changed as a result
On timing, the Commission's reportable incidents page says most reportable incidents, such as death, serious injury, abuse or neglect, must be notified within 24 hours of the provider becoming aware, followed by a 5-day report. An unauthorised restrictive practice that hasn't caused harm is due within 5 business days. From 12 October 2026, new incidents are lodged in the new NDIS Commission Portal.
Where providers slip: a register that records incidents but shows no investigation or close-out. That looks like storage, not management.
5. Complaints, feedback and rights
- [ ] Complaints and feedback policy, available in accessible formats
- [ ] A complaints log showing what was raised, what you did, how it was resolved and how long it took
- [ ] Evidence participants know they can complain to you and to the NDIS Commission
- [ ] Records showing complaints feed into your continuous improvement register
The Commission says auditors may ask participants privately whether they know how to make a complaint. Your paperwork and their answer should line up.
6. Medication and other higher-risk supports
If you support people with medication, or deliver high intensity daily personal activities, expect the auditor to check worker competency for those tasks as well as the records themselves. Medication charts, administration records and competency sign-offs should all carry dates and names.
How ratings and non-conformities work
The auditor rates each standard and quality indicator from 3 to 0:
- 3: conforms, with elements of best practice
- 2: conforms with the Practice Standards
- 1: minor non-conformity
- 0: major non-conformity
Annex B of the guidelines describes a minor non-conformity in a way that's worth reading twice. It's usually one of two things: the process is happening but the supporting documentation is missing, or the process is written down but you can't show it's been put in place, reviewed or evaluated. Both are record problems.
A major non-conformity means you can't show the processes or systems needed to meet the outcome, or the gap carries a high risk. Three minor non-conformities in the same module can also add up to a major.
Timeframes from Annex C (current compilation on legislation.gov.au):
- Corrective action plan: due within seven calendar days of written notice of the non-conformity.
- Major: must be downgraded or closed within three calendar months. At a mid-term or recertification audit, missing that deadline means automatic suspension of the certification decision.
- Minor: must be closed out within 18 calendar months, at the mid-term or recertification audit, whichever comes first. If not, it's escalated to a major.
A major rating blocks certification until it's dealt with. The Commission says your registration won't progress until the major is addressed and the audit is completed.
Gaps worth hunting for first
Each of these maps back to an item in the checklist above:
- Policies with no review date, or a review date long past
- Training records that can't show who is trained for what support, on what date
- Workers rostered for a support their training file doesn't cover
- Service agreements that were never updated when supports changed
- Incident entries with no outcome recorded
- A continuous improvement register that stopped being updated months ago
A one-hour self-check before you book Stage 1
Set a timer and work through this with whoever owns compliance:
- Open your ten most-used policies and note any with an overdue review date.
- Pick three workers at random. Can you show their screening verification date, their induction and their latest training?
- Compare next week's roster with your training records. Is anyone rostered for something they aren't trained to do?
- Pick three participant files. Is the service agreement signed and current, and has the support plan been reviewed?
- Open your incident register and filter for anything without an outcome.
- Check the date of the newest entry in your continuous improvement register.
Anything that fails goes on a list with an owner and a date. That list is the start of your own improvement record, which is also evidence.
Keep reading
- The original post on our blog: NDIS audit evidence checklist: what auditors actually ask for
- Related guides: NDIS verification vs certification audits and the NDIS Worker Screening Check by state
- Elsewhere from us: building a SIL roster of care in 2026 on our Blogger site, and how NDIS providers can reduce no-shows and claim correctly on Medium
- Our free NDIS and aged-care tools, including the NDIS price guide search and shift price calculator
Rostery is NDIS and aged-care rostering software made in Sydney. It keeps shifts, notes and participant records together so they're easier to trace at audit time.
The Rostery team
Top comments (0)