Written by the Provider360 team. Provider360 is Australia’s leading NDIS registration and compliance solution, supporting 3,000+ providers nationally. We are not an Approved Quality Auditor. We prepare providers for the audit and recommend the auditors who conduct it, so we see this from the provider’s side of the table.
Last updated: 15 September 2026
Key takeaways
- The Commission emails you an Initial Scope of Audit. It names your audit type, your registration groups and what the auditor will assess.
- A corrective action plan is due within 7 calendar days of written notification of a non-conformity.
- Your mid-term audit must start no later than 18 months after your registration period begins, not 18 months after your audit.
What is an NDIS audit, and who actually runs it?
An NDIS audit is an independent assessment of a provider against the relevant NDIS Practice Standards, and it is the step you clear before you can be registered. An Approved Quality Auditor is the body that carries it out: an auditing firm accredited by the Joint Accreditation Scheme for Australia and New Zealand, which regulates auditor behaviour. Approved Quality Auditors “are not part of the NDIS Commission”, and they are subject to Australian Consumer Law.
The Commission is direct about why the audit exists. Quality audits “play an important role in making NDIS services safer and more effective”: they hold providers to the same standards, give participants and families confidence, and reduce risk by identifying issues early and confirming when they are addressed. The purpose is to verify that participants are safe and receiving quality supports, not to catch you out.
What is the Initial Scope of Audit, and what does it set in motion?
The Initial Scope of Audit is the document that starts everything. You submit your registration application with a self-assessment against the Practice Standards that apply to you, and the Commission responds with one setting out the type of audit you need, your registration groups, your types of service delivery, the relevant Practice Standards, and the information you must share with your auditor.
It is also what an auditor quotes from, so the best time to request quotes is after your application is in, not before. Until it arrives, nobody can tell you what your audit will involve.
In our experience, this is the step to get right, because everything that follows runs from it. Your application sets your scope, and your scope should match the supports you deliver now or will deliver soon. Register for more and you pay to be audited on services you are not running. Register for less and you are back applying to change your registration later, sometimes while the audit is under way.
How do you choose and engage an Approved Quality Auditor?
You choose, and you pay. “You are responsible for engaging an independent auditor to complete the quality audit”, and you select from the list of Approved Quality Auditors the Commission publishes.
Send your Initial Scope of Audit to more than one of them and compare what comes back: the Commission “doesn’t set prices for audit services” and encourages providers to “get quotes from multiple approved quality auditors and compare them”. What an audit costs depends on the size and scale of your organisation and the number of participants you support. We cover the full cost picture in a separate article.
What happens during an NDIS audit?
The audit runs to a rulebook. Auditors work to the National Disability Insurance Scheme (Approved Quality Auditors Scheme) Guidelines 2018, and what they measure you against is the NDIS Practice Standards, built as a core module for high-risk supports, supplementary modules by support type, and a verification module for low-risk, low-complexity supports. Which modules land in your audit follows your scope, and our module map sets them out.
A verification audit is one thing: a desktop review of the required documentary evidence. A certification audit is two stages, and here is what each looks like from your side of the table.
Stage 1: what happens in the desktop review?
Stage 1 is off site. The auditor reviews the self-assessment responses and documents you submitted with your application, your previous audit outcome and corrective actions if you have any, and anything additional the Commission has raised. Nobody visits.
You get the Stage 1 findings in writing before Stage 2 begins, and how far in advance tells you something. If a non-conformity has been found, or the audit team suspects one is likely, the findings must reach you at least two weeks before Stage 2 starts; if none was found or suspected, at least one week. They also name the registration groups, key personnel and participants that will be part of the audit. Stage 2 should then start within three months of Stage 1 finishing.
Stage 2: what happens on the day of an on-site audit?
In our experience this is the part of the whole cycle providers fear most, and it does not have to be. We take 15 to 20 enquiries a day on average, and more than 80% of them come from providers with the audit already in front of them, for a reason that is nearly always the same: nobody has shown them how to prepare. What the day tests is what every paragraph below comes back to. You are doing the work the way your documents say you do, and you can show it.
In July 2026 the Commission published its own account of an audit day. It is the nearest thing to a rehearsal.
The day “usually starts with a short opening meeting”, where the auditor introduces themselves, explains that they are assessing how your organisation meets the Practice Standards, and outlines what they plan to review: leadership, risk systems, incident management, staff files, participant records and interviews. Then, in the Commission’s words, “very quickly, the focus moves from what your policies say to what actually happens in practice”.
The questions are ones you should be able to answer any working day. “How do you know participants are safe?” “Can you show me how incidents are managed from start to finish?” “How does leadership monitor risk and quality?” The auditor wants real examples: incident reports, complaints records, training logs, supervision notes. As the Commission puts it, “they are looking for evidence that your systems are working, not just that they exist”.
The auditor samples your staff files, checking worker screening clearances, qualifications, induction records and evidence of ongoing training and supervision. When the auditor observes supports being delivered they “quietly watch how supports are provided”, looking at how staff communicate, whether consent is sought, and whether the supports match the participant’s plan.
The day ends with a closing meeting, where the auditor summarises your strengths and explains any gaps identified. One requirement of the Guidelines is easy to miss: the audit team leader must ensure you receive a written copy of the audit findings at that meeting. You do not leave the room waiting to hear.
What does the auditor ask your participants, and can a participant decline?
Participant interviews are a core part of a certification audit. The auditor speaks privately with a sample of your participants and asks simple questions: “Do you feel safe?”, “Do staff listen to you?”, “Do you know how to make a complaint?” A participant can have a carer, family member, support person or advocate with them for that conversation.
Two rules operate together here, and they are easy to mix up. Sampling is opt-out: you must let all participants know they are automatically included in the audit process, and if a participant does not want to take part, you must respect that decision, document it, and communicate it to your auditor. Separately, before the inspection and interviews begin, the auditor must ensure you have obtained prior informed consent from each participant selected to be part of the audit. Opt-out decides who is in the pool; informed consent decides who is interviewed.
Which NDIS audit applies to you, and who decides that?
You do not pick your audit type. “The Initial scope of audit provided by the NDIS Commission tells you the type of audit you need”, and the type follows from the supports you have applied to deliver.
If you deliver only low-risk, low-complexity supports, you are on the verification pathway. One desktop review of the required documentary evidence, and no site visit.
If you deliver one or more high-risk or complex supports, you are on the certification pathway. Stage 1 off site, then Stage 2 on site. How the two pathways differ is its own comparison.
If you are not yet delivering services, you are assessed on readiness instead. That is a provisional audit: there are no participant interviews, and both stages usually run in the same week. The Guidelines provide for provisional audits and exempt them from the minimum sampling requirements.
If you operate remotely or from virtual sites, Stage 2 may run remotely. Stage 2 is conducted on site. It runs remotely only if that is proportionate, your auditor is accredited to IAF MD4, and at least one of these is true of you: you operate in remote or regional areas as defined by the Accessibility/Remoteness Index of Australia, you operate from virtual sites, or you provide classes of support involving limited interaction with participants.
If you are not registered yet and none of this is settled, start with your scope. The free NDIS Registration Roadmap tells you which pathway your services fall under and which Practice Standards you will be assessed against.
What happens if the auditor raises a non-conformity?
Start with the Commission’s own words: “if a non-conformity is raised, it does not mean you’ve failed. It means something needs to be corrected or strengthened. You are given a timeframe to address any issues.”
Every Practice Standard and quality indicator in your audit is rated. A 3 is conformity with elements of best practice, a 2 is conformity, a 1 is a minor non-conformity, and a 0 is a major non-conformity.
Whichever it is, your corrective action plan is due within 7 calendar days of written notification of the non-conformity. That is the tightest clock on this page.
If it is a minor non-conformity, you have longer to fix it, and registration continues. Your auditor can still recommend certification when minor non-conformities have been identified, provided you have shown them an acceptable corrective plan first. Minor non-conformities must be closed out by your mid-term or recertification audit, whichever comes first, or they escalate to major.
If it is a major non-conformity, registration stops until it is fixed. A rating of 0 rules out certification, and your registration “won’t progress until you have addressed the major non-conformity and successfully completed the quality audit”. It must be downgraded or closed within 3 calendar months of the initial written notification.
What if you used a consultant, an advice service or purchased policies?
The Commission has published what it expects when you use outside help, and it is worth reading before you lodge. You are responsible for the content of your application, you should have been substantially involved in preparing it, and you must understand what you submitted and be able to explain it if asked. Your responses must be specific to your organisation rather than a direct copy of purchased documents, and the policies you provide must accurately reflect how your organisation will deliver supports.
The Commission’s concern is copied content: the same or very similar information appearing across multiple providers, it says, may subvert the quality audit process and raises the risk that an application contains false or misleading information. The result may be refusal, or a condition requiring a new certification audit, both stages, with a new self-assessment. False or misleading information in a registration application carries a civil penalty under the NDIS Act and is also a criminal offence.
Treat anything you bought or had written for you as a first draft. Read it end to end, then edit it until it describes how your organisation actually runs: the supports you deliver, who delivers them and how. If a document sets out a practice you do not follow, change the document or change the practice before you lodge. Whoever drafted it, the version you submit has to be yours, and you have to be able to talk an auditor through it.
How often does an NDIS audit happen after you pass?
An NDIS audit is a cycle, not a one-off, and the clock does not start where you might assume. The date of your certification or verification decision is not your registration approval date, and the audit timeframes all run from the registration approval date.
| Audit event | When it happens | What is assessed | Report to the Commission |
|---|---|---|---|
| Verification audit | Once, before registration, for low-risk, low-complexity supports | A desktop review of the required documentary evidence | Within 14 calendar days |
| Certification, Stage 1 | Off site, before Stage 2 | Your self-assessment responses and submitted documents, plus any previous outcome and corrective actions | Findings to you 1 to 2 weeks before Stage 2 |
| Certification, Stage 2 | Within 3 months of Stage 1 completing | Whether your systems are implemented: records, site visits, observation and interviews | Within 28 calendar days |
| Mid-term audit | No later than 18 months after your registration period starts; prepare from 12 months | Provider governance and operational management, plus any standard that previously required a corrective action plan | Within 28 calendar days |
| Re-registration | Before your registration period ends; providers are “generally registered for three years” | Recertification reviews your previous mid-term reports and your management system’s performance | Within 28 calendar days |
Mid-term audits do not apply to a provider registered only for specialist disability accommodation, to a transitioned provider, or to an individual or partnership that only needed certification for early childhood early intervention supports.
Two audit types sit outside the cycle. The Commission can require a condition audit during your registration period, for example after a provisional certification audit or where minor non-conformities are still outstanding. An out-of-cycle audit is one you organise yourself, to support an application to change your registration.
Who decides your registration, the auditor or the NDIS Commission?
The Commission does, and the Guidelines could not be blunter: “an approved quality auditor shall not issue a NDIS provider certification or verification decision to the NDIS provider”. The auditor issues its decision and recommendation to the Commission instead, with the audit report, “for consideration in making the registration determination”.
Before any of that, you get to read it. The audit report is proof read, independently reviewed, endorsed by the audit team leader and provided to you for comment before it is submitted, and any disagreement between you and your auditor must be documented. Then it goes to the Commission: within 14 calendar days of a verification audit, within 28 of a certification or mid-term audit.
From there the Commission weighs the auditor’s recommendation alongside its own assessment of your suitability, including your key personnel, and contacts you with the outcome. If it is heading towards refusing your application, you are invited to provide information first. The Commission publishes no end-to-end duration for this, and we cover how long registration takes separately.
The gaps are there before the auditor is. Our own pre-audit evidence review catches an average of 16 gaps before the auditor sees them. The Commission’s own audit account sets the bar: auditors are looking for evidence that your systems are working, not just that they exist.
Close the evidence gaps before the auditor finds them
We are not an Approved Quality Auditor, so we never conduct or quote your audit. What we build is the evidence your audit tests: branded policies and procedures, your self-assessment answers, your application submitted for you, recommendations of 3+ Approved Quality Auditors, and a pre-audit evidence review, backed by our money-back guarantee.
Find your Platinum Registration Package →Common questions about the NDIS audit
What is the next step after I get my Initial Scope of Audit?
Use it to get quotes. The Initial Scope of Audit tells an Approved Quality Auditor exactly what your audit covers, which is what they need to quote accurately, so the best time to ask is once your application is in and the scope has arrived. Provider360 is not an Approved Quality Auditor and cannot quote or conduct the formal audit. We recommend trusted Approved Quality Auditors at no extra cost, typically three or more, and you gather the competitive quotes directly.
Does an NDIS audit happen once, or on a cycle?
On a cycle. A certification audit runs Stage 1 and then Stage 2 before your registration is decided; a mid-term audit must begin no later than 18 months after your registration period starts; and a recertification audit follows before your registration period ends. Mid-term audits apply to providers who completed a certification audit, not to providers on the verification pathway.
What happens if I have no participants at the time of my audit?
You are assessed on readiness instead of delivery. That is what a provisional audit is for: the auditor looks at whether your documentation is complete and ready to use, whether your staff HR files are up to date, and whether you know your own policies. There are no participant interviews, and both stages are usually conducted in the same week.
What does an auditor expect to find in a participant file?
Evidence that the support happened the way your policies say it does. A participant file should hold a signed service agreement, a risk assessment, a support plan, progress notes, an intake assessment, signed consent forms and any incident reports, and every document should be dated, signed and current at the time of the audit.
The auditor is not counting documents. They are tracing one participant’s experience from end to end and checking that what is on the file matches what happens in practice.
