The NDIS Audit Checklist: What to Have Ready by Pathway, and How to Show It Is in Use

Written by the Provider360 team. Provider360 is Australia’s leading NDIS registration and compliance solution, supporting 3,000+ providers nationally. Our pre-audit evidence reviews mean we read providers’ audit evidence before the auditor does.

Last updated: 6 November 2026

What is an NDIS audit checklist, and when do you need one?

An NDIS audit checklist is a list of the evidence an auditor will ask to see, set against the Practice Standards that apply to you. You need it from the moment you submit your application, when the NDIS Commission sends your Initial Scope of Audit. It sets out the type of audit you need, your registration groups, the relevant Practice Standards and “the information you need to share with your auditor”. You need it again when you re-register, and for the mid-term audit that follows a certification audit, 18 months into the registration period.

More than 80% of the enquiries we receive come from providers whose audit is already booked or notified, and in our experience the reason is that they don’t know how to prepare well. So this checklist starts from what the auditor samples, not from a list of documents to download.

The audit draws its evidence from documents, interviews and observation, which the Commission’s guidance for auditors calls the backbone of the assessment. For what happens on the day, see our guide to the NDIS audit process. Gaps cost time. If the audit team decides you are unlikely to be ready for the second stage of a certification audit, it tells you and the Commission that the stage is likely to be delayed while you fix them.

How does the auditor decide what to sample?

The auditor works to the sampling rules in the NDIS auditor guidelines, and those rules make the audit a sample rather than a check of everything you hold. Sampling applies to the documents reviewed, the people interviewed and the practice observed, and what participants say about their supports is part of how the auditor weighs the evidence. When you prepare, work from these rules:

• You don’t choose the sample. Auditors must not let you pre-select the workers, participants or participant files they review. Participant files are drawn at random in every audit, alongside a structured sample.
• High-risk supports come first. Sampling gives priority to the groups the guidelines call “highest risk”, such as high intensity daily personal activities and specialist behaviour support, and the sample must include participants from each one you deliver.
• A finding makes the sample bigger. When the auditor finds a non-conformity in the minimum sample, the sample grows by the number of non-conformities, to test whether the problem is a system failure or a one-off.

The written report follows the same trail. The Commission’s principles for audit reports ask for policies traceable by version number and date, and for evidence “triangulated with the knowledge and practice of their workers and the experience of participants”. Each standard is then rated on a scale from 0 (major non-conformity) to 3 (conformity with elements of best practice).

How many participant files and interviews will the auditor check?

On a certification or recertification audit, the minimum is the square root of the participants in scope, rounded up. Count the participants you support at the time, then take out those who receive only the supports the guidelines exempt from minimum sampling; if 5 or fewer are left, the minimum is all of them.

On a certification audit under the NDIS auditor guidelines, 32 participants in scope means at least 6 participant files and 6 participant interviews. That is the guidelines’ own example: a provider with 40 participants, 8 of whom receive only an exempt support, has 32 in scope, and the square root of 32 rounds up to 6. A mid-term audit uses a smaller sample, the square root multiplied by 0.6 and rounded up.

Which of your workers can be interviewed?

Any of them. There is no fixed number of worker files or interviews. The auditor samples what they need to judge whether you meet the standards, and the sample must include workers in governance, management and service delivery roles, and from every shift if you run shifts. Workers are chosen for interview as randomly as possible.

Interviews are held one to one, not only in groups, and must include workers who provide supports directly, not only the board and managers. Auditors use them to check how your processes are carried out and whether they work. Your staff should be able to explain everyday procedures such as incident management and complaints handling.

Which NDIS audit checklist applies to you: verification or certification?

Your Initial Scope of Audit names the audit type, so check it before anything else. Our guide to verification and certification audits explains which pathway your supports fall under.

If you’re on verification, your checklist is documents. The auditor runs a desktop review of the required documentary evidence against four verification standards: human resource management, incident management, complaints management and risk management. Use the verification column of the checklist table.

If you’re on certification and already delivering supports, you need the documents and proof that you use them. Stage 1 is a desktop audit of your information and evidence. Stage 2, which should take place within 3 months of Stage 1, looks at how you implement your policies through records, site visits, interviews with staff and participants, and observation. Work from the certification column of the checklist table and the column on how the auditor tests each area.

If you’re on certification but not delivering yet, prepare for a provisional audit. It checks that your systems and processes are in place, with no witnessing or interviews and no minimum sampling, because there are no services to sample yet. A further Stage 2 audit may be required once you start delivering.

If you’re renewing, work through the same checklist. Re-registration follows the same steps as your first application, including evidence, and you can start it any time in the 6 months before your registration expires. Our guide to the NDIS audit process sets out the full audit cycle.

If you haven’t applied yet, build the evidence before you lodge. The Commission suggests reviewing your policies and procedures against the Practice Standards and making an action plan for any gaps. Our Platinum registration packages include a pre-audit evidence review before the auditor sees your evidence.

What should be on your NDIS audit checklist?

The checklist table sets ten evidence areas side by side for both pathways, drawn from the quality indicators for the Core Module, the verification module and the supplementary modules. It doubles as your NDIS compliance checklist for the audit itself. For the obligations that run all year after registration, see NDIS compliance after registration. On verification, the documents themselves are the evidence, while on certification Stage 2 checks the column on how the auditor tests each area.

If a worker is still waiting on a screening clearance, some states and territories let them start in a risk-assessed role after applying, known as “working on application”. Where it is allowed, you need a written risk management plan, the worker must always be supervised by someone with a clearance, and you record them as a worker without one.

What training records do you need for an NDIS audit?

You need proof that every worker completed the mandatory NDIS worker orientation module, and records of the training they have done since, including infection prevention and control training with refreshers. The orientation module is “Quality, safety and you”, and staff of registered NDIS providers have to complete it. If you’re on verification, add records of continuing professional development.

On certification, the indicator asks for a system to identify, plan, facilitate, record and evaluate the effectiveness of training. That system has to name which training is mandatory, including training on staff obligations under the Practice Standards. Every worker must also be aware of, trained in and following your incident and complaints procedures.

Keep training logs and signed policy acknowledgements as evidence, and expect the auditor to ask workers to explain the procedures they were trained in.

How do you show a policy is in use, not just on file?

Show the trail from the policy to the record to a person who can explain it. The auditor guidelines describe the usual minor non-conformity in two forms: a process in place without the required supporting documentation, or a documented process you cannot show is implemented, reviewed or evaluated where that is required. Either one needs a corrective action plan before certification or verification can be recommended.

For each policy, have three things ready: the current version with its date, the records it produces (completed registers, incident reports, complaint files, supervision notes), and a worker who can walk the auditor through it.

If you bought your policies, the Commission expects them to “accurately reflect how your organisation will deliver NDIS supports”. We cover the rest of that guidance in our guide to the NDIS audit process.

How do you run an NDIS internal audit before the auditor arrives?

Run it the way the auditor will sample you. This is our method, built from the sampling rules in the auditor guidelines; it is not an official Commission procedure. For certification providers, an internal audit is also part of what you are audited on, because your quality management system needs “a documented program of internal audits” sized to your service.

1. Draw your sample at random. Work out your minimum participant sample with the square-root rule, then pick the files without looking at them first.
2. Pull staff files from every level and shift. Include governance, management and direct-support workers, and check each file for screening clearances, qualifications, induction records, and training and supervision records.
3. Trace one incident end to end. Follow it from the first report through internal review and actions taken to any notification, and check the records against your policy, as the auditors did in the Commission’s certification case study. Then do the same with one complaint.
4. Ask a direct-support worker to explain a procedure. For example, ask how they would report an incident or handle a complaint. On certification, every worker must be aware of and trained in both procedures.
5. Write up the gaps and act on them. The Commission suggests an action plan for any gaps or areas needing improvement.

What do we find when we review providers’ evidence?

When a provider’s policies are on file but not in use, the place we see it most often in our pre-audit evidence reviews is the registers. The policies call for incident, complaints, risk and continuous improvement registers. They exist, but they are empty or have not been kept up.

A register is where you can see a policy being used: auditors examine incident reports, complaints records, risk registers and improvement logs. So in your own rehearsal, open each register and check that its entries are current and match what happened in your service. Across everything it checks, our pre-audit evidence review catches an average of 16 gaps before the auditor sees them.