NDIS verification audit vs certification audit: which one applies to you

Written by the Provider360 team. Provider360 is Australia’s leading done-for-you NDIS registration and compliance solution, supporting 3,000+ disability service providers nationally. Verification or certification is the first question almost every provider brings us.

What is an NDIS verification audit, and what is a certification audit?

An NDIS verification audit is an assessment by an approved quality auditor conducted as a desktop audit: the auditor reviews your documentation against the applicable standard, off-site. A certification audit is an assessment that adds two things to that desktop audit: an inspection of the sites, facilities, equipment and services used to deliver supports, and interviews with relevant persons, including your key personnel and the people receiving supports.

Read those two definitions side by side. Certification is not a stricter version of verification: it is the verification desktop audit plus a site inspection plus interviews. Everything in the smaller audit is inside the bigger one.

The word that decides which one you get is “only”. The Commission’s rule is that verification applies to providers who only deliver low-risk or low-complexity supports and services, while certification applies to providers delivering one or more high-risk or complex supports. One certification-level support anywhere in your scope moves the entire registration across. That single word carries the whole comparison, and it is what providers most often get wrong when they scope an application.

Did the 2026 reforms change the two audit pathways?

No. The 2026 reforms changed who must register and which module they are assessed against, not how the two audits work. Mandatory registration for supported independent living and NDIS digital platform providers, the new registration groups, and the new SIL Practice Standards all sit on top of the same two-pathway framework.

And the framework is current: the Commission refreshed its quality audit process guidance on 20 July 2026 with the two-pathway rule intact, and the Provider Registration Rules were compiled on 1 July 2026 with the section 4 and section 5 definitions unchanged in substance. If you are reading an older explanation that describes surveillance audits in your first and second calendar years, it is out of date: the current guidelines no longer contain that wording.

Which NDIS Practice Standards will you be assessed against?

Verification and certification are defined as two assessment methods in the NDIS (Provider Registration and Practice Standards) Rules 2018, at section 4 and section 5(1) of compilation F2026C00527 (1 July 2026). The audits themselves are conducted under the NDIS (Approved Quality Auditors Scheme) Guidelines 2018, compilation F2025C01100, Compilation No. 5 (15 November 2025), where section 12 states that a verification audit includes the activities of a stage one audit, and section 13 states that a certification audit comprises both a stage one audit and a stage two audit.

That split decides which standards you are assessed against:

• Schedule 8 of the Provider Registration Rules applies to a verification audit.
• Schedules 1 to 7 apply to a certification audit.
• Part 2 of the Practice Standards (Worker Screening) Rules 2018 applies to both.

Nor is the audit the same size for every provider on a pathway. Certification assessment must be proportionate to the size of the provider, the scale of its operations including geographical area and number of locations, and the scope and complexity of the supports delivered, and it may be conducted by an appropriate sampling method. That is why two providers on the same pathway can face very different audit effort.

Only approved quality auditors can assess you. They are accredited by JASANZ, the Joint Accreditation Scheme for Australia and New Zealand.

Which audit pathway applies to you?

Your pathway follows the registration groups you apply for, and the Commission confirms it in your Initial scope of audit. Our page on NDIS registration groups maps every group to the audit it triggers. Four situations cover almost every provider:

If you deliver only low-risk supports, then you are on the verification pathway. Therapy supports, plan management, assistive equipment, home modifications and similar sit here. A desktop audit, no site visit, no participant interviews. Part of the rationale is oversight that already exists: as the Commission puts it, many of these providers have already met the requirements of professional regulation, for example through the Australian Health Practitioner Regulation Agency or another professional body.

If you deliver any core or high-risk support, then you are on the certification pathway. Personal care, assistance with daily life, community participation, supported independent living and behaviour support all sit here. Two stages, site inspection and interviews included. Supported independent living is always certification, and it now carries mandatory registration: see SIL registration and transition pathways.

If you deliver a mix of both, then certification governs the whole registration, and you sit one audit rather than two. This is the fork that costs providers the most confusion. You are assessed against Schedules 1 to 7 instead of Schedule 8, and certification satisfies verification: where compliance with a standard must be assessed using verification, that requirement is met if compliance is assessed using certification. So your low-risk services are not audited separately, and they are not left out either: they are covered by the wider audit you were always going to sit.

If you are not sure, or your scope is still moving, then get the scope settled before you commit to anything. The Initial scope of audit is authoritative, but it arrives after you apply, which is too late to be your planning tool. The practical interim step is a scope assessment: work out which registration groups you actually need, and the pathway falls out of it. Our free NDIS Registration Roadmap does that in about 60 seconds and tells you which pathway your scope lands on.

NDIS verification audit vs certification audit: the full comparison

Every row is sourced. Read the first row first: the stage structure is the difference that holds in every case, and everything else follows from it.

Those two pathways cover your initial registration audit, but they are not the only audits in the system. There are four others, each with its own trigger: a provisional audit assesses readiness when you have no participants yet; a mid-term audit falls due by 18 months on the certification pathway; a condition audit can be imposed by the Commissioner, including after a provisional audit or an unresolved minor non-conformity; and an out of cycle audit is triggered when you expand your scope mid-cycle.

What does certification actually add after the desktop audit?

A whole second audit. Stage two should commence within three months of stage one, and it is the stage verification providers never sit: the auditor inspects the sites, facilities and equipment used to deliver supports, and interviews your key personnel and the people receiving them. Participants are included on an opt-out basis, so you have to notify them, respect and document any decision to opt out, and tell the auditor.

What the auditor is testing changes in stage two as well. In the Commission’s own words, the focus moves from what your policies say to what actually happens in practice: auditors ask how you know participants are safe, and to be shown how incidents are managed from start to finish, wanting real incident reports, complaints records, training logs and supervision notes rather than the policy on its own. Closing that distance before audit day is what our pre-audit evidence review is for: it catches an average of 16 gaps before the auditor sees them.

The obligations that follow are heavier too. The audit report is due to the Commission within 28 days on certification against 14 on verification. A mid-term audit must commence no later than 18 months after your registration period begins, carried out using certification, with narrow exclusions: providers delivering only early intervention supports for early childhood, only specialist disability accommodation, or transitioned providers. Expanding your registration groups mid-cycle triggers an out of cycle audit. And a major non-conformity, a rating of 0, gives you three months to fix it, with registration not progressing until it is addressed.

One number cuts against the expected story, and it is worth stating plainly. The Commission publishes median calendar days from the auditor submitting the audit recommendation to the registration decision. For new applications in January to March 2026, certification decisions took a median of 34 days and verification decisions 49. Certification was the faster of the two in that step. Three caveats matter: this measures one step only, not preparation, application, auditor scheduling or the audit itself, so it is not how long registration takes; these are medians, so half of applications took longer; and the figures move quarter to quarter. The honest reading is that the pathway difference lives in the audit, not in the Commission’s decision window.

End to end, in our own experience across 3,000+ providers, verification registrations typically run 4 to 6 months and certification 8 to 12. Those are Provider360’s observed timelines, not Commission-published figures. The documentation load tracks the same gap: a verification-scope provider works from 70+ documents, a Core Module certification provider from 120+. What the audit costs is a separate question with real figures behind it, and we answer it in what NDIS registration costs in 2026.