Who needs a certification audit
When you apply for NDIS registration, the NDIS Commission sends you an Initial scope of audit. It tells you which audit you need, based on the registration groups you applied for. Lower risk supports need a verification audit. If you deliver even one higher risk or more complex support, you need a certification audit.
Supported independent living providers, who must be registered from 1 July 2026, all need certification audits, and so do providers of specialist behaviour support, high intensity daily personal activities and assistance with daily personal activities.
What gets assessed
Every certification audit covers the core module of the NDIS Practice Standards. That has four parts: rights and responsibilities for participants, provider governance and operational management, provision of supports, and the provision of supports environment.
On top of the core module you are assessed against any supplementary modules that match your supports. These include high intensity daily personal activities, specialist behaviour support, implementing behaviour support plans, early childhood supports, specialised support coordination, Specialist Disability Accommodation and the new supported independent living module.
Stage 1 and stage 2
A certification audit runs in two stages.
- Stage 1, desktop audit: the auditor asks for your policies, procedures and evidence and reviews them, usually offsite
- Stage 2, onsite audit: the auditor checks how your policies work in practice. That can mean visiting your sites, sampling staff files, interviewing workers and participants and observing supports
- The stage 2 audit should take place within 3 months of stage 1 finishing
- The auditor submits the report to the NDIS Commission up to 28 days after the audit is complete
Participants in the audit
Participant interviews are a key part of stage 2. Audits use opt out sampling, so you must tell all participants they are included unless they choose not to be. If someone opts out, respect it, record it and tell the auditor.
Auditors ask simple questions such as whether people feel safe, whether staff listen, and whether they know how to make a complaint. The Commission publishes plain English fact sheets you can give participants.
Ratings and non conformities
Each standard and quality indicator is rated from 0 to 3: 3 conforms with elements of best practice, 2 conforms, 1 is a minor non conformity and 0 is a major non conformity.
A major non conformity gives you 3 months to fix the issue, and your registration does not progress until it is resolved. A minor non conformity gives you longer and the application can continue. A non conformity is not a fail. It means something needs to be corrected or strengthened.
The mid term audit and after
Registration generally lasts three years. If you were certified for higher risk supports you also need a mid term audit: start preparing about 12 months after your registration date, and the auditor's final report is due to the Commission by 18 months. It focuses on governance and operational management, plus any standard that needed a corrective action plan.
Some providers are exempt from the mid term audit, including individuals or partnerships certified only for early childhood supports, and providers registered only for SDA. The Commission can also require a condition audit, and you may need an out of cycle audit to add new registration groups.
Cost and how to prepare
Registering with the Commission is free, but you pay the auditor. The Commission does not set audit prices, and cost depends on your size, sites and number of participants, so get quotes from more than one approved quality auditor.
Auditors look for evidence that systems work, not just that they exist. Keep incident and complaint records, training logs, supervision notes and worker screening clearances current, and make sure staff can explain how things happen day to day. Policies copied from a template that do not match how you operate are a common problem, and the Commission warns that identical purchased policies can lead to a refused application.