Why NDIS audits exist
Before you can become a registered NDIS provider, you must be assessed against the NDIS Practice Standards that apply to the supports you want to deliver. The NDIS Commission does not do this itself. You engage an approved quality auditor, who audits you and reports to the Commission, which then makes the registration decision.
The Commission's view is that audits are about demonstration: showing that your systems work in practice and participants are safe, not just that you have written policies.
The types of audit
The initial scope of audit the Commission gives you tells you which audit you need. The general rules are:
- Verification audit: for providers who only deliver lower risk, lower complexity supports, often professionals already regulated by AHPRA or a professional body. It is a desktop review of documents
- Certification audit: for providers who deliver any higher risk or more complex supports, such as daily personal activities, SIL or behaviour support. It has a desktop stage and an onsite stage
- Mid term audit: for providers who completed a certification audit, finalised 18 months into the registration period
- Condition audit: can be required by the Commission during your registration
- Out of cycle audit: may be needed if you want to change the supports you provide during registration
How a certification audit works
Stage 1 is a desktop audit, usually offsite, where the auditor asks for information and evidence. Stage 2 is onsite and should happen within 3 months of stage 1. The auditor looks at records, visits sites, observes support and interviews staff and participants. Participants are automatically included unless they opt out, so let them know in advance.
Auditors sample staff files for worker screening clearances, qualifications, induction and supervision, and trace incidents and complaints from start to finish.
The mid term audit
Certification providers must have a mid term audit. It checks the core standards on provider governance and operational management, any standard where you had a corrective action plan, and anything else the Commission requires. Start organising it around 12 months after your registration date, so the auditor can submit the final report by the 18 month deadline.
Mid term audits do not apply to some providers, such as those only registered for Specialist Disability Accommodation, or individuals and partnerships who only needed certification for early childhood supports.
Findings and non conformities
At the closing meeting the auditor summarises strengths and any gaps. A minor or major non conformity is not a fail. It means something needs to be fixed, and you are given a timeframe and told what evidence to provide. You can check the draft report for factual accuracy before it is finalised and sent to the Commission.
What it costs
There is no fee to apply for registration with the NDIS Commission, but you pay the auditor. The Commission does not set audit prices. Cost depends on the size of your organisation, the number of participants and the supports in scope, so get quotes from several approved quality auditors and compare them.
Preparing well
- Read the Practice Standards modules that apply to your registration groups
- Keep staff files complete: worker screening, qualifications, training and supervision
- Have real examples ready: incident reports, complaints, risk registers and meeting minutes
- Tell participants and staff when the auditors are coming and what to expect
- From 12 October 2026, start new applications in the new NDIS Commission Portal