To get ready for an NDIS audit, confirm your audit type from your initial scope of audit, map the standards that apply, and run a gap analysis. Then tailor your policies and procedures to how you actually work, put them into practice with real records, complete your staff files and worker screening, and run an internal audit before your auditor arrives.
Key takeaways
- Your initial scope of audit tells you whether you face verification or certification and which standards apply.
- Verification checks four areas (HR, incidents, complaints and risk) plus qualifications. Certification checks the full Core Module plus any supplementary modules.
- Auditors test whether your policies are actually used, so you need records, registers and trained staff, not just documents.
- The NDIS Commission expects your documents to be specific to your organisation, not a copy of a purchased pack.
- Major nonconformities must be fixed within three months, so preparing properly saves both time and money.
Whether you are facing a verification audit or a certification audit, the providers who do best are the ones who prepare in a deliberate order. This plan works for both. Where the two differ, we say so.
Step 1: Confirm your audit type
When you submit your application in the NDIS Commission Portal, you receive an initial scope of audit. It confirms your audit type, your registration groups and the standards you will be assessed against. Your audit type depends on your registration groups, and if any group needs certification, the whole application is certified.
| Verification | Certification | |
|---|---|---|
| Method | Desktop review of documents | Stage 1 desktop review, then Stage 2 onsite |
| Standards | Verification Module plus required qualifications | Core Module plus any supplementary modules |
| Site visit | No | Yes, Stage 2 within three months of Stage 1 |
| Staff and participant interviews | No | Yes (participants can opt out) |
| Mid-term audit | No | Yes, final report due within 18 months |
| Typical cost | $900 to $1,800 | $3,000 to $15,000+ |
See our guide to how much an NDIS audit costs for a full price breakdown.
Step 2: Know exactly which standards apply
Verification
The Verification Module covers four areas:
- Human resource management: identity and right to work, pre-employment checks, qualifications, the NDIS Worker Orientation Module, and infection control and PPE training.
- Incident management: a documented system to record, manage and learn from incidents.
- Complaints management: a fair, accessible way for participants to complain, with records.
- Risk management: identifying and managing risks, including insurance and emergency and disaster planning.
You also need evidence of the qualifications or professional memberships required for your registration groups.
Certification
Certification covers the full Core Module: rights and responsibilities, governance and operational management, provision of supports, and the support provision environment. Supplementary modules are added depending on your supports:
| Module | Applies to |
|---|---|
| Module 1: High intensity daily personal activities | Registration group 0104 |
| Module 2: Specialist behaviour support | Registration group 0110 |
| Module 2A: Implementing behaviour support plans | Providers who use regulated restrictive practices |
| Module 3: Early childhood supports | Registration group 0118 |
| Module 4: Specialised support coordination | Registration group 0132 |
| Module 5: Specialist disability accommodation | Registration group 0131 |
| SIL Module (new from 1 July 2026) | Class of support 0138, Assistance with SIL |
The core standards themselves have not changed in 2026. The Commission is reviewing them, but no new core standards or start date have been announced, so prepare against the current version.
Step 3: Run a gap analysis
List every outcome and quality indicator that applies to you, and next to each one write down the evidence you have today: a policy, a form, a register or a record. Anything blank is a gap. This also gives you a head start on the self-assessment, which is part of your application.
Tip: An internal audit spreadsheet that lists every indicator makes this far quicker. Our Certification pack includes one with the Core Module quality indicators already set out.
Step 4: Build and tailor your policies and procedures
Most of your evidence starts with documents. These are the core areas auditors expect to see covered:
| Area | What auditors expect to see |
|---|---|
| Governance | Organisational structure, roles, delegations, conflict of interest management, business planning |
| Risk management | Risk management policy, risk register, risk assessments, insurance |
| Incident management | Incident policy and procedure, incident forms, register, reportable incident process |
| Complaints | Feedback and complaints policy, accessible information for participants, complaints register |
| Human resources | Position descriptions, screening and qualification records, induction, training, supervision |
| Information management | Privacy, consent, record keeping, storage and retention |
| Service delivery (certification) | Service agreements, support plans with risk assessments, transitions, continuity of supports |
| Emergency and disaster | Emergency and disaster management plans, tested and communicated to staff and participants |
Tailoring is not optional. The NDIS Commission expects applicants to be substantially involved in preparing their application, to be able to explain what they submit, and to make sure responses and policies are specific to their organisation rather than a direct copy of purchased documents. Near-identical content across providers may lead to refusal or a condition requiring a new certification audit.
If you start from templates, replace every placeholder, rewrite procedures to match your real processes, assign real people to roles, and remove anything that does not apply to your supports. Our guide to where to buy NDIS policies and procedures explains what to look for in a good starting point.
Step 5: Put your systems into practice
Auditors check that your system works, not just that it exists. Before your audit, make sure you have:
- registers in use for incidents, complaints, risks, training and conflicts of interest
- participant files with signed service agreements, support plans, risk assessments and consents (certification)
- meeting minutes and continuous improvement records showing you review and act on issues
- emergency and disaster plans that staff know about and that have been tested
At a certification Stage 2, auditors interview staff and participants. Staff should be able to explain, in their own words, how to report an incident or handle a complaint.
Step 6: Get your staff files audit-ready
Personnel files are one of the most common sources of findings. For every worker, check you hold:
- proof of identity and right to work in Australia
- an NDIS Worker Screening clearance for risk-assessed roles
- an NDIS Worker Orientation Module certificate
- qualifications and any registrations relevant to their role
- infection prevention and control and PPE training records
- a position description, induction record and training history
- current contact details and details of any secondary employment
Our support worker guide explains the screening and orientation requirements in detail.
Step 7: Run an internal or mock audit
Rate yourself the way an auditor will. NDIS auditors use a scale where 3 means elements of best practice, 2 means conformity, 1 is a minor nonconformity and 0 is a major nonconformity. Anything you would score 0 or 1 is your priority list. Ask someone who did not write the documents to review them, because fresh eyes catch gaps the author misses.
Step 8: Book your auditor and prepare for audit day
Get quotes from approved quality auditors and select one in the portal. Then organise your evidence into folders that follow the standards, so the auditor can find everything quickly. For verification, you submit documents for desktop review. For certification, confirm the Stage 2 schedule, the sites to be visited and who will be interviewed, and brief your team on what to expect.
Step 9: Close out any nonconformities
Most providers receive at least one finding. Minor nonconformities are addressed through a corrective action plan. A major nonconformity must be fixed within three months, and your registration will not progress until it is. Auditors report within 14 days for verification and 28 days for certification, after which the Commission makes its decision. Our guide to getting your NDIS certificate covers what happens next.
Quick readiness checklist
| Item | Verification | Certification |
|---|---|---|
| Initial scope of audit read and understood | Yes | Yes |
| Gap analysis against every applicable indicator | Yes | Yes |
| Tailored incident, complaints, risk and HR policies | Yes | Yes |
| Full Core Module policy and procedure suite | No | Yes |
| Supplementary module documents | No | If in scope |
| Registers set up and in use | Incidents, complaints, risks | All core registers |
| Staff files complete, including screening and orientation | Yes | Yes |
| Insurance certificates of currency | Yes | Yes |
| Participant files with agreements, plans and consents | Recommended | Yes |
| Internal audit completed and gaps fixed | Yes | Yes |
Skip weeks of writing. Get a complete Core Module policy suite, forms and an internal audit tool, ready to tailor.
See what's in the packFrequently asked questions
What is the difference between NDIS certification and verification?
Verification is a desktop review against the Verification Module (HR, incidents, complaints and risk) plus qualification evidence, for lower-risk supports. Certification is a two-stage audit with an onsite visit, assessed against the full Core Module and any supplementary modules, for higher-risk or more complex supports.
How long does it take to get ready for an NDIS audit?
It depends on your starting point. With a complete set of tailored documents, many small providers are ready within a few weeks. Writing everything from scratch and setting up systems can take two to three months.
Can I use template policies for my NDIS audit?
Yes, as a starting point. The Commission expects documents to be specific to your organisation and not a direct copy of purchased documents, so tailor every template to how you actually operate and make sure you can explain it.
What happens if I fail an NDIS audit?
Findings are rated. Minor nonconformities need a corrective action plan. Major nonconformities must be fixed within three months and your registration will not progress until they are. The Commission can refuse registration if requirements are not met.
Do NDIS auditors talk to participants?
In a certification Stage 2 audit, yes. Participants are included in interviews unless they opt out. Verification audits are desktop reviews and do not involve participant interviews.
Do I need participants before my certification audit?
Not necessarily. Providers with no participants yet may be eligible for provisional certification, followed by a further audit once services begin. Ask your auditor which approach applies to you.
Further reading on the blog
Sources and official resources
- NDIS Commission: Types of audits
- NDIS Commission: Verification Module
- NDIS Commission: NDIS Practice Standards
- NDIS Commission: SIL Practice Standards
- NDIS Commission: Apply for registration
- NDIS Commission: Registration groups and classes of support
Information is general in nature and current as at 12 October 2026. NDIS rules change, so always confirm requirements with the NDIS Quality and Safeguards Commission before you act.