What an NDIS Verification Audit Checks

If you only deliver lower risk or lower complexity supports and services, your registration is assessed through a verification audit rather than certification. Verification is a lighter audit, but it is still a real one, done by an independent approved quality auditor, and the report rates how well you meet each requirement. Knowing exactly what the auditor reviews is the simplest way to prepare.

This guide covers the four areas a verification audit checks, the evidence that usually satisfies each one, and the gaps that most often cause findings. For general preparation, see our audit preparation guide.

Verification in one paragraph

A verification audit applies to NDIS providers who only deliver lower risk or lower complexity supports and services. Many providers that need one have already met the requirements of professional regulation, for example through certification with the Australian Health Practitioner Regulation Agency (AHPRA) or another professional body. Instead of the core module of the NDIS Practice Standards, you are assessed against the verification module, which applies to all registered NDIS providers delivering lower-risk supports and services. An approved quality auditor completes a desktop review of the required documentary evidence. If you deliver even one higher risk or more complex support, you need a certification audit instead; our guide to verification and certification explains why.

The four areas the auditor reviews

The verification module covers human resource management, risk management, complaints management and resolution, and incident management.

1. Incident management

The module requires an incident management system that complies with the National Disability Insurance Scheme (Incident Management and Reportable Incidents) Rules 2018. It should be proportionate to your business: for a sole trader that might be a short procedure and a simple register; for a team it needs to show who does what.

Evidence that usually satisfies it:

• a written incident management procedure that describes how you actually respond
• an incident register, even if it has few entries
• how you would identify reportable incidents and notify the NDIS Commission

2. Complaints management

The module requires that each participant has knowledge of and access to your complaints management and resolution system. Complaints should be recorded, resolved fairly and used to improve.

Evidence that usually satisfies it:

• a complaints procedure written in plain language
• how participants are told about your complaints process and how to use it
• a complaints register showing how complaints were handled and closed

3. Risk management

The auditor checks that you identify the risks in your business and your supports, and manage them. The module requires appropriate insurance, including professional indemnity, public liability and accident insurance.

Evidence that usually satisfies it:

• a risk management procedure
• a risk register with real risks, controls and review dates
• current certificates for each insurance policy you hold

4. Human resource management

The module requires that each participant's support needs are met by workers who are competent in their role, hold relevant qualifications, and have relevant expertise and experience. Records of worker identity, right to work, pre-employment checks, qualifications and/or experience must be kept.

Evidence that usually satisfies it:

• identity, right to work, qualification and registration records for each worker, including you
• NDIS worker screening clearances for everyone in a risk-assessed role or a key personnel role; see our worker screening guide
• records that each worker has completed the mandatory NDIS orientation module, and records of continuing professional development

The orientation module, "Worker orientation module – Quality, safety and you", explains what workers need to do under the NDIS Code of Conduct, and it is mandatory for staff of registered NDIS providers.

Where verification audits go wrong

In our experience, findings in verification audits usually come from a short list of avoidable gaps:

• Template documents. A policy written for a different business, with your name added, rarely matches how you work. Auditors notice quickly.
• Empty registers that should not be empty. A register with nothing in it is fine if nothing has happened. A register nobody has ever opened is not.
• Missing screening records. All key personnel, and all workers in risk-assessed roles, are checked for a valid NDIS worker screening clearance. Have each one on file.
• Out-of-date qualifications. Registrations and certificates that have lapsed since you applied.
• A self-assessment that does not match the evidence. What you told the Commission should be what the auditor finds.

What happens after the audit

The audit report has a rating for how well you comply with each NDIS Practice Standard and quality indicator: 3 conforms with elements of best practice, 2 conforms with the NDIS Practice Standards, 1 is a minor non-conformity and 0 is a major non-conformity. If you get a major non-conformity in any area, you have 3 months to fix the issue, and your registration won't progress until you have addressed it. A minor non-conformity gives you a longer time, and you can continue with the registration process. Correcting it well means fixing the gap itself, fixing whatever caused it, and keeping evidence of both so the auditor can confirm the change.

The auditor submits the audit report and recommendation to the NDIS Commission up to 14 days after the verification audit is completed, and the Commission considers the recommendation and decides whether to register you. Keep your evidence organised after approval: re-registration has the same steps as your initial application, including getting an audit, and it is far easier to keep a system current than to rebuild one.

Preparing in a weekend

For a small provider, preparing for verification is mostly a matter of order:

1. Re-read your initial scope of audit so you know exactly what is being assessed.
2. Gather the documents for each of the four areas into one folder each.
3. Check every worker's qualifications, screening and orientation module against your records.
4. Re-read your self-assessment and fix anything your evidence no longer supports.
5. Agree a date with your auditor and keep your evidence ready to share.

If you have not yet chosen an auditor, our guide to choosing an approved quality auditor covers what to compare. And if you would like a second pair of eyes on your answers before you lodge, the self-assessment answers review gives written feedback on each one.

Verification is designed to be proportionate. Providers who prepare for these four areas specifically, with evidence that reflects how they really work, usually find it the most straightforward step of the whole registration.