What Happens at an NDIS Certification Audit: Stage One and Stage Two

If you deliver one or more higher risk or more complex NDIS supports and services, your registration needs a certification audit. It is the audit most providers worry about, and most of that worry comes from not knowing what happens on the day. This guide walks through both stages, what the auditor looks at in each, and what happens afterwards.

For the practical side of getting ready, see our audit preparation guide. If you are not sure whether you need certification at all, start with verification or certification.

Who conducts the audit

When you submit your application, you get an email with an Initial scope of audit. It sets out the type of audit you need and your registration groups. You are responsible for engaging an independent approved quality auditor to complete the quality audit. In the NDIS Commission's new portal, once you have submitted Part 2 you select your approved quality auditor from a list in the portal, and the portal emails the auditor a request, which they review and accept. The Commission recommends getting more than one quote before you choose.

The standards you are audited against are the NDIS Practice Standards: a core module that applies to all registered NDIS providers delivering higher-risk supports and services, plus supplementary modules that apply depending on the types of supports and services you deliver. Check which modules you need before the audit, so you prepare for the right ones.

Your application also includes a self-assessment against the applicable NDIS Practice Standards, with evidence to support your comments. Your self-assessment and evidence are what the auditor checks.

The auditor assesses and recommends; the NDIS Commission decides. The auditor submits a recommendation to the Commission, which considers it and assesses your suitability as a provider. Keeping those two roles separate helps you prepare for the right thing: the auditor needs to see evidence.

Stage one: the desktop audit

Stage 1 is a desktop audit. The auditor asks for information and evidence, and this usually takes place off-site. It is where the auditor sees whether your system exists on paper and is ready to be assessed in practice.

What we suggest you have ready (our checklist, not an official list):

• your policies and procedures for the areas the standards cover, such as incident management, complaints, risk, governance and human resources
• your registers, including incidents, complaints and risks
• how you manage worker screening, training and supervision
• your templates for service agreements, support plans and consent
• your self-assessment, and evidence that supports what it says

Treat any gaps the auditor raises at this point as useful. They are far easier to close before Stage 2 than after it.

Stage two: the onsite audit

Stage 2 is an onsite audit. The auditor looks at how you are implementing your policies and procedures. This might include viewing records, visiting your sites, and interviewing staff and participants. The Stage 2 onsite audit should take place in the 3 months after the Stage 1 audit is complete.

This is where documentation that does not match reality comes apart, so it is where preparation pays off most.

Records

The auditor views records to see whether what your procedures say happens is what actually happens. Records worth having in order include participant files, case notes, incident reports, complaint records, and training and screening records.

Interviews with staff

Staff may be asked how they do their jobs: what they would do if there was an incident, how a participant can make a complaint, how they protect a participant's privacy. They do not need to recite policies. They need to be able to explain the processes in their own words.

Participants

The method of sampling used in audits is "opt out". You need to let participants know they are automatically enrolled in the audit unless they opt out. If a participant opts out, respect their choice, document it and tell the auditor. Participants who take part may be interviewed.

After the audit: ratings and non-conformities

The audit report has a rating for how well you comply with each NDIS Practice Standard and quality indicator:

• 3: conforms with elements of best practice
• 2: conforms with NDIS Practice Standards
• 1: minor non-conformity
• 0: major non-conformity

If you get a major non-conformity (0) in any area, you have 3 months to fix the issue, and your registration won't progress until you have addressed it. If you get a minor non-conformity (1), you have a longer time to fix the issue and you can continue with the registration process.

Closing non-conformities well usually means three things:

1. fixing the immediate gap, such as a missing record or an out-of-date policy
2. fixing the cause, so the gap does not come back
3. keeping evidence that both are done, so the auditor can verify it

The auditor submits the audit report and recommendation to the NDIS Commission up to 28 days after the certification audit is completed. The Commission then considers the recommendation and decides on your registration.

It does not end at registration

If you initially completed a certification audit, you have a mid-term audit 18 months into your registration period. The Commission's page on the quality audit process sets out who it applies to. When your registration ends, re-registration has the same steps as your initial application, including getting an audit. Documents that passed at registration are not automatically documents that pass later, so keep them current. Our guide to renewing your registration covers the end of the cycle.

How to make the day easier

A few habits make a certification audit noticeably smoother:

• Organise your evidence by standard so you can find any record quickly.
• Brief your team on what the auditor may ask and why, without scripting answers.
• Re-read your self-assessment the week before, so what you say matches what you wrote.
• Tell participants about the audit early, and record any who opt out.
• Name one contact to coordinate with the auditor on the day.

If you want a rehearsal first, a mock audit runs through the questions auditors ask, with feedback on what is ready and what is not. Either way, the aim is the same: an organisation whose documents, records and people all tell the same story.