External Compliance Manager
Managing Ongoing Compliance
Registration is a day. Compliance is every day after it. This is what actually has to happen between audits, and how we take it off your hands.
How it works
- Answer the questionnaireSeven short steps, about five minutes. Your answers are kept as you go.
- Book your discovery callPick a time in our calendar as soon as you submit.
- Talk about you, not backgroundWe come to the call already knowing your setup and show you what ECM would look like for your business.
Free, no obligation. If ECM isn’t the right fit today, we’ll tell you straight.
Get Started
ECM Eligibility & Suitability Questionnaire
Thanks for your interest in External Compliance Manager. Most providers we speak to are carrying compliance in their head, in a spreadsheet, or in the gap between the two, and it only becomes urgent when an audit date lands. ECM takes that weight off you, with an experienced compliance manager working inside your business without the cost of hiring one. This short questionnaire takes about five minutes. It tells us where you’re at, so your discovery call isn’t spent on background, we’ll come to the call already knowing your setup, and use the time to show you exactly what ECM would look like for you. Answer as honestly as you can. There are no wrong answers, and nothing here commits you to anything. If ECM isn’t the right fit today, we’ll tell you straight and point you to what is.
The Problem
Compliance Decays Quietly
Nothing dramatic happens. A worker joins and their screening check is recorded in an email instead of the register. A complaint is resolved in a phone call and never written down. A policy references a standard that was reworded last year. A quarterly review happens twice and then stops.
Each one is small. None of them causes a problem on the day. Then an auditor sorts the worker register by expiry date, asks for the complaints log, and eighteen months of small omissions become a set of corrective actions.
The Work
What Has to Happen Between Audits
| Area | What it involves | How often |
|---|---|---|
| Incidents | Recording, investigating, acting, and notifying the Commission where it is a reportable incident — inside the required timeframes. | As they occur, reviewed monthly |
| Complaints | A record of every complaint, what was done, and what the person was told. Including the ones resolved informally. | As they occur, reviewed monthly |
| Worker screening and qualifications | A register with expiry dates, checked before anything lapses rather than after. | Quarterly at minimum |
| Training | Evidence that workers have had it, not an assertion that they have. | Ongoing, reviewed quarterly |
| Policies and procedures | Reviewed against the current standards and against how the business now actually runs. | Annually, and whenever the standards change |
| Service agreements | Current, signed, and reflecting what is really delivered. | At onboarding and on change |
| Standards changes | Watching for them, and acting before an auditor raises it. | Continuous |
The Options
Doing It Yourself, or Handing It Over
Doing It Yourself
- No external cost, but it costs your time
- Works for a disciplined sole trader with few participants
- Falls over when the business gets busy, which is when the risk rises
- Nobody is watching for standards changes on your behalf
An External Compliance Manager
- No salary, no recruitment, no leave cover
- Someone whose job it is to notice the expiry date before it passes
- Standards changes reach you as a task, not as an audit finding
- Your file and your history stay with one team between audits
What We Do
The Same Team, Between Audits Too
A regular rhythm
Scheduled reviews rather than an annual panic. Registers checked, records reviewed, expiries caught before they expire.
Documents kept current
Updated as the standards move and as your business changes. All 37 registration groups are covered.
Incidents handled properly
Guidance in the moment it happens, when it matters, rather than a policy to read afterwards.
Someone who knows your file
Not a ticket queue. The same team at your mid-term audit and at renewal.
FAQ
Ongoing Compliance Questions
What is a reportable incident?
A defined set of serious incidents — including death, serious injury, abuse or neglect, unlawful sexual or physical contact, sexual misconduct, and the unauthorised use of a restrictive practice — that must be notified to the NDIS Commission within set timeframes. The timeframes are short and they are strict. Knowing which category an incident falls into, in the moment, is exactly what providers need help with.
How often should policies be reviewed?
Annually at minimum, and immediately whenever the Practice Standards change or your business does — a new registration group, a new site, a significant change in staffing. A policy reviewed on a date and never read is not a review.
Do I need a compliance officer?
At a certain size, yes. Well before that size, an external arrangement covers the same ground without a salary. The point at which an internal hire makes sense is usually later than people expect, and the point at which the risk becomes real is earlier.
What happens if the Practice Standards change?
Your obligations change with them, whether or not you noticed. It is one of the most common reasons a provider who has done nothing wrong is non-compliant at a mid-term audit. Watching for it is part of what an external compliance arrangement is for.
Can you take over compliance for an existing registration you did not set up?
Yes, and many of the providers we support came to us that way. The first step is a review of where things actually stand.
Stop Managing It in Bursts
Tell us about your organisation and we will scope what ongoing support looks like for you.