Auditing an NDIS Provider Quality Management System

Why Auditing an NDIS Provider Is Different

If you have audited manufacturing plants, construction sites, or logistics operations, walking into an NDIS provider audit for the first time can feel disorienting. The processes are person centred rather than product centred. The “output” is not a widget you can inspect. It is a service delivered to people with disability, often in their homes, often by workers who operate with significant autonomy and limited direct supervision.

That context shapes everything about how you approach the audit. You are not just checking whether a procedure exists. You are gathering evidence that the system actually protects participants, supports their goals, and gives them genuine choice and control over their lives. That is a meaningfully different audit task, and it requires a different mindset alongside your standard QMS auditing skills.

This guide is written for internal auditors, quality managers, and ISO consultants working with NDIS registered providers. It assumes you already understand how to conduct an audit. What it offers is specific, practical guidance on what to look for, where the common gaps are, and how to gather evidence that actually tells you whether the system is working.

The Regulatory Framework You Need to Understand First

Before you start building your checklist, you need to understand what an NDIS provider is being assessed against. The primary framework is the NDIS Practice Standards, which are administered by the NDIS Quality and Safeguards Commission. These standards sit alongside the NDIS Code of Conduct, which applies to both providers and their workers.

The Practice Standards are organised into a core module that applies to all registered providers, plus supplementary modules that apply depending on the registration groups the provider holds. Those supplementary modules cover areas like specialist behaviour support, early childhood supports, and high intensity daily personal activities. If you are auditing a provider with a complex registration scope, you need to know which modules apply before you plan the audit.

Many NDIS providers also hold ISO 9001 certification, or are working toward it, because a well implemented QMS provides the documented system infrastructure that the Practice Standards require. If you want to understand how ISO 9001 and the NDIS Practice Standards complement each other, the post on ISO 9001 for NDIS Providers covers that relationship in detail.

As an internal auditor, your job is to audit against the organisation's own QMS, which should incorporate the Practice Standards requirements. You are not conducting an NDIS Commission audit. But you are checking whether the system is capable of meeting those requirements when the external auditor arrives.

Understanding the Audit Types in the NDIS Context

NDIS providers face two types of external audits conducted by approved quality auditors: certification audits and verification audits. The type depends on the registration groups the provider holds and the risk level of the supports they deliver.

Certification audits are more comprehensive. They involve document review, staff interviews, and participant interviews. Verification audits are less intensive and are typically applied to lower risk registration groups. They focus primarily on document review.

As an internal auditor, you should understand which type applies to your organisation, because that shapes the evidence you need to have ready. If your provider is subject to certification audits, your internal audit programme needs to cover participant experience, worker competence, and incident management in depth. If it is verification only, the documentary evidence requirements are your primary focus.

Planning the Audit: Scope, Risk and Participant Focus

Defining the Scope

Start by confirming the registration groups and the supports the provider delivers. A provider registered only for therapeutic supports has a very different risk profile to one delivering high intensity daily personal activities including complex bowel management or ventilator management. Your audit scope and sampling strategy need to reflect that risk.

Map the processes you intend to audit before you arrive. For an NDIS provider, the key processes typically include:

• Intake and eligibility assessment
• Support planning and goal setting
• Service delivery and monitoring
• Worker recruitment, screening, and induction
• Incident management and reportable incidents
• Complaints and feedback handling
• Restrictive practices management (if applicable)
• Participant rights and safeguarding
• Governance and management review

Not every process carries equal risk. Prioritise your time on the areas where failures have the greatest impact on participant safety and wellbeing.

Risk Based Sampling

When selecting participants and workers to include in your evidence gathering, use a risk based approach. Look at participants who receive higher intensity supports, those with complex needs, and those who may be less able to raise concerns themselves. Look at workers who are newer, who work remotely or in participants' homes, and who operate with less direct oversight.

Do not just sample the easy files. The gaps in an NDIS provider's system are almost never found in the files of participants who have been with the organisation for years and have articulate families advocating for them. They are found in the files of people who are more isolated, more vulnerable, or whose supports are more complex.

What to Audit: Key Areas and Evidence to Gather

Worker Screening and Competence

Every worker delivering NDIS supports must hold a current NDIS Worker Screening Check. This is a non negotiable requirement. Start here. Pull a sample of worker files and verify that screening checks are current, that they have not lapsed, and that the provider has a system for tracking renewal dates.

Beyond screening, look at competence records. The NDIS Practice Standards require workers to have the skills and knowledge to deliver the supports they are providing. For workers delivering high intensity supports, there are specific training requirements. Ask to see the competence framework the organisation uses. Then check whether actual worker records match what the framework says is required.

Common gaps here include:

• Screening checks recorded but not verified as current at the time of audit
• Training records that show attendance but not assessed competence
• No clear link between the supports a worker delivers and the competence requirements for those supports
• Induction records that are incomplete or undated

Interview workers directly. Ask them how they know what they are supposed to do in a given situation. Ask what they would do if a participant was distressed or at risk. Their answers will tell you more than the training records will.

Support Planning and Goal Setting

Every participant should have a current support plan that reflects their goals, preferences, and needs. Pull a sample of support plans and ask yourself whether they look like they were written with the participant or written about the participant. There is a significant difference, and auditors who have worked in this sector can usually tell within a few minutes of reading a plan.

Check the review dates. Are plans being reviewed at the frequency the organisation's own procedures require? Are there documented conversations with participants about whether their goals are being met? Is there evidence that the participant had genuine input into the plan, or does every plan look like it was completed by the same person using the same template with minor variations?

Look for evidence of person centred practice in the records, not just in the policy. The policy will always say the right things. The records will tell you whether those things are actually happening.

Incident Management and Reportable Incidents

This is one of the highest risk areas in any NDIS provider audit. The NDIS Commission requires providers to report certain incidents within specific timeframes. A failure to report, or a delay in reporting, is a serious compliance issue.

Start by reviewing the incident register. Look at the volume and types of incidents recorded. Then look at a sample in detail. For each incident you review, ask:

• Was the incident identified and recorded promptly?
• Was it correctly classified? Was the provider's classification consistent with the NDIS reportable incident categories?
• If it was a reportable incident, was it reported to the Commission within the required timeframe?
• Was a root cause analysis completed?
• Were corrective actions identified and implemented?
• Was there follow up to check whether the actions were effective?

Also look for what is not in the register. If you interview workers and they describe situations that sound like they should have been incidents, but those situations do not appear in the register, that is a significant finding. Under reporting is a common and serious problem in disability services.

Cross reference incident data with participant progress notes and shift notes where available. Inconsistencies between what notes record and what the incident register shows are worth investigating.

Complaints and Feedback

Review the complaints register and the feedback process. Check whether participants and their families know how to make a complaint. Ask workers how they would support a participant to make a complaint if the participant wanted to. Ask whether participants know they can complain to the NDIS Commission directly.

Look at how complaints have been handled. Were they acknowledged promptly? Were participants kept informed of progress? Were outcomes communicated? Were systemic issues identified from patterns in complaints and acted on?

A provider that receives very few complaints is not necessarily doing a good job. It may mean participants do not feel safe raising concerns, do not know they can, or have learned that raising concerns does not lead to change. That is worth exploring in your interviews.

Restrictive Practices

If the provider is registered to deliver supports involving restrictive practices, this area requires careful audit attention. Restrictive practices must be authorised in accordance with the relevant state or territory legislation, and providers must report their use to the NDIS Commission.

Check that the provider has a behaviour support practitioner involved where required. Check that any regulated restrictive practices are properly authorised, documented, and reviewed. Check that workers understand what constitutes a restrictive practice and what they are and are not permitted to do.

This is an area where the gap between policy and practice can be very wide. Workers on the floor may be implementing what they think are reasonable responses to challenging behaviour, without understanding that some of those responses meet the definition of a restrictive practice and require authorisation.

Governance and Management Review

Pull the management review records and check whether the inputs required by both ISO 9001 and the NDIS Practice Standards are being addressed. Look for evidence that leadership is actively monitoring quality and safety outcomes, not just financial performance.

Check whether quality data is being analysed and used to drive improvement. A management review that shows no incidents, no complaints, and no corrective actions should prompt questions, not satisfaction. Either the system is extraordinary, or the data is not being captured properly.

Participant Interviews: The Most Important Evidence You Will Gather

If your internal audit programme does not include conversations with participants, it is missing the most important source of evidence available to you. Participants are not just the recipients of the service. They are the people best placed to tell you whether the system is working in practice.

Participant interviews in an NDIS context require some additional preparation. Consider communication needs. Some participants may use augmentative and alternative communication. Some may have cognitive impairments that affect how questions should be framed. Some may have a support person or advocate present. Plan for this in advance and discuss with the service team how best to approach conversations with specific participants.

Keep questions simple, open, and non leading. Ask participants what they like about their supports, whether they feel listened to, whether they know how to raise a concern if something is wrong. Listen carefully to what they say, and to what they do not say. Note whether they seem comfortable or hesitant. Note whether support workers are present during the conversation and whether that seems to affect the participant's responses.

The findings you get from participant conversations will often be more revealing than anything in the document review. Treat that evidence seriously and record it carefully.

Common Nonconformities Found in NDIS Provider Audits

Based on what auditors regularly encounter in this sector, the most common nonconformities include:

• Expired or unverified NDIS Worker Screening Checks
• Support plans that have not been reviewed within the required timeframe
• Incident reports that are incomplete, incorrectly classified, or not reported to the Commission within required timeframes
• Corrective actions that are recorded but never verified as effective
• Workers who cannot describe the provider's complaints process or how to support a participant to make a complaint
• No documented evidence of participant consent for specific supports or changes to supports
• Restrictive practices being implemented without proper authorisation or documentation
• Management review records that do not address quality and safety outcomes in any meaningful way

When you find a nonconformity, write it clearly with the specific evidence that supports it. Vague findings do not drive improvement. If the support plan for a named participant (identified by file reference, not name, in your report) has not been reviewed in 18 months against a required 12 month review cycle, say exactly that. That is a finding that can be acted on.

For guidance on writing nonconformities that actually lead to corrective action, the post on how to write nonconformities that hold up is worth reading before you finalise your report.

Auditor Conduct and Sensitivity in This Environment

Auditing in a disability services environment requires a degree of sensitivity that is not always emphasised in standard auditor training. You may be visiting participants in their homes. You may be observing personal care supports. You may be speaking with people who have experienced trauma, abuse, or neglect.

Approach every interaction with respect and care. Do not treat participants as data sources. They are people, and the audit exists to serve their interests. If a participant discloses something concerning during an interview, you need to understand your obligations. Discuss with the organisation's safeguarding lead before the audit how disclosures will be handled, and make sure you are clear on your own responsibilities.

Maintain appropriate confidentiality. Participant information is sensitive. Handle it accordingly, and make sure your audit report does not contain identifying information that could cause harm if the report were shared more broadly than intended.

Building a Better Internal Audit Programme for NDIS Providers

A single annual internal audit is not sufficient for most NDIS providers. The risk profile of the sector, and the requirements of the NDIS Practice Standards, call for an ongoing programme that monitors key indicators continuously and conducts structured audits of specific processes throughout the year.

Consider structuring your programme around the highest risk areas: incident management, worker screening, and participant experience. These should be reviewed more frequently than lower risk administrative processes. Use your internal audit findings to feed into management review and drive genuine improvement, not just compliance documentation.

If you are responsible for building or improving the internal audit programme for an NDIS provider, the post on how to build an internal audit programme from scratch provides a practical framework you can adapt to this context.

Getting the Right Training for This Work

Auditing an NDIS provider effectively requires two things: solid auditing skills and genuine understanding of the disability services context. Neither alone is sufficient. An auditor who knows ISO 9001 inside out but has never worked in disability services will miss things that a sector experienced auditor would catch immediately. Equally, someone with deep sector knowledge but no formal audit training will struggle to gather and document evidence in a way that stands up to scrutiny.

If you are building your auditing skills, the ISO 9001 internal auditor and lead auditor courses at Audit Workshop provide the practical audit skills foundation you need. The training is built around real audit scenarios and practical evidence gathering, not just theory. Pair that training with genuine engagement with the NDIS Practice Standards and the Commission's guidance materials, and you will be well equipped to conduct audits that make a real difference for participants.