NDIS Audit Preparation: The 2026 Provider Checklist

The short version

An NDIS audit is an approved quality auditor checking your business against the NDIS Practice Standards. You pay for it, you pick the auditor, and the NDIS Commission makes the registration decision off the back of the auditor's report.

• Low risk supports get a verification audit. It's a desk review of documents against four standards: risk, complaints, incidents and HR.
• Higher risk supports get a certification audit. That's two stages: a desk audit, then a site audit with staff and participant interviews.
• Certification providers also face a mid-term audit that has to start within 18 months of registration.
• 2026 added new rules. SIL and NDIS digital platform providers must now be registered, SIL has its own Practice Standards module, and two big auditors left the market.

Everything below is sourced to the NDIS Commission or the Federal Register of Legislation unless we say otherwise. This is general information, not legal advice.

Certification or verification: which audit you need

The NDIS (Provider Registration and Practice Standards) Rules 2018 list every class of supports, the standards that apply to it and the assessment method.

Source: Rules, section 20 table. If you deliver supports that use, or may use, a regulated restrictive practice, you also need Module 2A, assessed by certification, whatever your other classes are (Rules, section 20(1)(b)). Government providers are always assessed against the Core module by certification (Rules, section 22).

If even one of your classes needs certification, your audit is a certification audit. A certification audit also satisfies any verification requirement (Rules, section 23).

When you submit your application, the Commission emails you an "Initial scope of audit" document. It confirms your audit type, registration groups, the standards that apply and what to give your auditor (NDIS Commission, Apply for registration). Treat that document as the final word on scope.

The Practice Standards modules

These are the current module names in the compiled Rules in force from 1 July 2026 (Rules, Schedules 1 to 8):

Auditors must take the Quality Indicators Guidelines into account when they assess you (Rules, section 24). Those indicators are the closest thing to the auditor's checklist, and they were updated on 1 July 2026 to add the SIL indicators (Quality Indicators Guidelines, Compilation 3). Read them before you write a single policy.

How the audit runs, step by step

1. Application and self-assessment

You apply in the Commission's Applications Portal: registration groups, a self-assessment against the Practice Standards with evidence, and suitability questions about you and your key personnel. Finish within 60 days or it gets deleted (NDIS Commission, Apply for registration).

Write the self-assessment yourself. The Commission says responses must be specific to your organisation, "not a direct copy of purchased documents". If they're not, it can refuse the application or impose a condition requiring a fresh certification audit (NDIS Commission, Apply for registration).

Get key personnel and risk-assessed workers screened first: the Commission checks their clearances during the application (Apply for registration).

2. Choosing an approved quality auditor

Only approved quality auditors can do the audit, and they are not part of the Commission. Auditors give free, no-obligation quotes, and the Commission recommends getting more than one (NDIS Commission, The quality audit process).

Fewer auditors are taking work. QIP stopped NDIS verification and certification audits on 30 April 2026 (QIP). Citation Certification wound up all NDIS audit activity on 30 June 2026 (Citation Certification). Book early.

3. Stage 1: desk audit

Stage 1 is an off-site review of your self-assessment, your documents and any past audit findings. A verification audit is Stage 1 activity only (Approved Quality Auditors Scheme Guidelines, sections 12 to 14).

The auditor must send you the Stage 1 findings at least one week before Stage 2, or two weeks if they suspect a non-conformity. If you're clearly not ready, they tell the Commission Stage 2 will be delayed (AQA Guidelines, section 14).

4. Stage 2: site audit

Stage 2 should start within three months of Stage 1 finishing (AQA Guidelines, section 14(3)). Expect an opening meeting, governance interviews, staff file sampling, private participant interviews, observation of supports, and a walk through at least one incident from report to close (NDIS Commission, The quality audit process).

Sampling rules worth knowing (AQA Guidelines, Annex B):

• Opt-out. You must tell every participant they are automatically in the audit. If someone opts out, record it and tell the auditor.
• Sample size. For certification, at least the square root of your participant count, rounded up. 32 participants means 6 files and 6 interviews.
• No cherry-picking. You can't pre-select the workers, participants or files.
• Problems grow the sample. Each non-conformity found adds to it, to test for a system failure.

5. Report and decision

The auditor sends the report to the Commission within 14 days of a verification audit and 28 days of a certification or mid-term audit (NDIS Commission, The quality audit process). The Commission then assesses your suitability and decides. Registered providers are "generally registered for three years" (NDIS Commission, About registration).

New providers with no participants yet get a provisional audit, and may need a further Stage 2 once they start delivering (AQA Guidelines, section 27).

6. Mid-term, renewal and other audits

• Mid-term audit. Certification providers must start one no later than 18 months into the registration period. It covers the Core module's governance and operational management standards, anything that needed a corrective action plan, and anything else the Commission names (Rules, section 13B). The Commission suggests engaging your auditor at 12 months (NDIS Commission, The quality audit process). Individuals or partnerships whose only certification class is early childhood, SDA-only providers and transitioned providers are exempt.
• Renewal. You can start any time in the 6 months before expiry. Start before expiry and your registration stays valid until the decision. Start after and it has lapsed (NDIS Commission, Renew your registration).
• Condition and out of cycle audits. The Commission can order an audit at any time, and you can request one to add registration groups (NDIS Commission, The quality audit process).

Ratings and non-conformities

Every standard and quality indicator gets a rating (NDIS Commission, The quality audit process):

The clock rules are tight (AQA Guidelines, Annex C):

• You must give the auditor a corrective action plan within 7 calendar days of written notice of any non-conformity.
• A major must be downgraded or closed within 3 calendar months. At a mid-term or recertification audit, missing that deadline means automatic suspension of the auditor's certification decision.
• A minor must be closed by the mid-term or recertification audit (whichever comes first) and within 18 calendar months, or it escalates to a major.
• A major can't lead to certification, but a minor can, if you show an acceptable corrective plan first (AQA Guidelines, section 16).

What auditors ask for, area by area

The Commission says auditors want to see real examples, such as incident reports, complaints records, training logs and supervision notes, not just the policy (NDIS Commission, The quality audit process). Here's what the rules and indicators point to.

The Commission's own audit case study shows the auditor tracing one incident from first report through internal review, actions and notification, then checking restrictive practices were properly authorised (NDIS Commission, The quality audit process). Pick a real incident and do that trace yourself before they do.

Indicative costs and timeframes

There is no fee to register with the Commission. You pay the auditor, and the Commission "doesn't set prices for audit services". Cost depends on your size and participant numbers (NDIS Commission, The quality audit process).

We couldn't find any official figures. These ranges are indicative, from industry sources that don't publish their method, and they disagree:

Sources: Provider Plus, LMS Compliance Services.

The timeframes that are set in the rules or by the Commission:

Sources: as cited in the sections above, plus Rules, section 13BA. The Commission gives no total processing time; it depends on your size and supports (Apply for registration).

Common non-conformities

The Commission doesn't publish a ranked list. Its case study ends with a minor non-conformity for incomplete documentation and an improvement opportunity on participants' awareness of complaints (NDIS Commission, The quality audit process). Industry write-ups keep naming the same problems (FlowLogic; LMS Compliance Services):

• Policies that don't match practice.
• Worker screening gaps for people in risk-assessed roles.
• Incident logs with holes: no follow-up, no trend review.
• Complaints with no paper trail to an outcome.
• Risk registers untouched since the last audit.
• Staff files missing qualifications or induction records.

Watch screening this year in particular. The first NDIS worker screening checks were issued from February 2021 and started expiring from February 2026, because clearances last up to 5 years (NDIS Commission, Worker screening; Renewal cycle FAQs).

What changed in 2026

Confirmed:

• SIL must be registered. From 1 July 2026 you must be registered to provide assistance with supported independent living, assessed by certification against the Core module and the new Module 5A (Amendment Rules F2026L00802). The new registration group is 0138 (NDIS Commission, SIL mandatory registration).
• SIL transition. Registered providers already holding the shared living class must meet Module 5A from 1 July 2026 while the Commission decides whether to add SIL to their registration. Unregistered providers already delivering SIL had to apply before 1 October 2026 to keep going until a decision; those that didn't had to be registered from 1 October 2026 (Amendment Rules, transitional section 32). The Commission says delivering SIL unregistered carries a maximum penalty of 2 years' imprisonment, 120 penalty units, or both (NDIS Commission, SIL mandatory registration).
• Digital platforms must be registered and certified against the Core module. Extra conditions on checking and displaying worker screening, banning orders and credentials apply from 1 January 2027 (Amendment Rules F2026L00802).
• Change of ownership. Notice is due by the earlier of when you know the change will happen or when a necessary step occurs. Certification providers whose governance changes significantly must start a change of ownership audit within 3 months (Rules, sections 13A and 13BA).
• Stronger Commission powers. The NDIS Amendment (Integrity and Safeguarding) Act 2026 received Royal Assent on 8 April 2026 and expands the Commission's powers to detect, prevent and respond to breaches (NDIA, Integrity and safeguarding).

Not decided yet:

• The wider Practice Standards review. Public consultation, run with KPMG, closed on 14 November 2025, and it asked about a new NDIS Quality Framework. As at September 2026 the Commission says it is "considering feedback" for next steps (NDIS Commission, Practice Standards reform). For now, the Core module and other modules still apply as written. Ignore anyone selling "the new standards" as law.

A practical checklist

Where software helps, and where it doesn't

No system passes an audit for you. What helps is having the evidence in one place with dates on it, instead of chasing it across inboxes the week before Stage 2. Orangised keeps the incident, ABC, client and organisational risk, continuous improvement and feedback registers together. It sends admins reminders before staff checks and risk reviews fall due, and your auditor can get a read-only login, set up by Orangised support, to go through the registers, risk assessments, participant records and documents.