Getting ready for an NDIS audit: what to have on file

An NDIS provider needs four piles of records for an audit: policies and governance papers, worker records, participant records, and records of what happened, meaning incidents, complaints and restrictive practices. An auditor checks whether your practice matches what your policies promise, and your records are the only evidence of that. The test is whether you can find it.

In short

• An NDIS audit needs policies and governance papers, worker records, participant records, and incident, complaint and restrictive practice records, all dated and findable.
• The NDIS Practice Standards set what you must have in place, in the Provider Registration and Practice Standards Rules 2018, as at October 2026.
• A certification audit covers the Core module plus any extra modules. A verification audit is the shorter check for lower risk supports.
• Audit evidence is weakest where the work got done and nobody wrote down that it got done.
• List every standard that applies, then name the record that proves each one. The gaps on that list are your work.

What documents an NDIS provider needs for an audit

An NDIS provider needs every document the applicable NDIS Practice Standards ask it to have, plus the records that show those documents are used. It helps to sort them into four piles.

Policies and governance

The Core module of the Practice Standards covers provider governance and operational management, including governance and operational management, risk management, quality management, information management, complaints management and resolution, incident management, human resource management, continuity of supports, and emergency and disaster management (Schedule 1, Part 3 of the Rules, as at October 2026). So have on file:

• your governance arrangements and who holds which responsibility, including key personnel;
• your risk register and how risks are reviewed;
• your continuous improvement record, which is what quality management looks like in practice;
• your information management and privacy procedures, including how records are stored and who can see them;
• your complaints procedure and your incident management procedure;
• your emergency and disaster plan, and evidence it has been tested or reviewed.

Worker records

Human resource management is a Core module standard, so an auditor will sample worker files. Expect to show, for each worker sampled, their screening check, their role description, their induction, the training they have done, and their supervision or performance records. Where a support needs a particular skill, the file should show that the worker has it.

Participant records

Participant records are the pile auditors read most closely, because the standards on provision of supports run through them: access to supports, support planning, service agreements, responsive support provision, and transitions to and from a provider (Schedule 1, Part 4 of the Rules, as at October 2026). For a sampled participant, be ready to show the service agreement, the support plan and its reviews, consent records, progress notes, and the record of any change the participant asked for and what you did about it.

If the participant receives supports covered by an extra module, the module's own records come with them. Module 1 covers high intensity daily personal activities. Module 2 and Module 2A cover specialist behaviour support and implementing behaviour support plans. Module 3 covers early childhood supports, Module 4 specialised support coordination, Module 5 specialist disability accommodation and Module 5A assistance with supported independent living (Schedules 2 to 7A of the Rules, as at October 2026).

Records of what happened

This is the pile that decides most audits. An auditor wants to see that something happened, that you recorded it, that you acted, and that you closed it out. That means your incident records, your complaints register, your restrictive practices records and your record of notices you gave the Commissioner. The incident management rules set both the documentation and record keeping requirements for an incident management system and the record keeping requirements for reportable incidents (rules 12 and 25 of the National Disability Insurance Scheme (Incident Management and Reportable Incidents) Rules 2018, as at October 2026). If restrictive practices are part of your service, our post on restrictive practices and what NDIS providers must record and report sets out that paperwork in detail.

What the NDIS quality audit process involves

The NDIS quality audit process is an independent audit against the NDIS Practice Standards that apply to your registration. The NDIS Commission uses the auditor's report when it decides on provider registration.

In practice the audit runs in stages: you engage an auditor, the auditor reviews your documents, then the auditor visits or meets your people, samples participant and worker files, and usually speaks with participants or their families with consent. The auditor writes up findings, you respond to any that need correcting, and the report goes to the Commission.

Registration is not a single event either. The Rules provide for a mid-term audit for certain providers, and for a change in ownership audit for certain providers (rules 13B and 13BA, as at October 2026). The Rules also require a provider to give the Commissioner notice of certain changes and certain events (rules 13 and 13A, as at October 2026). Keep a record of every notice you sent and when, because an auditor may ask for it.

Certification audit or verification audit: which applies

A certification audit is the fuller assessment, used for higher risk supports. A verification audit is the shorter, mostly desktop assessment used for lower risk supports.

A certification audit covers the Core module plus every extra module that matches the supports you deliver. A verification audit checks a defined set of requirements rather than the whole Core module. Which one applies to you is set by the class of supports you are registered for, under rule 20 of the Rules, which deals with the applicable standards and the assessment process, as at October 2026. Two further points are worth knowing: the Rules define what certification means (rule 5), and assessment by certification meets a requirement to be assessed by verification (rule 23), as at October 2026.

The practical difference is how much evidence you prepare. A verification audit leans on your core documents and your worker records. A certification audit adds site visits, participant interviews and file sampling, so it exposes the gap between a written policy and the daily habit much more sharply.

How long to keep records, and where they sit

An NDIS provider keeps each record for as long as the rule covering that record requires. Participant records should sit where your staff can retrieve them in minutes, not hunt for them.

Information management is a Core module standard in its own right (Schedule 1, clause 12 of the Rules, as at October 2026), and the incident rules set their own record keeping requirements for incident and reportable incident records (rules 12 and 25 of the Incident Management and Reportable Incidents Rules, as at October 2026). Retention periods differ by record type and can change, so check the current requirement for each type against the rules linked under Sources rather than applying one blanket period to everything.

Two habits make retrieval easier. First, one place per participant, so a file does not live half in a folder and half in someone's email. Second, a dated audit trail on anything that is reviewed, because a plan review with no date proves nothing happened.

Getting your evidence ready

The fastest preparation is a single list: every standard that applies to your registration, and beside each one the record that proves it, where it lives and who owns it. Build that list first, because it turns a vague worry into a short set of named gaps.

A few checks worth running early:

• Pick two participants at random and try to assemble their full file in ten minutes. Whatever you cannot find, the auditor will not find either.
• Read your complaints and incident registers end to end, looking for entries opened and never closed.
• Check that the version of each policy on your shelf is the version your staff actually follow.
• Confirm your notices to the Commissioner are recorded somewhere other than one person's memory.

Plain reporting helps: a count of open incidents, plan reviews falling due, and worker checks approaching expiry, up to date as of the last load. MERIT Lumina can connect to the exports a provider already produces and show those counts on one screen, as described on our NDIS page and in our FAQ. The point is not the screen. The point is that nobody should discover an overdue plan review during an audit.

Common questions

What is the NDIS quality audit process?

The NDIS quality audit process is an independent audit of a provider against the NDIS Practice Standards that apply to its registration. The auditor reviews documents, meets staff, samples participant and worker records and reports findings, and the NDIS Commission uses that report when it decides on registration.

What is the difference between a certification audit and a verification audit?

A certification audit is the fuller assessment for higher risk supports and covers the Core module plus any applicable modules, usually with a site visit and participant interviews. A verification audit is the shorter assessment for lower risk supports and checks a narrower set of requirements, mostly from documents. Rule 20 of the Rules sets which process applies to which class of supports, as at October 2026.

What do the NDIS Practice Standards require a provider to keep on file?

The NDIS Practice Standards require a provider to keep the documents and records that evidence each applicable standard, including governance, risk, quality and information management records, complaints and incident records, human resource records, and participant records covering access, support planning, service agreements and transitions (Schedule 1 of the Rules, as at October 2026).

How long should an NDIS provider keep participant records?

Retention depends on the record. The Practice Standards require a provider to manage and store records securely, and separate rules set record keeping requirements for incidents and reportable incidents. Check the current period for each record type in the rules linked under Sources, as periods and rules change.

Who carries out an NDIS provider's audit?

An independent auditor approved for NDIS audits carries out the audit, not the NDIS Commission itself. The provider engages the auditor, and the auditor's report goes to the Commission, which makes the registration decision. The Commission publishes which auditors are approved, so confirm an auditor's current standing before you engage one.

Sources

• National Disability Insurance Scheme (Provider Registration and Practice Standards) Rules 2018, as at October 2026
• National Disability Insurance Scheme (Incident Management and Reportable Incidents) Rules 2018, as at October 2026