Common NDIS audit findings include worker screening that wasn't current on the date of service, incidents not notified or closed on time, incomplete participant files, generic progress notes, empty complaints registers, policies staff can't explain, and missing internal audit records. Each is raised as a minor or major non-conformity. Either way, you must send your auditor a corrective action plan within seven calendar days of written notification.
The closing meeting is where it lands.
The auditor reads the summary: "Major non-conformity: human resource management. Two workers delivered personal care without a verified NDIS Worker Screening Check."
From that moment, two clocks start. You have seven days to submit a corrective action plan. You have three months to close or downgrade the finding, or your auditor can't recommend certification.
This guide covers the findings auditors raise most often, what each one looks like on paper, how minor and major ratings work, and how to close each finding before the deadline.
What is an NDIS audit finding?
An NDIS audit finding is an approved quality auditor's assessment of how a provider meets each applicable NDIS Practice Standard. A non-conformity is a finding that a standard isn't fully met. It's rated either minor (an isolated gap or lower risk) or major (a systemic failure, or a risk to participants).
Auditors are independent bodies you engage and pay. They report their findings to the NDIS Quality and Safeguards Commission, and the Commission makes the final decision on your registration. The Commission's types of audits guidance explains the verification and certification pathways.
NDIS audit ratings: minor vs major non-conformity
Minor non-conformity | Major non-conformity | |
|---|---|---|
What it means | An isolated gap, or a risk that has been identified | A systemic failure, or a serious risk to participants |
Rating | 1 | 0 |
Corrective action plan due | Within 7 calendar days | Within 7 calendar days |
Deadline to close | 18 months, or it escalates to major | 3 months to close or downgrade |
Can you still be certified? | Yes, with an acceptable CAP | No, until it's closed or downgraded |
Follow-up | Checked at your next audit | Follow-up audit, desktop or on-site |
Findings that meet a standard are rated 2 (conformity), and 3 marks best practice. Three minor non-conformities within the same standard can become a major one, because the auditor reads the pattern as a systemic problem. The National Disability Services factsheet on audit reports sets out these rules in plain language.
The 8 most common NDIS audit findings
These findings come up again and again, because they're the areas auditors sample hardest. Severity depends on how widespread the problem is and how much risk it creates.
1. Worker screening not current on the date of service
A worker's check is current today but lapsed for six weeks last year, and they were rostered throughout. Unscreened workers delivering personal care is a classic major finding.
Fix: check worker screening status against each shift date, and block rostering when a check expires. See our guide to staff credential tracking.
2. Incidents notified late or never closed
Priority 1 incidents must be notified within 24 hours, and Priority 2 within 5 business days. A notification that went in on day three, or an investigation that never closed, becomes a finding.
Fix: reconcile your register against Commission notifications every month. Read SIRS compliance and our incident reporting audit guide.
3. Incomplete participant files
This covers service agreements signed after the service started, missing consent, and risk assessments that weren't updated when needs changed.
Fix: sample three files a month against the participant file checklist and the service agreement requirements.
4. Progress notes that don't show the support
"Support delivered. Client well." repeated for three months shows nothing about goals or outcomes.
Fix: tie every note to a participant goal. Our progress notes guide has examples.
5. An empty or incomplete complaints register
An empty register doesn't look like nothing went wrong. It looks like complaints aren't being captured.
Fix: record every complaint and its outcome, and show participants how to complain. See NDIS complaints management.
6. Policies staff can't explain
The policy is well written, but a support worker in an interview can't say how they'd report an incident. That gap between policy and practice is a finding in itself.
Fix: ask three workers five process questions each quarter, and retrain wherever their answers differ from the policy.
7. No working quality management system
This means no documented internal audit program, or a continuous improvement register with nothing in it.
Fix: run a quarterly internal audit and log every change it produces.
8. Restrictive practices that aren't authorised or reported
If you implement behaviour support plans, any practice used without authorisation, or left unreported, is a serious finding.
Fix: compare monthly restrictive practices reporting against the behaviour support plan.
What happens after an NDIS audit finding? The corrective action process
The auditor gives you written notice of each non-conformity, usually at or after the closing meeting.
Submit a corrective action plan within 7 calendar days. It should cover the immediate correction (fixing the instance that was found) and the corrective action (fixing the root cause).
Minor findings: the auditor can still recommend certification or verification once they've accepted your plan. You then have 18 months to close each one.
Major findings: the auditor reviews your implemented actions within three months, at a desktop or on-site follow-up. The finding must be closed or downgraded within three months of the written notice.
At your next audit, the auditor checks that the fixes are still working.
If you disagree with a finding, raise it with the auditor straight away, ideally at the closing meeting and before the report is finalised. Bring evidence, not explanations.
What is an NDIS non-compliance register?
Short answer: An NDIS non-compliance register is a provider's internal log of every non-conformity, whether it came from an external audit, an internal audit, a complaint or an incident. It records the corrective action, the owner, the due date and proof of closure. Most providers keep it as part of their continuous improvement register.
At your next audit, the register is how you show that corrective actions still work. It also helps you spot three minor findings clustering in one standard before an auditor does.
How to avoid common NDIS audit findings
Sample your own records the way an auditor would. Use our NDIS audit checklist.
Check credentials against the date of service, not today's date.
Reconcile your incident register monthly against Commission notifications.
Test staff understanding as well as policy wording.
Follow a preparation timeline. Our guide on how to prepare for an NDIS audit sets one out.
Key takeaways
Common NDIS audit findings cluster around worker screening, incidents, participant files, progress notes, complaints, staff knowledge, quality systems and restrictive practices.
Findings are rated as conformity, minor non-conformity or major non-conformity.
Every non-conformity needs a corrective action plan within 7 calendar days of written notice.
Majors must be closed or downgraded within 3 months. Minors must be closed within 18 months.
Three minors in one standard can become a major, so a non-compliance register helps you spot patterns early.
Frequently asked questions
What are some examples of common NDIS audit findings?
Common examples include:
a worker whose screening check lapsed while they were still rostered
a Priority 1 incident notified after 24 hours
a service agreement signed after the service began
progress notes with no link to participant goals
an empty complaints register
no documented internal audit program
What happens if you fail an NDIS audit?
There's no single "fail" result. The auditor raises minor or major non-conformities. You submit a corrective action plan within 7 calendar days. Majors must be closed or downgraded within 3 months before the auditor can recommend certification. The NDIS Commission makes the final registration decision.
What is the difference between a minor and major non-conformity?
A minor non-conformity is an isolated gap or a lower risk. It can be addressed over 18 months and doesn't stop certification if your corrective action plan is accepted. A major non-conformity is a systemic failure or serious risk. It must be resolved within 3 months and blocks certification until then.
What raises a red flag in an NDIS audit?
The main red flags are:
records that are slow to find
documents all created just before the audit
copied progress notes
credentials that were expired on past service dates
staff whose answers don't match written policy
What should I not say during an NDIS audit?
Avoid "we always do that" without evidence, guessing, and blaming individual staff. If a record is missing, say so, explain how you'll fix it, and show your corrective action.
Will I have to pay back NDIS money after an audit?
A quality audit finding doesn't by itself mean paying money back. Separately, the NDIA can review claims and recover payments that aren't supported by records. That's why progress notes and delivery evidence matter for both audits and claiming. See our guide to rejected NDIS claims.
How often do NDIS providers get audited?
Registered providers are audited at registration and at renewal, every three years. Certified providers also have a mid-term audit. Major non-conformities trigger follow-up audits. See NDIS registration renewal.
Close the gaps before they're written up
It sounds like the fear isn't the audit. It's hearing "major non-conformity" read out in front of your team.
Most of the findings above come from records that exist but can't be shown on demand. Start a free CareVisor trial, load your real records, and see which findings you're carrying today. No credit card is needed.
About CareVisor
CareVisor is the audit-ready operating system for Australian NDIS providers, built in Sydney by NDIS operators who have prepared for and passed Quality and Safeguards Commission audits. Worker screening, incident registers, participant files, progress notes, complaints and continuous improvement records live in one platform mapped to the NDIS Practice Standards, with a time-stamped audit trail that shows auditors when each record was created. See how it works as NDIS compliance software, and read what NDIS auditors check during the audit itself.
