An NDIS audit checklist lists the documents and evidence an approved quality auditor will check against the NDIS Practice Standards. What goes on it depends on your audit type. Verification audits cover risk, complaints, incidents and HR records. Certification audits cover the full Core Module plus any supplementary modules, across a document review and an on-site visit. Mid-term audits check that your systems still work 18 months after certification.
Most providers build their audit checklist from their policy folder.
Auditors work the other way round. They pick three participant files, three workers, three incidents and a week of shifts, and then ask you to prove each one. A policy that says "all incidents are reviewed within 24 hours" becomes a finding the moment one sampled incident took nine days.
So this checklist is built backwards, from what an auditor samples. It's split by audit type, it lists the evidence rather than the policy, and it finishes with the questions auditors actually ask, along with what to show them.
What is an NDIS audit checklist?
Definition: An NDIS audit checklist is a structured list of the records and evidence a registered provider must be able to produce during an NDIS audit, mapped to the NDIS Practice Standards. A good checklist asks "can we show it?" for each item, not "do we have a policy?"
The difference matters. Auditors assess whether your practice matches your policies. A checklist that stops at "policy exists" will miss every gap an auditor finds.
Which NDIS audit checklist do you need?
Your registration groups decide your audit type, and your audit type decides your checklist. The NDIS Commission's types of audits guidance confirms which pathway applies to you.
Verification audit | Certification audit | Mid-term audit | |
|---|---|---|---|
Who | Lower-risk supports | Higher-risk supports, such as SIL and personal care | Certified providers, 18 months into registration |
Format | Document review | Stage 1 document review, then Stage 2 on-site | A check that systems still work |
Measured against | Verification module | Core Module plus supplementary modules | Your certification scope |
Interviews | Usually not | Staff and participants | Depends on the auditor's findings |
NDIS verification audit checklist
Verification audits focus on four areas. For each one, have the evidence ready, not just the policy.
Risk management
A current risk register, reviewed within the last 12 months
Risk assessments for the supports you deliver
Current insurance certificates
Complaints management
A complaints policy participants can easily access and understand
A complaints register with outcomes and dates
Evidence that participants are told how to complain (complaints management guide)
Incident management
An incident register with follow-up actions
Reportable incidents notified on time: 24 hours for Priority 1, 5 business days for Priority 2 (SIRS compliance)
Human resource management
A current NDIS Worker Screening Check for every risk-assessed role
Qualifications and induction records for each worker
Credential expiry dates tracked (staff credential tracking)
NDIS certification audit checklist
Certification audits test the full Core Module in two stages. Supplementary modules apply if you deliver behaviour support, high intensity daily personal activities, SDA or early childhood supports.
Stage 1: document review checklist
Rights and responsibilities. Consent records, privacy procedures, and evidence of participant choice and control.
Governance and operations. Governance structure, risk register, and a quality management system with a documented internal audit program.
Information management. Record-keeping procedures that meet NDIS record keeping requirements.
Continuous improvement. A continuous improvement register with real entries and completed actions.
Provision of supports. Signed service agreements, support plans and transition procedures.
Support environment. Medication management, participant money handling and emergency plans, where relevant.
Supplementary modules. Behaviour support plans and restrictive practices reporting, plus worker competency records for high intensity supports.
Stage 2: on-site audit checklist
Participant files ready to sample. Use our participant file checklist.
Progress notes that link each shift to a participant goal. See our progress notes guide.
Staff briefed. They should be able to explain how to report an incident and handle a complaint in their own words.
Participants informed about possible interviews, and their consent recorded.
Sites walked through for safety, privacy and emergency readiness.
Recent incidents traceable from report to review to closure.
SIL providers face the heaviest Stage 2 sampling. See SIL provider compliance.
NDIS mid-term audit checklist
The mid-term audit checks that what passed at certification is still working.
Changes since certification recorded: new supports, sites or key personnel
Every corrective action from your last audit closed, with evidence
Internal audit results since certification, and what changed because of them
An incident and complaints register with no gaps or late notifications
Worker screening and credentials current for every rostered worker
For what happens next in the registration cycle, see NDIS registration renewal.
The evidence most NDIS audit checklists miss
Four items rarely appear on template checklists. Auditors find all four.
Credentials valid on the date of service, not today. A worker whose First Aid lapsed in March and was renewed in May was uncertified for every shift in between.
When each record was created. Forty incident reports all created the week before your audit raise questions.
Proof that something changed. A complaint with no matching improvement entry shows the system didn't learn anything.
How shifts were paid. SCHADS pay isn't an NDIS Practice Standard, but auditors review workforce records, and Fair Work can look back six years. Our SCHADS payroll audit guide covers what to check.
NDIS audit questions and answers: what auditors ask
The auditor asks | What to show |
|---|---|
"Walk me through your last incident." | The report, notification time, investigation and closure |
"How do you know this worker was cleared?" | Screening status on the date of each sampled shift |
"How would a participant make a complaint?" | An accessible policy and a register entry showing it works |
"How does this support connect to the participant's goals?" | Service agreement, plan and a linked progress note |
"What changed after your last internal audit?" | Findings, actions and improvement register entries |
"Who reviews your policies?" | Version dates and sign-off records |
For the full list of areas auditors examine, see what NDIS auditors check.
How to use this NDIS audit checklist
Confirm your audit type and registration groups.
Run the checklist against a real sample. Pick three participants, three workers and three incidents, the same way an auditor would.
Log each gap in the 5 C's format from our internal audit guide, which also has free schedule and report templates.
Fix the highest-risk gaps first, starting with screening and incidents.
Follow a preparation timeline. Our guide on how to prepare for an NDIS audit sets out a six-week plan and typical audit costs.
Key takeaways
An NDIS audit checklist should list evidence, not policies, because auditors test practice.
Verification audits cover risk, complaints, incidents and HR. Certification covers the full Core Module in two stages.
Mid-term audits check that corrective actions are closed and systems still work.
Check credentials against the date of service, not today's date.
Sample your own records the way an auditor would before the audit.
Frequently asked questions
What should be included in an NDIS audit checklist?
An NDIS audit checklist should include evidence for:
risk management
complaints
incidents
worker screening and credentials
participant files and service agreements
progress notes
policies
continuous improvement records
Certification checklists add governance, quality management and any supplementary modules that apply.
What are the requirements for an NDIS audit?
Registered providers must show they meet the NDIS Practice Standards that apply to their registration groups. Verification audits assess a smaller set of requirements, while certification audits assess the full Core Module plus supplementary modules. Providers engage and pay an approved quality auditor.
How often do NDIS providers get audited?
Registered providers are audited at registration and again at renewal, every three years. Certified providers also have a mid-term audit 18 months into registration. Adding new supports or a serious incident can trigger an extra audit.
How much does an NDIS audit cost?
Costs depend on your audit type, registration groups, number of sites and chosen auditor. Verification audits cost far less than certification audits. Get at least three quotes. Our audit preparation guide covers typical ranges.
What documents do I need for an NDIS audit?
Common documents include:
policies and procedures
a risk register
incident and complaints registers
worker screening and training records
participant files, service agreements and consents
progress notes
continuous improvement records
What should I expect during my first NDIS audit?
For verification, expect a document review. For certification, expect a Stage 1 document review, then a Stage 2 site visit where the auditor samples records and interviews staff and participants. Any gaps are raised as minor or major non-conformities, each with a corrective action.
Is there a free NDIS audit checklist PDF?
Yes. The checklists above can be printed or copied into your own template. CareVisor also offers a free printable version with verification, certification and mid-term sections.
Know your gaps before the auditor does
It sounds like the worry isn't the checklist. It's not knowing how many boxes you can actually tick with evidence today.
Start a free CareVisor trial, load your real records, and see your audit-readiness score on day one. No credit card is needed.
Want to start with the area most checklists skip? Book a FairWork Diagnostic for a written payroll exposure report within 3 business days.
About CareVisor
CareVisor is the audit-ready operating system for Australian NDIS providers, built in Sydney by NDIS operators who have prepared for and passed Quality and Safeguards Commission audits. Incident registers, worker screening, participant files, service agreements, progress notes and SCHADS payroll live in one platform mapped to the NDIS Practice Standards, with a time-stamped audit trail captured by default. See how CareVisor works as NDIS compliance software, or compare plans and pricing.
