An NDIS quality management system (QMS) is the set of policies, registers and review routines a registered provider uses to check its supports are safe and keep improving. Under the NDIS Practice Standards Core Module, it must be proportionate to your size and the supports you deliver. It must include a documented program of internal audits, and it must use outcomes, risk data and feedback from participants and workers to drive continuous improvement.
The auditor asks to see your quality management system.
You hand over a 40-page policy manual. It’s well written. Version controlled. Signed by the director.
The auditor flips through it, closes it, and asks one more question: “Show me one thing that changed in the last six months because of this system.”
That’s the question the whole standard rests on. A QMS isn’t a document. It’s evidence that your organisation notices problems and fixes them. This guide shows what the standard actually requires, the eight parts of a working QMS, how one complaint moves through it, and a checklist to test your own.
What is an NDIS quality management system?
An NDIS quality management system is how a provider plans, checks and improves the quality of its supports. It connects your quality policy, risk register, internal audits, complaints, incidents and improvement actions, so a problem found in one place leads to a recorded fix in another.
The requirement sits in the NDIS Practice Standards Core Module, under provider governance and operational management. The NDIS Commission’s Core Module standards set the outcome: every participant benefits from a QMS that is relevant and proportionate to the provider’s size and scale, and that promotes continuous improvement of support delivery.
“Proportionate” matters. A 12-person provider doesn’t need the same system as a 400-staff SIL organisation. It does need a system that works, with evidence to show it.
What does the NDIS quality management standard require?
The standard has three quality indicators. Here’s what each one means and what an auditor will ask to see.
Quality indicator | What it means in practice | Evidence the auditor asks for |
|---|---|---|
1. A QMS that is maintained, defines how you meet legislation and the standards, and is reviewed as required | Your system is written down, current and mapped to your obligations | Quality policy, a document register with review dates, minutes from quality meetings |
2. A documented program of internal audits, proportionate to your size and supports | You test your own practice on a schedule | Internal audit schedule, completed audit reports, actions raised |
3. Continuous improvement using outcomes, risk data, evidence-informed practice and feedback from participants and workers | Feedback and data lead to changes | Continuous improvement register entries linked to complaints, incidents and audits |
Is a QMS mandatory?
Yes, for providers audited against the Core Module, which is the certification pathway for higher-risk supports such as SIL and personal care. Verification-only providers aren’t assessed against this standard, but a light version still makes the risk, complaints and incident checks they are audited on much easier.
The 8 parts of a working NDIS quality management system
Part | What it does | Our guide |
|---|---|---|
Quality management policy | States how you plan, check and improve quality | (see below) |
Risk register | Lists risks to participants, workers and the organisation, with controls | Part of how to prepare for an NDIS audit |
Internal audit program | Tests practice against your policies on a schedule | |
Complaints system | Captures, resolves and learns from complaints | |
Incident management | Records, investigates and reports incidents, including SIRS | |
Continuous improvement register | Logs every improvement, its source, owner and outcome | |
Document and information control | Keeps policies current and records accurate and confidential | |
Workforce competence | Confirms workers are screened, trained and qualified |
What should an NDIS quality management policy include?
Keep it to three or four pages. A useful quality management policy covers:
who is accountable for quality (usually a director plus a named quality lead)
how feedback, complaints, incidents and audit findings feed into improvement
your internal audit schedule and how findings are tracked to closure
how often policies are reviewed, and who signs them off
how participants and workers are involved in improving services
National Disability Services’ quality management guide is a useful second reference when you draft yours.
NDIS quality improvement plan vs continuous improvement register
A quality improvement plan sets the year’s priorities, for example “cut late incident notifications to zero” or “move progress notes onto the mobile app”. The continuous improvement register is the running log of every individual change. The plan points the direction, and the register proves you’re moving.
How a QMS works in practice: one complaint, start to finish
Back to the auditor’s question: “Show me one thing that changed.” Here’s what a good answer looks like.
Complaint. A participant’s mother says three different workers turned up in one week and none knew her son’s routine.
Logged. It’s recorded in the complaints register the same day and acknowledged in writing.
Root cause. The rostering coordinator was filling gaps with whoever was free, because nobody had defined continuity rules.
Change. You add a rule: no more than two regular workers per participant without a documented reason. The rostering procedure is updated, with a new version number.
Briefing. Coordinators are briefed and sign off on the change.
Re-test. Next quarter’s internal audit samples five participants for worker continuity.
Closed. The improvement register entry is closed, with the audit result attached.
That’s one complaint, seven linked records and a clear answer for the auditor. A QMS that can’t produce a chain like this is just a folder.
How to build an NDIS quality management system for a 10 to 50 staff provider
Name a quality lead. One person owns the system, even if it’s only part of their role.
Write the quality management policy. Use the five points above.
Set up the registers. You need a risk register, complaints, incidents and continuous improvement. Wherever possible, keep them in one place.
Schedule internal audits. A quarterly cycle works well. Our internal audit guide has a ready-made schedule.
Hold a monthly quality meeting. Allow 30 minutes to review new complaints, incidents and open actions.
Run an annual management review. Check whether the system itself is working, and update the quality improvement plan.
Rhythm | What happens |
|---|---|
Daily | Complaints and incidents logged as they happen |
Monthly | Quality meeting: review new entries, overdue actions and trends |
Quarterly | Internal audit of one or two areas |
Annually | Policy review, management review, new quality improvement plan |
The standard itself only says the system is “reviewed and updated as required”. It doesn’t set fixed frequencies. A written rhythm like this shows an auditor that review is planned, not accidental.
NDIS quality management system checklist
A current quality management policy, signed and dated
A named person accountable for quality
A risk register reviewed within the last 12 months
An internal audit schedule, with completed reports for the last cycle
A complaints register with outcomes, including complaints from participants and families
An incident register reconciled against SIRS notifications
A continuous improvement register where each entry shows its source
Policy versions and review dates tracked in one document register
Worker screening and training current for every rostered worker
Minutes from at least three recent quality meetings
At least one improvement you can trace from trigger to closure
Common QMS problems auditors find
A policy with no evidence. The manual describes a system nobody uses.
Empty registers. A complaints register with nothing in it suggests complaints aren’t being captured.
Audits with no follow-up. Findings are raised but never closed or re-tested.
Improvements that come from nowhere. Register entries that don’t say what triggered them.
Workers who don’t know the process. A support worker can’t explain how to report a complaint.
Each of these can become a non-conformity. See common NDIS audit findings for how they’re rated, and what NDIS auditors check for how they sample.
Spreadsheets or software for your QMS?
Spreadsheets and folders | NDIS compliance software | |
|---|---|---|
Cost | Free | Monthly subscription |
Linking a complaint to its improvement | Manual cross-referencing | Linked records |
Proof of when records were created | Easy to question | Time-stamped automatically |
Best for | Very small providers | Providers with 10+ staff or certification audits |
Spreadsheets can work if you’re disciplined. The weak point is the chain: an auditor wants to follow one complaint through to its fix, and separate files make that slow. NDIS compliance software keeps those links in one place. If you’re facing certification or a mid-term audit, that difference shows quickly.
Key takeaways
An NDIS quality management system shows that your organisation notices problems and fixes them.
The Core Module requires a proportionate QMS, a documented internal audit program and continuous improvement driven by data and feedback.
A working QMS has eight parts, from the quality policy through to workforce competence.
Auditors test the chain: trigger, root cause, change, re-test, closure.
A monthly, quarterly and annual review rhythm proves the system is alive.
Frequently asked questions
What is an NDIS quality management system?
It’s the policies, registers and review routines a provider uses to keep supports safe and improving. Under the NDIS Practice Standards, it must be proportionate to your size and supports, include internal audits, and use feedback and data to drive continuous improvement.
Is a quality management system mandatory for NDIS providers?
Yes, for providers audited against the Core Module, which is the certification pathway for higher-risk supports such as SIL. Verification-only providers aren’t assessed against the Quality Management standard, though they’re still audited on risk, complaints, incidents and HR.
What are the NDIS quality standards?
The NDIS Practice Standards set the quality requirements for registered providers. The Core Module covers rights, governance and operational management, provision of supports and the support environment. Supplementary modules apply to specialised supports such as behaviour support.
Where can I find the NDIS quality standards PDF?
The NDIS Quality and Safeguards Commission publishes the NDIS Practice Standards and quality indicators on its website, including a downloadable version. Always use the Commission’s current version rather than a copy saved years ago.
What should an NDIS quality management policy include?
It should name who is accountable for quality and explain how complaints, incidents and audit findings feed into improvement. It should also set your internal audit schedule, say how often policies are reviewed, and describe how participants and workers help improve services.
How often should an NDIS QMS be reviewed?
The standard says “reviewed and updated as required” and sets no fixed frequency. A practical rhythm is a monthly quality meeting, quarterly internal audits and an annual management review.
Can a small NDIS provider maintain a quality management system?
Yes. The standard is explicitly proportionate. A small provider can run a QMS with a short policy, four registers, a quarterly internal audit and a 30-minute monthly review, as long as each step leaves evidence.
How can participants report quality issues with an NDIS provider?
Participants can complain to the provider first, using its complaints process. They can also contact the NDIS Quality and Safeguards Commission, which handles complaints about the quality and safety of NDIS supports.
Answer the auditor’s question before it’s asked
It sounds like the worry isn’t writing a quality policy. It’s not knowing whether you could trace even one complaint through to a real change today.
CareVisor keeps complaints, incidents, internal audits and improvement actions linked and time-stamped, so the chain is already there when an auditor asks. Start a free trial and test it with one real complaint. No credit card is needed.
Want to start with your payroll risk instead? Book a FairWork Diagnostic for a written payroll exposure report within 3 business days.
About CareVisor
CareVisor is the audit-ready operating system for Australian NDIS providers, built in Sydney by NDIS operators who have prepared for and passed Quality and Safeguards Commission audits. Complaints, incidents, internal audits, continuous improvement, worker screening and SCHADS payroll live in one platform mapped to the NDIS Practice Standards, with a time-stamped audit trail that turns your quality management system into evidence. Use our NDIS audit checklist to see where you stand today.
