An NDIS auditor walks in, sets down a laptop, and asks for one thing: your incident register from the last twelve months. Not your mission statement. Not your glossy participant brochure. The register. Within ninety seconds, they know roughly how the rest of the day will go.
That moment is the whole game. Most providers think an audit is about whether they're good people doing good work. They are usually both. But an audit doesn't measure intent. It measures evidence. The question an auditor is really asking, over and over, in fifteen different ways, is simple: can you prove it?
So let's talk about what NDIS auditors check, what makes them nervous, and how you walk into Stage 2 looking like the provider who has done this before. Even if you haven't.
Before reading further, it helps to know how an audit maps to the broader compliance framework. See the full NDIS compliance requirements for the registration, governance, and record-keeping obligations behind every audit question. Anchor: the full NDIS compliance requirements | URL: /ndis-compliance-requirements
The two audit types every NDIS provider faces
Before anyone checks anything, your audit type is decided by the support you're registered to deliver. The NDIS Commission splits this into two paths, and the difference is significant.
Verification audit | Certification audit | |
|---|---|---|
Who gets it | Lower-risk supports (e.g. gardening, basic equipment, plan management) | Higher-risk or complex supports (e.g. personal care, SIL, behaviour support) |
Depth | Document and desktop review | Two stages, including an on-site visit |
Against what | Verification module requirements | Full NDIS Practice Standards and Quality Indicators |
Rough effort | Lighter | Heavier, longer, more expensive |
The split matters because it sets the bar. A certification provider gets measured against the full NDIS Practice Standards, and that's the path where most providers feel the heat. If you deliver personal care or supported independent living, assume certification, and assume the auditor will want to watch your systems work in the real world, not just read about them.
What NDIS auditors actually check
Here's the part everyone wants the short version of. What do auditors mainly check? What shows up on an NDIS check? What do they look out for?
It comes down to four core areas under the Practice Standards, each one backed by evidence you either have or you don't:
Rights and responsibilities. Consent records, service agreements, privacy, dignity, freedom from abuse. Auditors want to see participants were informed and in control.
Governance and operational management. Your risk management, your continuous improvement log, your worker screening, your complaints handling. This is where "we've always done it this way" goes to die.
Provision of supports. Are supports planned, delivered, and reviewed against each participant's goals? Show the plan. Show the review. Show the signature.
Support environment. Safe premises, safe equipment, infection control, emergency planning.
Underneath those headings, auditors sample specific records. Expect them to pull:
Your incident register and notifications (timely, complete, investigated)
NDIS Worker Screening Check verification for every risk-assessed role
Staff training and induction records
Participant files, including service agreements and consent
Your complaints register and how you closed each one
Evidence of continuous improvement, not just a policy that mentions it
A pattern emerges fast. Auditors are not hunting for one catastrophic failure. They're testing whether your paperwork and your practice tell the same story. When they don't, that's a finding.
Insert image here: a clean, labelled diagram of the four Practice Standards areas with the evidence each one demands. Alt text: "What NDIS auditors check: the four NDIS Practice Standards areas and the evidence required for each."
Stage 1 versus Stage 2: what happens when they arrive
For certification providers, the audit runs in two acts.
Stage 1 is the desktop review. The auditor reads your policies, procedures, and systems. Think of it as the dress rehearsal where they decide whether you're ready for opening night. If your documents are missing or contradict each other, they'll flag it here and you'll be fixing things before Stage 2 even starts.
Stage 2 is the on-site audit, and it's the one people lose sleep over. This is where the auditor stops reading and starts watching. They interview staff. They may speak with participants (with consent). They walk your premises. They ask a support worker a question your policy already answers, then check whether the worker's answer matches the policy. What is Stage 2 of the NDIS audit, in one line? It's the moment your written system meets your actual operation, in front of someone trained to spot the gap.
You'll also see generic audit theory floating around online: the "7 audit procedures," the "5 stages of an audit," the "5 C's of audit" (Criteria, Condition, Cause, Consequence, Corrective action). Those come from financial and internal-audit frameworks. They're useful background for how auditors write up a finding, but they aren't the NDIS process. Don't study them instead of the Practice Standards. The Practice Standards are the exam.
The red flags that quietly fail NDIS audits
What does it take to fail? Rarely one dramatic thing. Usually a stack of small, boring ones. Here are the red flags auditors look for, drawn from the patterns that show up again and again:
Late or missing incident notifications. A Priority 1 incident logged six days after a 24-hour deadline is the fastest way to turn a good day bad.
Worker screening gaps. One staff member in a risk-assessed role without a verified clearance is a serious non-conformity, full stop.
Policy and practice mismatch. Your policy says one thing. Your staff do another. Auditors catch this in interviews within minutes.
No continuous improvement evidence. A register with no entries says nothing's gone wrong, which auditors read as nothing's being recorded.
Spreadsheet chaos. Registers in Excel where rows can be quietly deleted and nobody can prove what changed, or when.
Thin participant files. Service agreements missing, consent undated, goals never reviewed.
For a longer, practical walk-through of preparation, this step-by-step NDIS audit guide is a solid companion read. Pair it with a hard look at your own register tonight.
Insert image here: a "red flag" infographic ranking the most common audit failures by severity. Alt text: "NDIS audit red flags: the most common non-conformities that fail providers, ranked by severity."
Incident notifications are one of the most common audit findings. For the deeper breakdown, including the six register fields auditors check first and the SIRS Priority 1 and Priority 2 timeframes, read the NDIS Incident Reporting Audit guide. Anchor: the six register fields auditors check first
What not to say during an audit (and how to actually impress one)
This is the part nobody writes down, so let's be honest about it.
What not to say: "We've never had a complaint." Auditors don't hear flawless. They hear we're not capturing them. Also avoid "I'm not sure, that's [someone else]'s area" without a path to the answer, and never, ever "we'll sort that out before you leave." That last one tells them the system only works when watched.
How to impress an auditor? Be the provider who finds your own gaps before they do. Say "we identified that in our last internal review, here's the corrective action and the date we closed it." That single sentence does more for you than a wall of certificates. Auditors trust providers who audit themselves. It signals a living system, not a panic-cleaned office.
A quiet truth: confidence reads as competence, but only when it's backed by the record. Walk them to the evidence. Don't narrate around it.
How often you get audited, and what it costs
How often do NDIS providers get audited? Your registration runs for up to three years, and the rhythm usually looks like this:
Stage | When | What it is |
|---|---|---|
Initial audit | At registration | You prove you're ready to deliver |
Mid-term audit | Roughly midway (certification) | A check that you're still compliant in practice |
Renewal audit | Before your registration expires | A full reassessment to re-register |
Add unscheduled scrutiny if a serious incident or a complaint triggers the Commission's attention. There is no NDIS "2-year rule," by the way. That phrase belongs to financial and tax audits, as does "what triggers an ATO audit." They surface in NDIS searches because the word audit is doing a lot of work across very different worlds.
What do NDIS auditors charge? Audits are conducted by approved quality auditors, which are commercial bodies, so fees vary by your size and the number of registration groups you hold. Verification audits can sit in the hundreds to low thousands. Certification audits for larger providers can run into several thousand and beyond. It's a business cost, and it's far cheaper than losing registration.
One area providers underestimate is billing and claiming compliance, including travel. If you charge for travel, the rules are specific and easy to get wrong, and they intersect with the financial records, auditors, and the NDIA review. This guide on NDIS travel charging rules is worth a read before your next claim run.
Your pre-audit checklist (and the "am I in trouble?" question)
First, the question on everyone's mind: am I in trouble if I get audited? No. An audit is routine, not an accusation. Most providers pass. The ones who struggle are usually the ones who treated compliance as a once-a-year scramble rather than a habit.
Here's how to prepare for an NDIS review without the all-nighter:
Reconcile your incident register against your Commission notifications. Every reportable incident lodged, on time, investigated, closed.
Verify every worker screening clearance for risk-assessed roles. No exceptions, no "pending."
Pull ten random participant files. Service agreement, consent, current goals, recent review. If any are thin, fix them now.
Open your continuous improvement log. If it's empty, start it today with real entries.
Sit a staff member down and ask them your own policy questions. If their answer surprises you, that's your gap.
Confirm your policies are dated, version-controlled, and signed by your Authorised Executive Officer.
If you want the deeper version, our NDIS incident reporting audit guide breaks down the register fields auditors check first, and the full NDIS audit checklist covers the rest of the Practice Standards.
What NDIS auditors check, stripped of the jargon, is whether your evidence and your everyday practice agree. The providers who breeze through aren't the ones with the prettiest policies. They're the ones who can put their hands on proof in under a minute, because their system captures it as they work, not the night before.
That's the difference between a record-keeping system and an audit-ready one.
CareVisor was built for the second kind. Every incident, every shift, every credential logs audit evidence by default, and a live dashboard shows you the gaps before an auditor ever does. Start a free 7-day trial, bring your real data, and see your audit-readiness score on day one. Ahmed will personally walk you through the results before your week is up.
For a longer walk-through covering every NDIS Practice Standards area, including the kinds of questions auditors ask in Stage 2 interviews, see the full NDIS audit checklist.
If you have 6 weeks to your renewal audit, work through our step-by-step NDIS audit preparation guide to triage the gaps with the highest finding risk first
Quick FAQ
What questions are asked during an audit?
Expect questions that test whether staff know your policies in practice: how they report an incident, how they handle a complaint, how they protect participant rights and consent.
What shows up on an NDIS check?
Your registered supports, audit history, any conditions or compliance actions, and whether your worker screening and key records are current.
How do you impress an auditor?
Show them you find and fix your own gaps. A documented internal review with closed corrective actions beats a flawless-looking file every time.
About CareVisor
CareVisor is the audit-ready operating system for Australian NDIS providers, built in Sydney by NDIS operators who have prepared for and passed Quality and Safeguards Commission audits firsthand. Every workflow maps to the NDIS Practice Standards. What NDIS auditors check, including your incident register, worker screening verifications, service agreements, SCHADS payroll calculation order, and continuous improvement evidence, is captured by default with a time-stamped audit trail. Used by providers from Sydney to Perth, CareVisor turns audit preparation from a once-a-year scramble into a daily operational habit. Start your free 7-day audit-readiness trial at carevisor.com.au.
