Search for an NDIS audit checklist and you will meet the same list on every result. Policies, registers, staff files, service agreements. The list is right, it is settled, and the regulator gives it away for free.
What those pages leave out is what happens to each item once the auditor has it. Your audit does not hand back a pass or a fail. It gives each Practice Standard and each quality indicator a mark, out of four. One of those four ratings stops your registration where it stands.
This article gives you the list, grouped by what each paper has to prove. Then it gives you the scale each item is marked against, and the clocks that follow. It also covers the parts no folder can close.
This is general information, not legal advice. Where a rule affects your registration, read the source and take your own advice.
Key takeaways – An NDIS audit does not return a pass or a fail. Every Practice Standard is rated from 3 down to 0. – A single 0 freezes your registration and starts a three month clock. Nothing progresses until it is closed. – The list of papers is public and settled. Providers fail on proof they use them, not on the papers. – A certification audit runs in two stages, and stage 2 has to happen within three months of stage 1. – Two large auditors left the market in 2026, just as new rules pushed a wave of SIL providers into the queue.
What your auditor is actually producing
Your audit report marks how well you meet each NDIS Practice Standard and quality indicator. Those marks go to the Commission. The scale has four points (NDIS Quality and Safeguards Commission, retrieved 2026-08-11):
- 3 conforms with elements of best practice
- 2 conforms with the NDIS Practice Standards
- 1 is a minor non-conformity
- 0 is a major non-conformity
A major non-conformity is a mark of 0 against any standard. The gap between 1 and 0 is the gap between a nuisance and a full stop.
A major non-conformity gives you three months to fix the issue. Your registration goes nowhere until you have fixed it and finished the audit. A minor non-conformity gives you longer, and you carry on while you deal with it.
For example, take a risk register with no entries since its last review, two years back. It reads as a 1. The same register, reviewed inside the last 12 months and carrying dated entries that name who acted, reads as a 2. Those readings are ours, not the regulator’s. How auditors give the marks sits in Annex B of the Approved Quality Auditors Scheme Guidelines 2018.
Worth noticing: in August 2026 we read the Australian top ten for “ndis audit checklist” and the top ten for “ndis compliance checklist”. That is twenty results and seventeen unique pages, with three appearing in both. Not one of them names this scale. The rubric is not hidden, and the checklists describe the exam without mentioning the marking.
Watch two more clocks, because guides often hand them to you by mistake. The audit report goes to the Commission up to 14 days after a verification audit. For a certification or mid-term audit, the limit is 28 days. Those are deadlines for your auditor, not for you.
Which audit you are having, and the deadline in between
The Commission picks your audit type, not you. It arrives as the Initial scope of audit. The rule is simple. Verification covers lower risk, simpler supports. Certification covers higher risk or more complex ones.
A verification audit is a desk review of your papers by an approved quality auditor. The list for it is fixed. You will find it in the NDIS Practice Standards Qualification and Professional Associations Required Documentation Guide.
Certification runs as a two stage check, and you need both stages. Stage 1 is a desk audit, usually off site. The auditor asks for facts and proof. Stage 2 happens on site. It looks at how you use your policies day to day. It can take in your records, your sites, your staff, the people you support, and how the work is done.
Here is the limit almost no guide carries. Stage 2 should happen in the three months after stage 1 ends (NDIS Quality and Safeguards Commission, retrieved 2026-08-11). If your proof is thin at stage 1, you do not have a year to fix it. You have one quarter.
The documents, grouped by what they prove
Every NDIS compliance checklist carries much the same items, and nobody argues about the contents. Guides differ in how they sort them. The grouping below is ours, and it follows what each paper has to prove rather than the alphabet.
Governance and operational management
- your governance framework, with a clear structure
- a risk policy, and a risk register looked at inside the last 12 months
- a conflict of interest policy, with current forms signed
- a plan for keeping the doors open in a crisis
- an improvement register with entries that show work, not intent
Participant rights and responsibilities
- signed service agreements, current and looked at once a year
- a privacy policy covering how you hold data
- proof you have told people about their rights
- proof they know they can leave you without penalty
Support planning and delivery
- support plans with dated reviews
- proof the person helped write their own plan
- records linking what the plan says to what you actually did
Human resource management
- worker screening records for every worker who needs one
- a training register with dates for the training you must run
- supervision notes
- job outlines, plus proof of skill where the role calls for it
Incident management
- an incident policy that matches the rules on reportable incidents
- incident reports showing what you found and what you did next
- pattern analysis across incidents, not just single write-ups
- restrictive practice papers with current sign off
Complaints and feedback
- a complaints and feedback policy setting out how you sort a complaint
- the complaints themselves, and how each one ended
Supported independent living, if you deliver it
The SIL module, Module 5A, adds proof of its own. The four outcomes are supported decision-making, safeguarding, practice governance, and tenancy, housing and support arrangements (Paperbark, 31 May 2026). Expect to hand over:
- communication profiles
- worker codes of conduct
- shared living safety plans
- training needs reviews and skill checks
There is one trap in that module for providers working from a stock list. Your service agreement and your tenancy agreement have to be separate documents. The conflict of interest policy has to cover housing on its own.
Evidence of use is what you are short of
Providers in 2026 do not fail because a policy is missing. They fail because nothing shows the policy gets used. Sector vendors and consultants report the same shift. They say the Commission changed its Practice Standards guidance in late 2025 (ShiftCare, retrieved 2026-08-11). Proof of use now outweighs proof that a paper exists.
Five failures come up repeatedly (FlowLogic, 3 July 2026):
- policies that no longer match how you work
- gaps in worker screening records
- incident logs with no follow-up or pattern analysis
- complaints handled without a documented investigation
- risk registers not touched since the last audit
Worker screening is the blunt one, and it now has a date on it. The first five year clearances went out from February 2021. The first renewals fell due from February 2026. A worker can renew up to 90 days before expiry. A valid renewal must be submitted at least seven days before the expiry date (NDIS Quality and Safeguards Commission, November 2025). A worker whose clearance lapses cannot take a shift with direct contact.
Proof comes from four places. Your papers and your records are two. The other two are what the auditor sees on site, and what people say when asked (Paperbark, 31 May 2026). That means your staff and the people you support. Proof beats paper because stage 2 includes interviews. Your auditor talks to staff and to the people you support. They check that the policy is known and followed. A folder cannot answer a question about how you handled a complaint last March.
Enforcement is now routine, not rare. The Commission publishes every banning order and compliance decision it makes, and anyone can search them by provider name on its compliance and enforcement register. Your participants and their families can search it too.
Serious contraventions sit far above that chart, at up to 10,000 penalty units. They attach to four things (Team DSC, 28 April 2026, updated 21 May 2026):
- false or misleading information in a registration application
- failing to comply with conditions of registration
- breaching the Code of Conduct
- causing harm to or threatening another person
The checklist items that cannot live in a folder
Part of your checklist only counts if a person can find it without asking you. That is a different test from owning the paper, and it is the part providers most often get wrong. A second part is created by the audit itself.
Your complaints system is the clearest case, and it is the one place where NDIS provider website design and audit evidence meet. Under the Practice Standards it has to be easy to reach and it has to work, not just exist on paper. An audit-ready complaints policy covers (NDISCompliant, retrieved 2026-08-11):
- what it is for, and what counts as a complaint
- the rights of the person, and the ways to make a complaint
- who is in charge, and how you sort it out step by step
- how a complaint goes up a level, and how you shield the person who made it
- when the policy is reviewed
Auditors check whether you have written down the right to take a complaint to the NDIS Commission.
The audit samples people on an opt-out basis, and that makes a record most checklists miss (NDIS Quality and Safeguards Commission, retrieved 2026-08-11). You must tell every participant they are automatically included. That may mean the audit team calls them, talks to them, or reads their files and plans. If someone says no, you respect it, write it down, and tell your approved quality auditor. That written note is proof in itself.
There is a newer reason to read your own public wording carefully. The Commission can now issue an anti-promotion order, banning or limiting how you promote, advertise or sell, with a penalty if you break it. The explanatory material names examples worth noticing (Team DSC, 28 April 2026):
- misleading promotion about how NDIS funds can be spent
- the sale of NDIS registrations
- falsely claiming to be an approved auditor
- consultants offering 100 per cent audit success guarantees
Banning orders grew at the same time. They now reach approved quality auditors, their staff, and the consultants who help you register.
That last point is worth a pause if you are shopping for audit help. Some pages selling you a sure thing describe conduct the regulator has just named.
The checks you can run yourself sit on our NDIS provider website page too. How easy your words and your complaints channel are to use is a separate duty. Start with what the law actually requires. A finished check on a real provider site shows what the output looks like.
Mandatory registration, and how it lands you in an audit
The chain is short and runs one way. You must register, so you must be audited. The audit marks you against the Practice Standards. The standards pick the papers you hand over. Anyone hunting an NDIS provider registration checklist is really hunting the audit behind it.
Since 1 July 2026, supported independent living has its own must-register class. A new registration group, 0138 Assistance with Supported Independent Living, took effect on that date. The new SIL module of the Practice Standards began with it (NDIS Quality and Safeguards Commission, retrieved 2026-08-11).
What that means depends on where you stand. Providers in group 0115 move to 0138 on their own. They meet the new standards at their next booked audit. Providers already delivering SIL without registration have until 1 October 2026 to submit an application. They can keep working while it is looked at (Team DSC, retrieved 2026-08-11).
SIL counts as high risk, so the path is certification, not verification. That means both stages, a site visit, and interviews.
One more change matters here. The National Disability Insurance Scheme Amendment (Integrity and Safeguarding) Act 2026 made working without the right registration a crime (Gilchrist Connell, 15 July 2026). It is no longer only a civil matter. This article gives fines in penalty units, not dollars. Published dollar figures disagree with each other, and the unit value moves.
What it costs, and how long you will wait
Signing up with the Commission is free. The audit is not, and the Commission does not set audit prices (NDIS Quality and Safeguards Commission, retrieved 2026-08-11). Its own advice is to get quotes from several approved quality auditors and compare them. That is a useful fix for any page that quotes you one number.
Published figures vary a lot, so treat them as ranges (Sky Staff, retrieved 2026-08-11):
- a verification audit, 900 to 1,800 dollars
- certification for core services, 3,000 to 5,000 dollars
- certification including specialist modules, 5,000 to 12,000 dollars and above
- each additional supplementary module, 1,000 to 2,500 dollars
For a single site SIL operation, auditor fees have been quoted at 7,000 to 15,000 dollars. The same source puts four to eight months between the first draft and sign off (CollabEdge, 20 July 2026).
Price is only half of it. Getting a slot is the other half, and that got worse in 2026. QIP left the NDIS audit market on 30 April 2026 and Citation Certification concluded all NDIS auditing on 30 June 2026 (FlowLogic, 3 July 2026). A third had already gone. The Commission revoked JPS Audit Specialists’ approval, and another firm took over its audit work, announced by the acquiring firm in December 2025 (EIN Presswire, retrieved 2026-08-11).
Fewer auditors met more demand in the same quarter. The new rules sent a wave of SIL providers into certification at once. If you are working towards 1 October 2026, book the auditor at the start of your plan, not the end.
After the audit, the cycle keeps running
Getting registered starts an audit cycle. It does not end a project. More audit types can reach you later, and the Commission sets out each one (NDIS Quality and Safeguards Commission, retrieved 2026-08-11).
Halfway through, a mid-term audit takes a second, partial look. It applies to providers who went through a certification audit for higher risk supports. You start getting ready about 12 months in, and it wraps up at 18 months. It assesses you against three things:
- the Practice Standards on governance and running the business
- anything already marked as needing a corrective action plan
- anything else the Commission names
Mid-term audits do not apply to:
- a provider registered only for specialist disability accommodation
- a sole trader or partnership registered only for early childhood supports
- a transitioned provider
The Commission can also ask for a condition audit, at a time it picks. It can be imposed for five named reasons:
- you completed a provisional certification audit
- the auditor did not see every class of support at your audit
- minor non-conformities are outstanding
- the owners changed in a way that shifts the business or how it is run
- the Commissioner thinks it is needed
You can ask for an out of cycle audit yourself, usually to add registration groups or widen what you deliver.
If the audit itself goes badly, there is a path. Raise it with your auditor first. Then go to the firm that hired them, which must have a complaints system. If that does not settle it, contact JASANZ, the body that accredits them. It will expect to see you tried the earlier steps first.
Frequently asked questions
What documents do I need for an NDIS audit?
Governance and risk papers. Service agreements and support plans. Worker screening and training records. Incident and complaint records, with how each one ended. Privacy and conflict of interest policies. Restrictive practice sign offs. An improvement register. Providers doing supported independent living add the SIL module proof, including split service and tenancy agreements. The exact set depends on your registration groups and your audit type.
What is the difference between a verification and a certification audit?
A verification audit covers lower risk, simpler supports. It is a desk review of your papers. A certification audit covers higher risk or more complex supports and runs in two stages. Stage 2 adds a visit to your sites and talks with staff and the people you support. The Commission tells you which one applies, in your Initial scope of audit.
What happens if you fail an NDIS audit?
There is no single fail. Each Practice Standard gets a mark from 3 down to 0. A mark of 0 is a major non-conformity. It gives you three months to fix the issue. Your registration goes nowhere until you fix it and finish the audit. A mark of 1 is a minor non-conformity. It gives you longer and lets you carry on.
How much does an NDIS audit cost?
The Commission does not set audit prices. It tells you to compare quotes from several approved quality auditors. Published figures start near 900 dollars for a verification audit and near 3,000 dollars for certification of core services. They reach 15,000 dollars for a single site supported independent living service. Signing up with the Commission is free.
Do participants have to take part in the audit?
No. The sample is opt-out, so everyone is in by default and you must tell them so. Anyone can say no. If they do, you respect it, write it down, and tell your approved quality auditor.
Where to start
Working from a list of papers is the slowest way to get ready. The list was never the hard part. Start from the mark instead.
- Take one Practice Standard and ask what a 2 looks like. You need the paper, plus a record showing you used it lately.
- Find your oldest proof. A stale risk register and an incident log with no follow-up are the two usual ways a 2 slips to a 1.
- Check what a person can find without asking. Start with how to make a complaint, and how to take it to the Commission.
- Book the auditor early if 1 October 2026 applies to you. Their spare time is now part of your timeline.
If the public half of that list is where you feel least sure, that is the part we build and fix. Talk to us about what an auditor and a participant can both see on your website.
About the author. Vasilii Aldukhov founded Web Ways Tech in Sydney and has built websites for ten years, mostly in WordPress. He works with Australian businesses on rebuilds, ecommerce and the search foundations underneath them.
