How the NDIS Audit Process Works, Start to Finish

Starting the Audit Pathway

Will, EnableUs Community: Hey everyone, welcome back to the EnableUs Community Podcast. I’m Will, and I’m here with Winter. Today, we’re diving into the NDIS audit process—start to finish. If you’re a provider and you’ve ever stared at the NDIS portal thinking, “Where do I even begin?”—you’re in the right place.

Winter, EnableUs Community: Absolutely, Will. The whole process can feel a bit overwhelming at first, but once you break it down, it’s actually pretty logical. So, let’s start at the very beginning: submitting your application through the NDIS Commission portal. That’s where it all kicks off.

Will, EnableUs Community: Yeah, and honestly, the first time I logged into that portal as a new provider, I was completely lost. I remember thinking, “Is this the right form? Am I ticking the right boxes?” I actually submitted my application without attaching half the documents they needed—classic rookie mistake. Had to go back and redo it, which, you know, delayed everything by weeks.

Winter, EnableUs Community: You’re definitely not alone there. I’ve heard so many stories like that. The key is making sure you’ve got all your ducks in a row—your registration groups, your business info, and all those supporting documents like policies, insurance, and staff checks. Double-checking before you hit submit can save you a lot of headaches.

Will, EnableUs Community: And once you’ve submitted, you get what’s called the Initial Scope of Audit. That’s basically your audit roadmap. It tells you whether you’re up for a Verification or Certification audit, which registration groups are being assessed, and which NDIS Practice Standards you’ll be measured against. I always tell people—don’t lose that document. It’s like your audit cheat sheet.

Winter, EnableUs Community: Exactly. And after that, it’s time to pick your auditor. The NDIS Commission has a list of approved auditors, so you can shop around a bit—get quotes, check their experience, and make sure they’re available when you need them. It’s worth taking your time here, because the right auditor can make the whole process a lot smoother.

Will, EnableUs Community: Yeah, and don’t just go with the first name you see. I mean, I might be wrong, but I think a lot of people just pick whoever’s cheapest, and that can backfire if they don’t know your registration group inside out. So, yeah, do your homework.

Verification vs Certification Audits

Winter, EnableUs Community: Alright, so let’s talk about the two main types of audits: Verification and Certification. This is where people get tripped up, because the requirements and timelines are pretty different.

Will, EnableUs Community: Yeah, so Verification audits are for low-risk registration groups. They’re usually just a desktop review—no site visits, no interviews. You just submit your documents online, and the auditor checks them over. It’s pretty quick, like, one to three weeks if you’ve got everything ready.

Winter, EnableUs Community: Exactly. And then Certification audits are for higher-risk groups. They’re a lot more involved. The auditor will actually visit your site—sometimes in person, sometimes virtually—and they’ll interview your staff, maybe even some participants. They’ll look at your records, incident reports, complaints, training logs, all of that. It can take, what, four to eight weeks? Sometimes longer if things get complicated.

Will, EnableUs Community: Yeah, and I’ve seen providers get caught off guard by that. They think it’s just paperwork, but then suddenly there’s someone in their office asking about their complaints process or staff training. It’s a whole different ballgame.

Winter, EnableUs Community: I actually met a provider who started out with a Verification audit, and then as their business grew, they had to go through Certification. She told me the biggest shock was the site visit—she thought she was prepared, but the auditor wanted to see real evidence, like how staff actually followed policies day-to-day. She said the best thing she did was run a mock interview with her team beforehand. It made everyone way less nervous when the real thing happened.

Will, EnableUs Community: That’s such a good tip. And, I mean, even for desktop reviews, you can’t just upload a bunch of policies and hope for the best. The auditor’s looking for evidence that you actually use those policies, not just that you have them sitting in a folder somewhere.

Winter, EnableUs Community: Totally. And the more you can show that your team understands and follows your procedures, the smoother the audit will go—no matter which type you’re doing.

After the Audit: Reports and Compliance

Will, EnableUs Community: So, you’ve survived the audit—what happens next? The auditor puts together a report, and this is where you find out if you’re compliant, or if there are any non-conformities you need to fix. Sometimes it’s just minor stuff, like a missing policy update. Other times, it’s bigger issues that have to be sorted before you can move forward.

Winter, EnableUs Community: Yeah, and if you do get non-conformities, don’t panic. You’ll have a chance to address them—usually by submitting extra evidence or making some changes. The key is to respond quickly, because the longer you wait, the more it can delay your registration.

Will, EnableUs Community: And once everything’s sorted, your auditor sends the final report to the NDIS Commission. Then you just wait for the official decision. If all goes well, you get your registration certificate—three years for Certification, five for Verification. But honestly, that’s not the end of the story.

Winter, EnableUs Community: No, it’s really just the beginning. Ongoing compliance is huge. You’ve got to keep your policies and insurance up to date, renew staff checks, and make sure everyone’s training is current. Plus, there are mid-term and renewal audits down the track, so you can’t just set and forget.

Will, EnableUs Community: Yeah, I worked with a provider who used to update their policies once a year, and they always scraped through audits by the skin of their teeth. Then they switched to reviewing everything quarterly—policies, training logs, the lot. Next audit? Zero major non-conformities. It made a massive difference. I mean, it’s a bit more work, but it’s way less stressful in the long run.

Winter, EnableUs Community: That’s such a good example. Staying organised and proactive really is the secret sauce. And it means you’re always ready, not just for audits, but for delivering better services to participants.

Will, EnableUs Community: Alright, I think that’s a good place to wrap up for today. If you’re feeling a bit more confident about the NDIS audit process, that’s a win in our book. We’ll be back soon with more tips and stories from the field.

Winter, EnableUs Community: Thanks for joining us, everyone. Will, always a pleasure chatting with you. See you next time!

Will, EnableUs Community: Thanks Winter, and thanks to everyone listening. Take care and good luck with your audits!