Welcome to the show. Winter, the number I want every certified NDIS provider to hear is 18 months. Not three years. EIGHTEEN months. Because a lot of providers pass the initial certification audit, get the Certificate of Registration, breathe out... and completely miss that there’s a mandatory mid-term audit sitting in the middle of the cycle. Eighteen months is the bit that catches people, isn’t it? Because in your head you go, “We’re registered for three years, beauty, we’re sorted.” But if you’re on the certification pathway, that 18-month mark is not optional. Exactly. And that’s the first distinction that matters. Not every provider has to do it. Verified providers don’t. Providers registered only for Specialist Disability Accommodation, that’s 0131, don’t. And individuals or partnerships registered only for Early Childhood Intervention, 0118, also don’t. But if you’re delivering certified registration groups -- personal care, behaviour support, community participation, higher-risk supports -- the mid-term audit is mandatory. And “mandatory” here means if you miss it, you’re not just a bit behind on paperwork. You’re potentially in breach of a condition of registration. That wording matters. Yep. The Commission requires it to be commenced within 18 months from the date on your Certificate of Registration. And your due date is visible in the Provider Portal, which sounds obvious, but honestly, some providers don’t check until they get far too close. The surprising bit for me is that the mid-term audit is actually narrower than the initial certification audit. So on paper it feels smaller. But the stakes are still huge. That’s the tension. It’s narrower, not softer. Usually the auditor zooms in on Division 2 of the Core Module -- governance and operational management. So they’re looking at whether the organisation is still being run safely, ethically, and in line with the NDIS Practice Standards and Quality Indicators. Selected policies, procedures, staff records, incidents, complaints, continuous improvement evidence -- all of that can be reviewed. Division 2. That’s the phrase I’d circle. Because when people hear “governance and operational management,” they think board papers and org charts. But you said incidents, complaints, staff records. That’s everyday business. That’s the lived reality of the service. That’s right. The auditor is testing whether your actual practice matches your written systems. So, do the incident and complaint registers show an active process? Are worker screening checks current? Are qualifications still current? Are staff actually following the policy the organisation says it follows? And they’ll usually get at that through file reviews plus interviews with staff and participants. Let me try and say it back. The mid-term audit isn’t trying to re-run the whole initial audit. It’s more like, “Since registration, have you drifted?” Have the policies stayed in a folder while the real service moved somewhere else? That is very well put. Drift is the risk. And one of the most practical functions of the mid-term audit is early issue identification. If there were minor non-conformities at the initial audit, this is where you prove the corrective actions were actually implemented and documented. Not promised -- documented. “Not promised -- documented” is the painful line, isn’t it? Because a provider might say, “Oh yes, we fixed that training gap months ago.” Okay -- show the records. Show the updated training matrix. Show me the sign-off. Precisely. And this is why preparation shouldn’t start the week before. Best practice is at least three months before that 18-month due date. Pull out the initial audit report. Review every finding -- conformities and non-conformities. Update policies if the Practice Standards changed. Review incidents and complaints. Confirm staff checks and qualifications. And, importantly, contact your approved quality auditor, sign the service agreement, confirm scope, lock in the audit date. And once that audit date is locked in, the auditor needs to update the Commission’s system, yeah? Because otherwise you can end up getting overdue notices even though you’ve actually organised it. Yes. Small admin step, big consequence if missed. And I’d add one more thing: a self-assessment or internal audit before the real one can save a lot of pain. Some providers do that in-house, others bring in an NDIS internal audit specialist. Either way, the goal is the same -- find the gap before the auditor does. So the mid-term audit is almost a paradox. It’s targeted -- narrower than the first audit -- but if you treat that narrowness like it’s casual, that’s when it bites. Because governance failures don’t stay tidy. They spill into incidents, complaints, training, participant experience... all the things the renewal audit is going to see later anyway. Exactly. The mid-term audit is the warning light. Ignore it, and the dashboard doesn’t get kinder at year three. And year three is where this stops feeling like compliance admin and starts feeling commercial. Every registered NDIS provider -- verification or certification -- has to renew every three years. The renewal window opens SIX months before expiry. Six months sounds generous... until you waste four of them. And the consequence of getting this wrong is very real. If you commence renewal before the registration expires, your current registration stays valid while the Commission makes its decision. But if the registration lapses, you may have to start the registration application process again. At that point you’re operating as an unregistered provider. And “unregistered provider” is not just a label change. It can mean you can’t support NDIA-managed participants, you can’t claim NDIA payments as a registered provider, and you can’t present yourself as registered while lapsed. For some organisations, that’s not a hiccup. That’s an income shock. Exactly. Which is why I’d push back on the habit of treating renewal like a form you do when the reminder email arrives. Renewal is really a three-year compliance discipline. The application is just the moment when all the evidence gets called in. That’s the reframe. Three-year compliance discipline. Not an admin task. Because by the time you’re renewing, the Commission isn’t only looking at the audit result in isolation. They’re looking at your compliance history too -- complaints, reportable incidents, broader patterns. For certified providers, there’s also structure to the renewal audit that matters. Re-certification involves Stage 1 and Stage 2. Stage 1 is an off-site desktop audit -- basically a readiness check. Stage 2 happens within three months of Stage 1 and is on-site. Auditors can come to your place of business and outlets like group homes or day centres. Within THREE months of Stage 1. That timing matters because if Stage 1 exposes a messy system, you don’t have forever to magically become organised before the on-site piece. Right. And for providers on the verification pathway, re-verification is different again -- more of a remote desktop document review against the Verification Module. But either way, the Commission reviews the renewal application, the audit findings, and the compliance history before deciding whether to renew for another three years. They can also impose specific conditions. So if a provider says, “We’ll sort the little issues later,” later is expensive. A complaints register that’s patchy, outdated key personnel details, old outlet addresses, unresolved non-conformities -- none of that stays little once it hits the renewal file. That’s exactly the operational checklist between audits. Clean up non-conformities early. Review whether your registration groups still match what you actually deliver. Update key personnel, head office, outlet details. Keep incident and complaint data current and audit-ready. And when you submit the renewal application in the Provider Portal, you’ll receive an initial scope of audit document -- that’s what you give your chosen auditor to quote and plan properly. I like that scope point, because renewal can also be a strategic moment. You might keep the same supports, or add or remove registration groups. But those changes can alter the audit you need. So it’s not just “renew what we had.” It’s “does our registration still reflect our business model?” Yes -- and if you leave that thinking too late, you get boxed into rushed decisions. Set reminders at six months, three months, one month. Simple, but effective. The providers who manage renewal well usually aren’t smarter; they’re earlier. The bit I keep coming back to is this: the Commission’s monitoring doesn’t stop between audits. So the period between the mid-term audit and renewal isn’t dead time. It’s the evidence-building period. Every incident response, every complaint trend, every staff record update is adding to the picture. And that means the hardest question for a provider probably isn’t, “When is our audit due?” It’s, “If an auditor walked in next month, would our everyday practice tell the same story as our policies?” Because if the honest answer is “not quite,” the clock may already be ticking.
Audio Coursesby Jellypod