Audio Courses
NDIS Registration Groups and Audit Pathways

Lesson 15 of 17

NDIS Registration Groups: The Audit Decision That Changes Everything

From NDIS Registration Groups
Audio lesson
0:000:00

Overview

Learn how NDIS registration groups shape your audit pathway, from verification to certification, and why one high-risk support can escalate the entire application. We also break down common four-digit codes like 0120, 0125, 0128, and 0107 so providers can choose a scope they can actually evidence.

NDIS Registration Groups and Audit Pathways: NDIS Registration Groups: The Audit Decision That Changes Everything — full transcript

Welcome to the show. Winter, I wanna start with the bit that catches almost every new provider off guard: those little registration groups in the NDIS application are NOT admin fluff. Pick the wrong mix, and you can turn a fairly contained desktop verification audit into a full certification audit with an onsite visit, staff interviews, the lot. The phrase there is "full certification audit." Because desktop review versus onsite review -- that's a completely different level of pressure, time, and cost, isn't it? Exactly. In plain terms, registration groups are how the NDIS Quality and Safeguards Commission sorts providers by the supports they say they deliver. You select the categories that match your services, and those categories tell the system which standards you need to prove, what qualifications matter, and crucially, what audit pathway applies. So if I'm brand new and I see "registration groups," I shouldn't hear "tick-box categories." I should hear, "this is the thing that decides how hard the front door is gonna be." That's actually a very good way to put it. There are 36 registration groups in total, each with a four-digit code. And each group links back to specific support items in the 2025-26 NDIS Support Catalogue. That catalogue has more than 600 line items, so the groups are basically the Commission's way of saying, right, what sort of provider are you, really? More than 600 line items... that's the bit that makes the official language feel a bit slippery for people. Because they think they're applying for "support work" or "therapy," but the system wants a code like 0107 or 0128 and expects you to understand what sits underneath it. Yep. And once you understand that, the audit logic starts to make sense. Broadly, low-risk groups go down the verification pathway. That's usually a desktop audit. Auditors review your policies, procedures, evidence, then make a recommendation to the Commission. Higher-risk groups go down certification. That's a two-stage audit: Stage 1 document review, then Stage 2 onsite, where they test whether what you've written is actually understood and done in practice. Stage 2 is the bit people underestimate. "Onsite" sounds innocent, but it's documentation review, looking at issues raised in Stage 1, and interviews with staff and participants. That's not just paperwork -- that's your real operation being checked. Right. And here's the memorable warning I really want new providers to keep: one high-risk group contaminates the whole pool. Or, less dramatically, one high-risk group escalates the entire application to certification. There is NO ring-fence. You can't say, "Well, most of my services are low risk, so can we just desktop-audit those and quietly tuck the high-risk one in the corner?" Doesn't work like that. So one spicy choice and suddenly the whole meal is spicy. Yes -- exactly that. If you apply for a combination of low and high-risk groups, the Commission treats the application at certification level. That's probably the single biggest trap for new providers in 2026, because it often happens through ambition rather than recklessness. People think, "While we're here, let's add one more service line for future growth." And that "one more service line" might be something like 0128 Therapeutic Supports or 0107 Assistance with Daily Personal Activities, and now the whole process is bigger, dearer, and slower. That's it. So the smart question is not, "What could we possibly offer one day?" It's, "What can we credibly evidence right now?" Because registration groups aren't just a menu. They're a promise. You're telling the Commission, we deliver these supports, we have the workforce for them, and we can meet the standards attached to them. Let me try to play that back. Registration groups are the categories that connect your claimed services to the audit and standards you'll be judged against. And the dangerous misunderstanding is treating them like a wish list instead of a proof list. That's a great distillation. If you're only genuinely set up for lower-risk supports, a focused verification pathway may be entirely appropriate. If you need a higher-risk group, fine -- but make that decision with your eyes open. Because the jump from verification to certification is not technical... it's operational. This is where the four-digit codes become a bit more human. New providers usually recognise the common groups once you translate them. Like 0120, Household Tasks. That's domestic help -- cleaning, meal prep, gardening, the practical stuff that helps someone stay safely in their own home. And 0120 is lower risk, which is why a lot of smaller providers start there. Same with 0108, Travel and Transport Assistance. That's transport to appointments, community activities, social outings -- could be more formal, could be delivered by support workers. Then you've got 0125, Participation in Community, Social and Civic Activities, which is one of the most popular starting points because it's about helping participants access community life. 0125 is popular for a reason, but I think people still need a reality check there. "Community access" sounds broad and friendly -- and it is -- but you still need proper systems. Rostering, incident management, worker screening, documentation... broad doesn't mean casual. Definitely. Then once you step into higher-risk territory, the compliance bar changes fast. Take 0128, Therapeutic Supports. That's physio, speech therapy, OT, psychology. Workers delivering those supports need current AHPRA registration or relevant professional body membership. And selecting 0128 triggers certification. AHPRA is the token I'd underline there. If your business model says "we'll do therapy," the obvious next question is, do you actually have AHPRA-registered clinicians or the right professional memberships in place? If not, that code is aspirational, not operational. Exactly. Same story with 0107, Assistance with Daily Personal Activities. Huge service area, very common, but it's higher risk because you're talking personal care. It triggers certification and requires the Core Module of the NDIS Practice Standards. That's not a small lift. And then 0110, Specialist Behaviour Support, is even more specialised again. That's behaviour assessments and positive Behaviour Support Plans for participants with complex needs. Certification required, Behaviour Support Module required, and the practitioners themselves must be registered with the NDIS Commission. 0110 is a good example of why names can mislead. It sounds like a service description. It's actually a regulated practice area. Same with 0115, Specialist Disability Accommodation. SDA is housing for people with extreme functional impairment or very high support needs, and it's one of the most regulated spaces in the whole NDIS. 0115 is not the place for "we'll figure it out as we go." And neither, really, is 0132, Support Coordination. A lot of people think support coordination is mostly admin and relationship management. But 0132 usually requires certification and strong documentation. Plus from July 2025, Level 2 and Level 3 Support Coordination providers must be registered. That July 2025 change matters because it pulled a lot more support coordination into the full compliance framework. So again, before choosing any group, ask two very plain questions: do we have the workforce capability, and do we have the evidence? Qualifications, registrations, policies, practice standards -- whatever that group demands. Which brings us back to strategy. There are 36 groups overall, but nobody gets extra points for trying to collect them like Pokémon. The stronger first application is usually the narrower one -- the groups you can genuinely deliver TODAY. Yes. Start focused, build credibility, then expand through a variation later. That's standard across the sector. If you add a group later and it triggers certification, you'll deal with the extra audit when your systems and team are actually ready for it. So maybe the practical mindset is: don't register for the provider you hope to become in two years. Register the provider you can defend this month... and let the next variation reflect the business you've actually built. That's the move. Choose a scope you can stand behind now, because future growth is still there -- you just don't have to drag it into your first audit before it's real.