To get through an NDIS Commission quality audit, engage an approved quality auditor from the Commission's list, request quotes against your Initial scope of audit, and start assembling your evidence pack now. Confirm worker screening status early. Everything else in your audit preparation follows from those three moves.
TL;DR:
- Most providers should focus on early staff screening checks and assembling an organized evidence pack covering governance, participant plans, incidents, and policies before scheduling audits.
- A staged 90-day preparation process, including gap analysis, remediation, evidence cross-checking, and mock audits, significantly reduces the risk of major non-conformities.
- Auditor quotes vary widely, typically from $900 to $12,000+, and should explicitly include all cost components, with early booking essential due to tightening capacity.
- Compliance timelines are fixed by the Commission, requiring providers to build deadlines around 14-day verification and 28-day certification report windows.
- Regular board-level assurance reviews paired with a traceability register help turn audit readiness into ongoing, proveable compliance rather than reactive corrections.
What is NDIS Commission audit support and which audit applies to you?
Every registered or registering provider must be assessed against the NDIS Practice Standards through an independent quality audit conducted by an approved quality auditor. Which audit type you face depends on your registration group and risk profile, not on preference.
A verification audit is a desktop review, mostly documents, no site visit. A certification audit runs two stages, including a site visit and staff interviews, and applies to higher-risk supports. Mid-term audits happen roughly 18 months into your registration cycle to confirm ongoing conformity. Condition audits and out-of-cycle audits get triggered by a specific compliance concern or a condition placed on your registration, so if you've had a recent complaint or incident notification, expect closer scrutiny.
Auditors examine documentary evidence, run participant interviews, interview frontline staff, and observe your site in action. Your Initial scope of audit document tells you exactly which audit type and Practice Standards apply to your registration groups. Use it as the brief you hand to every auditor you approach for a quote.
What's your 90-day audit readiness checklist?
Break the 90 days into four 30-day-ish phases with named owners, not vague intentions.
- Days 1 to 25, gap analysis: Map every applicable Practice Standard against current policy and practice. Assign one senior staff member per standard area (governance, risk management, human resources) and log gaps in a shared register.
- Days 26 to 55, operational remediation: Fix what the gap analysis found. Update policies, close out worker screening and training backlogs, and version every document so you know what's current.
- Days 56 to 75, verification: Cross-check evidence against the standards, confirm all worker screening checks and mandatory training are complete and captured, and update your traceability register.
- Days 76 to 90, mock audit: Run mock interviews with frontline staff and a handful of participants (with consent), then do a final evidence sweep before your real auditor arrives.
Pro Tip: Mock audits consistently surface staff knowledge gaps that a document review alone misses. Run yours with real staff answering real questions, not a scripted walkthrough, because that's where interview-based non-conformities actually get caught before an auditor finds them.
A quality management system built around this kind of staged timeline gives your board something concrete to track, rather than a folder of good intentions.
What documents and evidence do auditors expect?
Auditors work fastest, and find least, when your evidence is organised before they arrive. Build a pack that covers:
- Governance and management: board minutes, organisational charts, insurance certificates, and worker screening records.
- Participant-facing evidence: current support plans, consent forms, and proof that supports are genuinely individualised, not templated.
- Incident and complaints registers, with timelines showing what happened, what you did about it, and whether it worked.
- Policies and procedures that match what actually happens on the ground, version-controlled and dated.
Auditors corroborate this paperwork against worker and participant interviews, so a policy that contradicts what staff tell an auditor in person is worse than no policy at all. Cross-reference every document to the specific Practice Standard it satisfies, and store it so any staff member can retrieve it in under a minute.
How do you choose and work with an approved quality auditor?
Your Initial scope of audit is the document to send every auditor you're comparing, because it lets you request genuinely comparable quotes rather than apples-to-oranges figures.
- Ask what's included: number of audit days, number of auditors, travel costs, and report turnaround time.
- Confirm impartiality safeguards, since auditors accredited under JASANZ must follow strict independence rules.
- Check whether the quote covers second-stage certification costs or only the first stage.
- If you're dissatisfied with an auditor's conduct, you can escalate unresolved complaints to JASANZ directly.
Auditor quotes sometimes exclude travel or second-stage fees, so ask the question explicitly rather than assuming it's covered.
What are realistic timelines and costs?
Report timeframes are fixed by the Commission: up to 14 days after a verification audit and up to 28 days after certification or mid-term audits. Build your registration deadlines around those windows, not around hope.
On cost, industry estimates put verification audits around $900 to $1,800, and certification audits from roughly $3,000 up to $12,000+ depending on modules, sites, and scale. The Commission doesn't set audit prices, so get multiple quotes. Auditor capacity has tightened, with market changes in 2026 reducing the number of active auditors and stretching booking lead times. Secure your date early and build in contingency.
How do you respond to audit findings?
Audit reports use a ratings scale from 3 (conforms with elements of best practice) down to 0 (major non-conformity). A rating of 0 or 1 triggers a corrective action plan, and auditors typically expect that plan submitted within seven days of being requested.
Closure evidence can be desktop-based or require a follow-up site visit, depending on severity. The safest operational approach treats every finding as a root-cause problem, not a paperwork fix: identify why the gap occurred, document the remediation, and get governance sign-off before you call it closed. Rushed, undocumented fixes are what turn a single non-conformity into a protracted re-audit.
How did one provider avoid major findings in 90 days?
A mid-sized disability support provider came to its mid-term audit with three open incident-register gaps and no evidence traceability system. The single highest-value fix wasn't a new policy. It was a traceability register linking every document to its Practice Standard, so staff could produce evidence on request instead of searching for it.
The Hub ran a mock interview two weeks out, catching a staff knowledge gap on incident escalation before the real auditor could. The result: zero major non-conformities and an audit closed inside the standard timeframe, not extended.
A board-level fix worth adopting now
Most boards see audit reports after the fact. The stronger governance move is a quarterly assurance review tied directly to your audit and registration timeline, not a generic quarterly meeting agenda item. Pair it with an evidence traceability register your board can glance at between meetings, because that's what turns "we think we're compliant" into "we can prove it."
If your board isn't asking to see traceability evidence at every quarterly meeting, what would it take to start?
— Rachel
How The Planning and Practice Hub supports your audit readiness
The Planning and Practice Hub is the practical alternative to going into an audit alone or relying solely on your auditor's feedback loop. Where most providers find out about a gap when the auditor points it out, our practice assurance work is built to surface it 90 days earlier, when there's still time to fix it properly.
Our engagements cover practice assurance reviews, policy and procedure development that matches what actually happens on the ground, a compliance calendar to track worker screening and audit dates, and mock audits run the way a real one feels. Clients typically come out with a clear evidence traceability register and a governance team that knows exactly what an auditor will ask before they ask it. If corrective actions intersect with broader legal obligations, our partner at Brainiac Consulting covers that ground too.
Start with a practice assurance review to find out exactly where your organisation stands before your auditor does.
Where to check the official rules
For the audit types themselves, read the Commission's quality audit process page. For auditor conduct and JASANZ accreditation, see information for quality auditors.
Sources
- The quality audit process | NDIS Quality and Safeguards Commission
- NDIS Audit Preparation 2026: Common Failures, Auditor Shortage & How to Get Ready | FlowLogic
- How Much Does NDIS Registration Cost in 2026? | SkyStaff
FAQ
How much does an NDIS audit cost?
Verification audits typically run $900 to $1,800, while certification audits range from about $3,000 to $12,000 or more depending on modules and scale. The Commission doesn't fix prices, so always request multiple quotes.
What does an NDIS auditor do?
An approved quality auditor reviews your documentary evidence, interviews staff and participants, observes your site, and rates your conformity against the NDIS Practice Standards on a scale of 0 to 3.
Who are the best NDIS auditors in Australia?
The Commission maintains the official list of approved quality auditors, all accredited under JASANZ. Rather than picking on reputation alone, use your Initial scope of audit to request comparable quotes from several listed auditors before deciding.
What documents do I need for an NDIS audit?
You need governance records, worker screening and insurance documents, participant support plans and consent records, incident and complaints registers, and current policies cross-referenced to each relevant Practice Standard. A well-organised evidence traceability register speeds up desktop review significantly.
How long does an NDIS audit take to report?
Auditors submit reports within 14 days of completing a verification audit and within 28 days for certification or mid-term audits, per Commission timeframes.