NDIS Audits: What Your Registration Groups Really Decide

Winter, EnableUs Community

Last time we talked about choosing registration groups and why ticking boxes you hope to use one day is a bad idea. Today I want to follow that choice into the audit itself. What does it actually decide?

Will, EnableUs Community

Quite a lot. It decides the type of audit, the evidence the auditor wants to see, and how your workforce gets tested. The first one is the big fork. Some groups need a verification audit and some need a certification audit.

Winter, EnableUs Community

What separates the two?

Will, EnableUs Community

Risk and complexity. Verification is for lower risk, lower complexity supports. Many providers in that category are already professionally regulated, like allied health practitioners under AHPRA. The audit is a desktop review of documents, things like policies, insurances and qualifications. Certification is for higher risk or more complex supports, and it has two stages. Stage 1 is a desktop review, usually offsite. Then Stage 2 is onsite, and it should happen within three months of Stage 1 finishing.

Winter, EnableUs Community

So what happens onsite that a desktop review can't catch?

Will, EnableUs Community

The auditor stops asking what your policy says and starts asking what actually happens. They can interview workers and participants, sample files, and watch supports being delivered. In staff files they check worker screening clearances, qualifications, induction records, and evidence of training and supervision. The Commission describes questions like, how do you know participants are safe, and can you show me how an incident is managed from start to finish.

Winter, EnableUs Community

And the participant side? That sounds like the part providers worry about.

Will, EnableUs Community

It can be. Sampling works on an opt out model. You have to tell participants they're automatically included, and if someone doesn't want to take part, you respect that, document it, and tell the auditor. The auditor might ask simple things. Do you feel safe, do staff listen to you, do you know how to make a complaint. If a participant is unsure about the complaints process, the auditor will explore that further.

Winter, EnableUs Community

Then there's the observation part. What are they looking for when they watch a support worker?

Will, EnableUs Community

Small things. Whether consent is sought, whether the worker explains a task before starting, whether dignity is respected, whether the support matches the participant's plan. And whether the worker documents it accurately afterwards. That's frontline competency being tested in real time, not described in a template.

Winter, EnableUs Community

Here's what worries me. Say a provider is mostly low risk work, but includes one higher risk group. Do they get a lighter audit for the rest?

Will, EnableUs Community

No, and this is the part that catches people. If your application includes groups needing both types, you generally complete a certification audit. One certification group can pull the whole organisation into the Core Module assessment, with Stage 2 and the interviews and observations that come with it.

Winter, EnableUs Community

So the evidence differs by group too, not just the audit type.

Will, EnableUs Community

Right. A provider doing household tasks has a different risk profile from one delivering supported independent living. For the simpler service, you'd expect basic safety and service delivery records. For complex daily personal care or SIL, auditors are looking for demonstrated competency, medication logs, and governance of restrictive practices. The setting matters too. Supports in a participant's own home, a shared living arrangement, or the community all shape what the auditor assesses.

Winter, EnableUs Community

Where does the Initial Scope of Audit come in?

Will, EnableUs Community

After you submit your application, the Commission issues it. It lays out your registration groups, the audit type, the relevant Practice Standards, and the information you need to give your auditor. It's the document that formally fixes what you're being audited against.

Winter, EnableUs Community

And providers need it before they approach auditors?

Will, EnableUs Community

Yes, and they should read it first. Approved Quality Auditors use it to quote. One auditor, GCC, says its pricing depends on registration groups, participant numbers, outlets and worker numbers. The Commission doesn't set auditor fees, and it encourages you to get quotes from several auditors and compare. But if the scope document has a group you didn't intend, every quote you collect is built on the wrong foundation.

Winter, EnableUs Community

So what should someone do if something looks wrong?

Will, EnableUs Community

Seek clarification before proceeding. Check it against your application and your planned services. Don't just forward it to auditors and hope it sorts itself out.

Winter, EnableUs Community

Now, back to the aspirational ticking. What does that look like once the auditor arrives?

Will, EnableUs Community

Think about what's being asked for. Operating evidence, qualified staff, active supervision. If you've registered for supports you aren't yet equipped to deliver, you can't produce any of that. That's where non conformities come from. A rating of 1 is a minor non conformity. You get more time to fix it and the registration process can continue. A rating of 0 is a major non conformity. You have three months to fix it, and your registration won't progress until it's resolved and you complete the audit successfully.

Winter, EnableUs Community

And a non conformity isn't automatically a failure, is it?

Will, EnableUs Community

The Commission is clear on that. It means something needs to be corrected or strengthened, and you're given a timeframe. But it's still avoidable work if the group never matched your operations. After the audit, the auditor drafts the report, you can check it for factual accuracy, and it goes to the Commission. Certification reports are submitted up to 28 days after the audit, verification up to 14.

Winter, EnableUs Community

So what if a provider genuinely wants to grow into new services?

Will, EnableUs Community

Register for what you can deliver now. When you expand, you can apply to vary your registration to add groups. An audit organised at any time to support that is called an out of cycle audit, and what's required depends on the changes and the Commission's assessment.

Winter, EnableUs Community

So the takeaway is to match groups to your real operations, read the scope document closely, and only then ask for quotes.

Will, EnableUs Community

That order saves money and stress. Know your service model, check the official registration group requirements, and prepare evidence that reflects what you really do. Then the auditor's question, how do you know participants are safe, has an answer you can show them.