NDIS Verification Audits: Scope, Evidence, and Common Traps

Winter, EnableUs Community

Picture two providers. One is a sole practitioner offering personal care, registration group 0107. The other is a large business with plenty of staff and revenue, delivering only household tasks. Which one gets the lighter audit?

Will, EnableUs Community

The instinct is to say the small one. But it's the reverse. Verification isn't decided by business size, revenue, or legal structure. It's decided strictly by the registration groups you apply for. So the sole practitioner doing personal care needs a certification audit, and the big household tasks provider can use verification.

Winter, EnableUs Community

Last time we introduced the split between verification and certification, and the warning that one higher risk group pulls you into certification. Today we're going inside the verification pathway. So first, what does the audit actually look like?

Will, EnableUs Community

It's an offsite desktop review by an Approved Quality Auditor. That's the key contrast. A certification audit has two stages. A desktop audit first, then an onsite audit with staff and participant interviews, file sampling, and observed service delivery. Verification skips all of that. The auditor reads your evidence and decides whether it shows you meet the standards.

Winter, EnableUs Community

Which means your paperwork is the whole audit. Nobody visits to see what you really do.

Will, EnableUs Community

Right, and that's why the scope trap matters. If your application includes even a single registration group that requires certification, the entire organisation goes through a certification audit against the Core Module. One group changes everything.

Winter, EnableUs Community

So which groups are on the verification side?

Will, EnableUs Community

Twenty three of them. Accommodation and tenancy assistance, 0101. Assistive products for personal care and safety, 0103. Personal mobility equipment, travel and transport assistance, vehicle modifications, home modifications. Then recreation equipment, vision equipment, community nursing care, and innovative community participation. Specialised hearing services, household tasks, interpreting and translation, hearing equipment. Add assistive products for household tasks, and communication and information equipment. Then exercise physiology and personal training, plan management, therapeutic supports, specialised driver training, assistance animals, hearing services, and custom prosthetics. That's 0135.

Winter, EnableUs Community

There's a pattern in that list. A lot of those are professions that are already regulated.

Will, EnableUs Community

Yes. The Commission's own guidance says many verification providers already meet professional regulation, through Ahpra or professional bodies. Think Speech Pathology Australia, ESSA for exercise physiology, ANZACATA, PACFA, or CPA and Chartered Accountants for plan management. Those bodies already monitor competency and continuing professional development. That's part of the reasoning for a streamlined, desktop only audit.

Winter, EnableUs Community

So what does that desktop review ask for? The Verification Module has four standards.

Will, EnableUs Community

Human resource management, incident management, complaints management, and risk management. Start with human resources, because it's the heaviest. For individuals and partnerships, that means 100 points of ID, proof of the right to work in Australia, pre employment checks, and qualifications or professional memberships. For a company, the Commission's documentation guide says you must show at least one worker delivering supports who meets the qualification criteria for each profession under each registration group.

Winter, EnableUs Community

And everyone needs the NDIS Worker Orientation Module, Quality, Safety and You.

Will, EnableUs Community

A completion certificate for each worker, yes. Plus training in infection prevention and control, hand hygiene and respiratory etiquette, and training in using PPE, with PPE actually available. Worker screening applies to risk assessed roles. That's key personnel, people directly delivering specified supports, and anyone in a role with more than incidental contact with participants. And workers compensation or personal accident insurance is required.

Winter, EnableUs Community

Then the two systems standards. Incident management and complaints.

Will, EnableUs Community

Both need a documented system that's proportionate to your size, scale, and scope. The incident system must comply with the Incident Management and Reportable Incidents Rules 2018. The complaints system must comply with the Complaints Management and Resolution Rules, and follow procedural fairness and natural justice. You can describe the process or provide a copy, and include materials participants actually receive.

Winter, EnableUs Community

Risk management is where I'd expect people to slip, because it's the broadest.

Will, EnableUs Community

It covers a documented work health and safety system, emergency and disaster planning, infection control, and certificates of currency for public liability, professional indemnity, and accident insurance. One detail worth noticing is the risk assessments. They have to consider how much participants rely on you for daily living needs, and how their health and safety would be affected if your services were disrupted.

Winter, EnableUs Community

Which is why a generic template alone won't carry you. That has to describe your actual service.

Will, EnableUs Community

Exactly. Now the workflow. After your application and self-assessment, the Commission issues an Initial Scope of Audit. It confirms your registration groups, audit type, and required evidence. Check it carefully before you request quotes, because auditor quotes depend directly on that scope. And the portal has changed. The Commission launched a new provider portal on 12 October 2026. New applications started on or after that date go through the new portal. Applications already underway before it finish in the legacy portal.

Winter, EnableUs Community

And timing?

Will, EnableUs Community

The Commission says the auditor submits the report within 14 days of finishing a verification audit, compared with 28 for certification. A documentation provider, Provider360, says the desktop audit itself usually takes one to two weeks, and the whole pathway four to six months. That's their estimate, not a Commission guarantee.

Winter, EnableUs Community

Then the ratings.

Will, EnableUs Community

Zero to three. Zero is a major nonconformity, and you have three months to fix it before registration can progress. One is a minor nonconformity. Two means you conform to the standards, and three means elements of best practice.

Winter, EnableUs Community

So someone passes the audit and thinks they're registered.

Will, EnableUs Community

And that's the trap. The audit report is the auditor's findings, not a registration. The Commission considers the report and makes the registration decision. It alone can grant or refuse registration. Until then, don't treat the application as successful.