In this guideWhy ‘more policies’ is the wrong goal →The Core Module, outcome by outcome →Registers beat policies →Supplementary modules →Interactive checklist →
An auditor doesn’t count your policies. They pick an outcome from the Practice Standards and ask you to show how you meet it – with a document, a register entry, a worker who can explain it, and a participant file that proves it happened. One good policy that is used beats five that aren’t.
Why ‘more policies’ is the wrong goal
The NDIS Practice Standards are written as outcomes supported by quality indicators. A Core Module certification assesses 24 outcomes across four divisions. Nothing in the Standards says ‘have a policy called X’. Template packs with 60 or 80 policies exist because they are easy to sell, not because auditors want them. What auditors need is a traceable line: outcome → your documented approach → evidence it is used. Fewer, tighter documents with living registers make that line short.
The Core Module, outcome by outcome
What each division expects – and the minimum documents that satisfy it
Tap a division. The document list is what Nemco builds for a standard certification scope; scale it down for verification.
Outcomes: person-centred supports; individual values and beliefs; privacy and dignity; independence and informed choice; violence, abuse, neglect, exploitation and discrimination.
- Participant rights and person-centred practice policy (one document)
- Privacy and consent policy + consent form
- Safeguarding policy (abuse, neglect, exploitation) with mandatory-reporting steps for your state
- Easy-read participant handbook covering rights, privacy, advocacy and complaints
- Evidence: signed consents on file; workers can describe how they support choice; advocacy information given
Outcomes: governance and operational management; risk management; quality management; information management; feedback and complaints; incident management; human resource management; continuity of supports; emergency and disaster management.
- Governance framework (roles, delegations, key personnel, meetings)
- Risk management policy + risk register
- Quality management & continuous improvement policy + improvement register
- Information management policy (records, retention – 7 years, security)
- Complaints management policy + complaints register + participant-facing complaints information
- Incident management policy + incident register + reportable incident procedure (24-hour / 5-day rules)
- HR policy: recruitment, screening, induction, supervision, performance, training + worker register and training register
- Continuity of supports plan; emergency and disaster management plan (added after COVID; still assessed)
Outcomes: access to supports; support planning; service agreements; responsive support provision; transitions to or from the provider.
- Intake and access policy (eligibility, waitlist, non-discrimination, reasons for refusal)
- Support planning procedure + support plan template with risk assessment
- Service agreement template compliant with the Pricing Arrangements (cancellation, notice, GST, dispute clauses)
- Transition and exit procedure + exit checklist
- Evidence: participant files showing plan, agreement, reviews, communication
Outcomes: safe environment; participant money and property; management of medication; management of waste; mealtime management (where relevant).
- Work health and safety policy + home/site safety checklist
- Participant money and property policy + transaction record
- Medication management policy (only if you assist with medication) + medication chart and error procedure
- Infection control and waste procedure
- Mealtime management procedure if you support people with swallowing difficulties (links to the Commission’s practice alert)
Outcome names paraphrased from the NDIS Practice Standards and Quality Indicators (Core Module). Confirm the current version on the Commission’s website before an audit.
Registers beat policies
The single strongest signal that a provider is real is a set of registers with entries in them. A blank incident register at an initial audit is expected; a blank one at a renewal audit is a finding. Build these on day one and touch them weekly:
- Incident register – every incident, near miss and reportable incident with dates, actions and notification status.
- Complaints register – including compliments and informal feedback; shows the system is used.
- Risk register – organisational and participant-level risks, rated, with controls and review dates.
- Worker register – screening clearance number and expiry, WWCC, orientation module, first aid, qualifications, supervision dates.
- Training register – mandatory training completion and refresher dates.
- Continuous improvement register – everything you changed because of an incident, complaint, audit or review.
- Restrictive practices register – only if applicable, but then non-negotiable.
Supplementary modules: what each one adds
| Module | Triggered by | What it adds |
|---|---|---|
| 1 · High Intensity Daily Personal Activities | Group 0104 | Skills descriptors per activity (complex bowel care, enteral feeding, tracheostomy, urinary catheter, ventilation, subcutaneous injections, complex wound care, severe dysphagia, epilepsy with midazolam); competency records signed by a health practitioner; participant-specific care plans |
| 2 · Specialist Behaviour Support | Behaviour support practitioners | Practitioner suitability, functional behaviour assessment, behaviour support plan development within timeframes, restrictive practice reporting |
| 2A · Implementing Behaviour Support Plans | Any provider implementing a plan with restrictive practices | Authorisation per state law, monthly reporting to the Commission, training records, plan implementation records |
| 3 · Early Childhood Supports | Group 0118 and children under 9 | Family-centred practice, natural settings, transition planning, inclusive practice |
| 4 · Specialised Support Coordination | Group 0132 | Conflict of interest management, crisis planning, complex needs coordination |
| 5 · Specialist Disability Accommodation | SDA providers | Dwelling enrolment, tenancy rights, conflict of interest between SDA and SIL providers |
Audit-readiness checklist
Tick what you have and use. Anything unticked is a likely finding.
- Governance framework naming key personnel, delegations and meeting cadence
- Risk register with at least ten rated risks and review dates
- Incident register and reportable-incident procedure (24 h / 5 business days)
- Complaints register and easy-read complaints information for participants
- Worker register with screening numbers, expiries and orientation module completion
- Service agreement template aligned to the current Pricing Arrangements
- Support plan template with participant risk assessment
- Participant handbook in easy-read format
- Privacy and consent policy with signed consents on file
- Continuous improvement register with entries
- Emergency and disaster management plan
- Continuity of supports plan (what happens if you or a key worker is unavailable)
- Medication management policy and chart (if applicable)
- Module 1 competency records signed by a health practitioner (if applicable)
Nemco’s NDIS Provider Setup delivers every item on this list mapped to the outcomes, with the registers pre-formatted and the self-assessment cross-referenced to each document.
Want it built for you? The NDIS Provider Setup is a fixed-price, ready-to-run version of everything in this article. Book a 20-minute call – no pitch, honest answer.
Sources and further reading
- NDIS Quality and Safeguards Commission – NDIS Practice Standards and Quality Indicators (current version), High intensity support skills descriptors, Practice alerts
- NDIS (Provider Registration and Practice Standards) Rules 2018; NDIS (Incident Management and Reportable Incidents) Rules 2018; NDIS (Complaints Management and Resolution) Rules 2018
- NDIS (Restrictive Practices and Behaviour Support) Rules 2018
General information only, not legal, financial or tax advice. Rules change; confirm current requirements with the regulator or a qualified professional.
Why Nemco
Built properly, priced once, owned by you – and who signs off every build.
Since 2013
Consulting, marketing and applications since 2013. A setup is that experience, packaged.
Fixed price
One number, three milestones. No hourly rates, no surprise invoices.
You own 100%
Entity, brand, site, documents, systems – yours outright. No royalties, ever.
Honest by design
No income claims. No guaranteed approvals. If it isn’t a fit, we say so on the call.
Christian Nehme · Founder & Principal Adviser
Lead Auditor
ISO 9001:2015 – trained to run the audits, not just pass them.
NDIS Internal Auditor
NDIS Internal Auditor Course – the Practice Standards from the assessor’s side.
Audit & risk in government
3+ years in audit and risk management roles in government.
Bachelor of Medical Science
A clinical-science grounding for health, disability and aged-care work.