The shape of an audit day
A certification Stage 2 audit follows a predictable arc. It opens with a meeting where the auditor confirms scope, the sample of participant files and workers they intend to review, and the timetable. Then they work through the Core Module division by division, alternating between reading documents, checking registers and interviewing people. For a new provider with no participants, the day is shorter and focuses on systems and key personnel. The audit closes with a meeting where findings are read back to you – nothing in the written report should be a surprise if you listened at the closing meeting.
Verification audits skip the interviews: the auditor works from your uploaded evidence against the Verification Module – risk management, incident management, complaints, worker screening and HR – and asks for clarifications in writing.
The five things they open first
Tap each to see what the auditor is actually testing
Order varies by auditor; the set doesn’t.
Interview questions, verbatim
Workers are interviewed without you present. The auditor is checking that the policy on paper is the practice on the ground. Prepare your team with the real questions:
Who gets asked what
These are the recurring questions from certification audits across NDIS providers.
- What would you do if a participant told you a family member was taking their money?
- Show me how you record an incident. What counts as reportable?
- How do you know what supports each participant wants and how they want them delivered?
- What do you do if a participant refuses their medication?
- How do you raise a concern about a colleague?
- When did you last have supervision, and what training have you completed this year?
- Walk me through your governance – who decides what, how often do you meet, where are the minutes?
- How do you know your workers are competent for high-intensity supports?
- Show me a risk you identified this quarter and what changed because of it.
- How do you make sure participants are not discriminated against at intake?
- What happens to participants if you are unavailable for a month?
- How do you monitor compliance with the Pricing Arrangements?
- Did you get a choice about who supports you and when?
- Were you told how to make a complaint? Would you feel safe doing so?
- Do your workers turn up on time and do what you asked?
- Has anything gone wrong, and what happened afterwards?
- Do you have a copy of your service agreement and plan?
The participant file test
Auditors sample participant files and trace a single participant from enquiry to today. A complete file contains: the referral or intake record and eligibility decision; a signed service agreement and schedule of supports; consents (privacy, photos, information sharing); a support plan with goals and a risk assessment reviewed at least annually or after an incident; progress notes that are dated, signed and factual; incident and complaint records linked back to the registers; evidence of reviews and of the participant’s involvement; and, on exit, a transition record. Files are read for voice: do the notes describe what the participant chose and did, or only what the worker did?
How findings are graded
| Grade | Meaning | What happens |
|---|---|---|
| Conformity | Outcome met with evidence | Nothing further |
| Minor non-conformity | A gap that does not put participants at immediate risk – e.g. a register not reviewed on schedule | Corrective action plan accepted; registration can proceed; closed at surveillance or next audit |
| Major non-conformity | A systemic failure or one that risks participant safety – e.g. unscreened workers, no incident system | Must be corrected and verified before the auditor recommends registration |
| Opportunity for improvement | Not a finding; the auditor’s advice | Record it in your improvement register – it shows the system works |
Audit-day simulator: could you produce these in under two minutes?
Tick only if you could hand it over right now. Auditors notice the pause.
- Current certificates of currency for public liability, professional indemnity and workers’ compensation
- Worker screening clearance number and expiry for every worker in a risk-assessed role
- Your most recent incident and what you changed because of it
- Your most recent complaint and the letter closing it
- Board or management meeting minutes from the last quarter
- A participant support plan with a risk assessment reviewed in the last 12 months
- A signed service agreement matching the current Pricing Arrangements
- Evidence of a worker’s supervision session and training this year
- Your emergency and disaster management plan with a tested contact tree
- A continuous-improvement register entry from the last 90 days
- NDIS Quality and Safeguards Commission – Audit process for registered providers, Approved quality auditor scheme, Reportable incidents
- NDIS (Provider Registration and Practice Standards) Rules 2018, Schedule 1 (Core Module)
- ISO/IEC 17021 and ISO 19011 principles applied by approved auditors (audit sampling and grading of findings)
General information only, not legal, financial or tax advice. Rules change; confirm current requirements with the regulator or a qualified professional.
Why Nemco
Built properly, priced once, owned by you – and who signs off every build.
Since 2013
Consulting, marketing and applications since 2013. A setup is that experience, packaged.
Fixed price
One number, three milestones. No hourly rates, no surprise invoices.
You own 100%
Entity, brand, site, documents, systems – yours outright. No royalties, ever.
Honest by design
No income claims. No guaranteed approvals. If it isn’t a fit, we say so on the call.
Christian Nehme · Founder & Principal Adviser
Lead Auditor
ISO 9001:2015 – trained to run the audits, not just pass them.
NDIS Internal Auditor
NDIS Internal Auditor Course – the Practice Standards from the assessor’s side.
Audit & risk in government
3+ years in audit and risk management roles in government.
Bachelor of Medical Science
A clinical-science grounding for health, disability and aged-care work.