The rules for how many participants an auditor reviews, how many workers they interview, and how long your audit runs are set out in Annex B of the NDIS (Approved Quality Auditors Scheme) Guidelines 2018, a legislative instrument that approved quality auditors are required to follow. This article covers participant sampling, worker sampling, site attendance, and how audit duration is calculated.
What auditors are doing when they sample
The legislation describes sampling as evidence-based auditing, where participant experiences are a central part of how auditors assess whether a system is working. An auditor reads your policies, then looks for evidence that those policies are operating as written. Participant files, participant interviews, worker interviews, and site visits are the primary sources of that evidence.
The sampling rules set minimum requirements. Auditors can go broader, and should if they find problems within the minimum sample. Finding a nonconformity within the minimum sample triggers an increase in sample size to determine whether the issue is systemic or a one-off.
Participant sampling
Who gets counted
The participant sample size is calculated from what the guidelines call the “sample population number.” This is not the total number of participants you serve. It excludes participants who receive only services in the registration groups listed in Annex D of the guidelines — broadly the lower-contact or equipment-based registration classes, including therapeutic supports, exercise physiology, household tasks, community nursing care, assistive products, and plan management.
If a participant receives one of those services alongside a higher-contact service, they stay in the sample population. They only drop out if Annex D services are the only thing they receive from you.
The calculation
If the sample population is 5 or fewer, the minimum sample size equals the sample population number — every participant is included.
If the sample population is greater than 5:
- Certification or recertification audit: take the square root of the sample population number, round up to the nearest whole number.
- Midterm audit: take the square root of the sample population number, multiply by 0.6, then round up to the nearest whole number.
A provider with 30 participants in the sample population has a minimum sample size of 6 for a certification audit (√30 = 5.47, rounded up to 6). For a midterm audit, that drops to 4 (5.47 × 0.6 = 3.28, rounded up to 4).
The minimum sample covers both participant files and participant interviews. An auditor reviewing 6 files is also expected to conduct 6 participant interviews — they are not interchangeable, both are required.
Opt-out, not opt-in
Participants are automatically enrolled in the audit sample unless they choose not to be. The provider is responsible for advising participants of this before the audit, documenting any who opt out, and passing that information to the auditor. Participants who opt out are removed from the available pool, but they do not reduce the minimum sample size. If your minimum is 6 and two participants opt out, the auditor needs 6 from the remaining pool.
High-risk registration groups
If you are registered for any of the five high-risk registration groups — High Intensity Daily Personal Activities, Specialist Positive Behaviour Support, Early Intervention for Early Childhood, Specialist Disability Accommodation, or Specialist Support Coordination — the sample must include participants from those groups regardless of whether they fall into the random draw. If the initial random sample does not include them, the sample is redrawn until it does.
Who controls the sample selection
Providers do not select the sample. The guidelines are explicit: approved quality auditors shall not allow the provider to preselect samples. This applies to participant files, participant interviews, and worker interviews.
Worker sampling
There is no minimum worker number expressed as a formula. The requirement is that the worker sample must include people in governance, management, and direct service delivery roles. Where your service operates across shifts, workers from all shifts must be represented.
For a small provider this typically means the director or manager alongside some of the workers delivering supports. For a larger provider, the audit team will want to speak with board-level or senior management as well as frontline workers, and will not treat management interviews as a substitute for speaking with delivery staff.
Workers cannot be interviewed solely in groups. The guidelines require that auditors conduct individual interviews as well.
Site attendance
Single-site providers
If you operate from one site, that site must be attended.
Multi-site providers
The minimum number of sites an auditor attends is calculated as follows:
- Certification or recertification: take the square root of total sites (including head office), round up to the nearest whole number.
- Midterm: take the square root of total sites, multiply by 0.6, round up to the nearest whole number.
Head office must always be among the sites attended. If you deliver high-risk registration group services at a particular site, that site must also be included.
A provider operating from 9 sites (including head office) has a minimum of 3 sites visited at certification (√9 = 3). At midterm, that is 2 (3 × 0.6 = 1.8, rounded up to 2).
Audit duration
The legislation sets a minimum audit duration of half a day — four hours of actual audit activity from opening meeting to closing meeting.
Your approved quality auditor is required to have a documented process for calculating stage two audit duration. That process must take into account, at minimum:
- the size and complexity of your service, including geographic spread between your primary hub and any regional or outreach services
- the results of any prior audits
- the sampling methodology applied to your scope
- whether technical experts are involved
- the auditor body’s own auditing practices
Audit duration must also comprise at least 80% of the estimated total audit time. Audit time, as defined in the legislation, excludes time spent writing the report and submitting it to the Commission — so the on-the-ground audit activity has to make up the bulk of the time.
Your auditor provides a quote before the audit commences, based on the initial scope of audit document generated by the Commission’s system. If your scope changes after that point — for example, if your participant numbers have grown — the cost and duration may change with it.
Provisional audits
If you have not yet commenced service delivery, you undergo a provisional audit rather than a standard certification audit. The sampling requirements in Annex B do not apply. There are no participants to interview and no files to review. The audit assesses whether your systems and processes are in place to meet the Practice Standards once you begin delivering services. Once you have participants, a further stage two audit is typically required before your midterm.
What to have ready
If you have 25 participants in your sample population, your minimum sample is 5. Those 5 participants will have their files reviewed and will be contacted for interview. Auditors will be looking at those files for evidence that your documented processes are being followed — support plans that reflect the individual, records of reviews, incident entries, progress notes that connect to participant goals. Current and complete participant files matter more than a polished policy manual.
Auditors will also speak with the people delivering supports, not just the person who wrote the policies. Workers who can describe how they handle an incident, a complaint, or a safeguarding concern in their own words are meaningful evidence. Workers who are not aware that a policy exists are a problem, regardless of what the policy says.
The sampling and duration requirements in this article are drawn from Annex B of the NDIS (Approved Quality Auditors Scheme) Guidelines 2018 (Compilation No. 5, November 2025).
The rules for how many participants an auditor reviews, how many workers they interview, and how long your audit runs are set out in Annex B of the NDIS (Approved Quality Auditors Scheme) Guidelines 2018, a legislative instrument that approved quality auditors are required to follow. This article covers participant sampling, worker sampling, site attendance, and how audit duration is calculated.
‘Sampling’ in audit language refers to who gets spoken to and how many files/records need to be reviewed.
What auditors are doing when they sample
The legislation describes sampling as evidence-based auditing, where participant experiences are a central part of how auditors assess whether a system is working. An auditor reads your policies, then needs to see evidence that those policies are operating as written. Participant files, participant interviews, worker interviews, and site visits are the primary sources to see if your systems are working.
The sampling rules set minimum requirement, but auditors can go broader, and should do if they find problems within the minimum sample. Finding a non-conformity within the minimum sample can trigger an increase in sample size to determine whether the issue is systemic or a one-off.
Participant sampling
Who gets counted
The participant sample size is calculated from what the guidelines call the ‘sample population number’. This is not the total number of participants you serve, as it doesn’t include participants who receive only services in the registration groups listed in Annex D of the guidelines. For the most part, these are supports that are deemed lower risk, including therapeutic supports, exercise physiology, household tasks, community nursing care, assistive products, and plan management.
If a participant receives one of those services alongside a higher-contact service, they stay in the sample population, but they drop out if they only receive a lower risk support.
The calculation
If the sample population is 5 or fewer, the minimum sample size equals the sample population number , so every participant is included. If you support 4 participants (with higher risk supports), they’re all automatically included.
If the sample population is greater than 5:
- Certification or recertification audit: take the square root of the sample population number, and round up to the nearest whole number.
- Midterm audit: take the square root of the sample population number, multiply by 0.6, and round up to the nearest whole number.
A provider with 30 participants in the sample population has a minimum sample size of 6 for a certification audit (√30 = 5.47, rounded up to 6). For a midterm audit, that gets reduced slightly to 4 (5.47 × 0.6 = 3.28, rounded up to 4).
The minimum sample covers both participant files and participant interviews, e.g. an auditor reviewing 6 files is also expected to conduct 6 participant interviews.
Opt-out, not opt-in
Participants are automatically enrolled in the audit sample unless they choose not to be, which differs from a lot of other human services auditing/certification schemes. The provider is responsible for advising participants of this before the audit, documenting any who opt out, and passing that information to the auditor. Participants who opt out are removed from the available pool, but this doesn’t reduce the minimum sample size. If your minimum is 6 and two participants opt out, the auditor needs 6 from the remaining pool.
Of course, participant choice is respected on audit day. If a participant doesn’t opt-out, but changes their mind on the day and doesn’t wish to speak to the auditor, this will be respected by the audit team. If you aren’t able to meet the minimum number of participants to sample, auditors can’t require participants to be involved, but they are however required to include a note of how many participants opted out of the process.
High-risk registration groups
If you are registered for any of the supports that trigger a supplementary module to be audited (High Intensity Daily Personal Activities, Specialist Positive Behaviour Support, Early Intervention for Early Childhood, Specialist Disability Accommodation, or Specialist Support Coordination, Implementation of Restrictive Practices) the sample must include participants from those groups regardless of whether they fall into the random draw. If the initial random sample does not include them, the sample should be taken until it does.
Who controls the sample selection
Providers do not select the sample. The guidelines are very clear on this: approved quality auditors shall not allow the provider to preselect samples. This applies to participant files, participant interviews, and worker interviews.
Worker sampling
There is no minimum worker number expressed as a formula. The requirement is that the worker sample must include people in governance, management, and direct service delivery roles. Where your service operates across shifts, workers from all shifts need to be represented.
For a small provider this typically means the director or manager alongside some of the workers delivering supports. For a larger provider, the audit team will want to speak with board-level or senior management as well as frontline workers, and won’t treat management interviews as a substitute for speaking with delivery staff.
Site attendance
Single-site providers
If you operate from one site, that site must be attended.
Multi-site providers
The minimum number of sites an auditor attends is calculated as follows:
- Certification or recertification: take the square root of total sites (including head office), round up to the nearest whole number.
- Midterm: take the square root of total sites, multiply by 0.6, round up to the nearest whole number.
Head office must always be visited. If you deliver high-risk registration group services at a particular site, that site must also be included.
A provider operating from 9 sites (including head office) has a minimum of 3 sites visited at certification (√9 = 3). At midterm, that is 2 (3 × 0.6 = 1.8, rounded up to 2).
Audit duration
The legislation sets a minimum audit duration of half a day, which is four hours of actual audit activity from opening meeting to closing meeting. In my professional experience, four hours of audit activity is not sufficient to do an audit well even for a small provider, however the rules do allow for this shorter duration.
Your approved quality auditor is required to have a documented process for calculating stage two audit duration, so they can’t just give you a four hour audit because you ask for it. That process must take into account, at minimum:
- the size and complexity of your service, including geographic spread between your primary location and any regional or outreach services
- the results of any prior audits
- the sampling methodology applied to your scope
- whether technical experts are involved
- the auditor body’s own auditing practices
Audit duration must also comprise at least 80% of the estimated total audit time. Audit time, as defined in the legislation, excludes time spent writing the report and submitting it to the Commission, so the on-site audit activity has to make up the bulk of the time.
Your auditor provides a quote before the audit commences, based on the initial scope of audit document generated by the Commission’s system. If your scope changes after that point (e.g. your participant numbers change or you add new sites), the cost and duration may need to be updated prior to Stage 2.
Provisional audits
If you have not yet commenced service delivery, you are entitled to undergo a provisional audit rather than a standard certification audit, and the sampling requirements in Annex B don’t apply, because there are no participants to interview and no files to review. The audit assesses whether your systems and processes are in place to meet the Practice Standards once you begin delivering services. Once you have participants, a further stage two audit is typically required.
What to have ready
If you have 25 participants in your sample population, your minimum sample is 5. Those 5 participants will have their files reviewed and will be contacted for interview. Auditors will be looking at those files for evidence that your documented processes are being followed, e.g. support plans that reflect that individual, records of reviews, incident reports, and progress notes that connect to participant goals.
Auditors will also speak with the people delivering supports, not just the managers who wrote the policies. Staff training in your policies and procedures and on-the-ground processes are crucial, not just for audit time, but to ensure you can run a safe, effective service for your participants.
