How NDIS Corrective Action Plans Work

Under the NDIS (Approved Quality Auditors Scheme) Guidelines 2018, providers have seven calendar days from written notification of a non-conformity to submit a corrective action plan to the auditor.

This article covers the close-out process and the deadlines you'll need to meet. If you've just received a finding and want to understand what it means, start with our guide to NDIS audit non-conformities.

Audit ratings

Every indicator in your audit will receive one of the following ratings:

Rating	Attainment level	What it means
3	Conformity with elements of best practice	You can clearly demonstrate best practice, i.e. innovative, responsive service delivery underpinned by continuous improvement of your systems and processes.
2	Conformity	You can clearly demonstrate the outcomes and indicators are met, through practice evidence, training, records or other evidence.
1	Minor non-conformity	A gap requiring a corrective action plan before certification or verification can be recommended
0	Major non-conformity	A higher risk gap, where you can't currently demonstrate appropriate processes, systems or structures. Precludes a recommendation for certification

What makes a non-conformity minor

The guidelines describe two situations that will lead to a finding of 'minor non-conformity'.

You have an appropriate process, system or structure in place and implemented, but the supporting documentation isn't sufficient. The practice is good, but there isn't enough documented evidence to demonstrate it's being consistently followed.
A documented process is evident, but you can't demonstrate implementation review or evaluation. The document is in place but there's no evidence that you've checked how it's working in practice.

Major non-conformities

A rating of 0 means you weren't able to demonstrate appropriate processes, systems or structures to meet the outcome and indicators, or the gaps present a high risk. Three minor non-conformities within the same module can also lead to an overall major non-conformity for that module.

7 days to write the corrective action plan

Seven calendar (not business) days from the day you received written notification of your non-conformity. Don't wait for the audit report before you start on your corrective action plan.

The guidelines don't prescribe a format for corrective action plans, and your auditor might provide a template. Look at covering two key things:

Correction. If relevant, what you did about the specific instance that led to the non-conformity, e.g. the missing consent form is now on file.
Corrective action. What you changed in your system so it doesn't recur, e.g. consent is now collected at intake, the intake checklist includes it, and the team lead checks it monthly.

Closing a major: three calendar months

Your auditor will do a review of the implemented corrective actions within three calendar months of receiving your plan, and can follow up on site if they feel that they need to (i.e. if the risk is higher). Critical risks and other serious matters are more likely to require an on-site follow-up.

Major non-conformities have to be downgraded or closed within three calendar months of the initial written notification. Downgrading and closing are different outcomes, and a downgrade starts a new clock.

At a mid-term or recertification audit, failing to downgrade or close a major within three months can result in suspension of the certification decision.

Closing a minor: eighteen calendar months

Minor non-conformities have to be closed out within eighteen calendar months of the initial written notification, or at your mid-term or recertification audit, whichever comes first. If you don't do this in time, it will be escalated to a major non-conformity.

Once a minor has been escalated to a major, it needs to be closed within three calendar months or it can lead to an automatic suspension of the certification decision. An escalated major also can't be downgraded back to a minor, it needs to be fully closed out.

If a major is downgraded to a minor

A downgraded major has to be closed within twelve calendar months from the date the original finding was issued, so if the downgrade took the full three months, you have nine months left. It can't be escalated back to a major.

Finding	Deadline	If you miss it
Corrective action plan	7 calendar days from written notification	The plan is late
Major	Downgraded or closed within 3 calendar months	At mid-term or recertification, automatic suspension of the certification decision
Minor	Closed within 18 calendar months, at mid-term or recertification	Escalated to a major
Minor escalated to major	Closed within 3 calendar months	Suspension, can't be downgraded back
Major downgraded to minor	Closed within 12 calendar months of the original finding	Suspension, can't be escalated again

There's work to do after it's closed

Where a major or minor non-conformity was raised, the relevant outcomes get audited again at your mid-term or recertification audit, whichever comes first, to check that the processes you developed in the corrective action plan were actually put into practice.

Make sure you have processes in place to monitor your corrective action plans, and review that they've been implemented correctly and successfully.

Common oversights

Fixing the document but not the practice. Particularly where the finding was about implementation review. A revised policy doesn't answer a question about whether anyone evaluated the old one.

Submitting the new policy as evidence of implementation. Implementation evidence includes items like completed forms, meeting minutes, a register with entries in it, and training records.

Waiting for the draft or final audit report. The seven days run from written notification of the non-conformity, not from the report being sent.

Treating a downgrade as a close. A major downgraded to minor is still open, and it now has to close within twelve months of the original finding.

Treating "staff error" as the root cause. If a worker did the wrong thing, the question is what in your system let that happen, e.g. induction, supervision, an unclear procedure, or a form that wasn't distributed. Root cause analysis generally should look wider than the individual.

A good corrective action plan

A correction for the specific instance
A root cause that looks at the system, not the person involved
A corrective action that changes the system
A named person responsible for implementing the changes and a realistic date
A check built in to ensure it's still being implemented as time passes

If you'd rather find these gaps yourself than have an auditor find them, our guide to internal auditing for NDIS providers covers how to run the same process on yourself.