What to expect from your NDIS Certification audit

An NDIS Certification audit is a two-stage audit against the Core Module of the NDIS Practice Standards and any supplementary modules on your scope. Stage 1 is a desktop review of your documents, and Stage 2 is a site visit, with interviews of management, staff and participants.

It applies to providers delivering higher-risk supports, and it's more involved than a Verification audit: there are significantly more standards and more evidence is required.

Are you on the Certification pathway?

The audit you undergo is determined by the registration groups you select in your application. Higher-risk registration groups trigger Certification and lower-risk groups are eligible for a Verification audit. The Initial Scope of Audit document generated by the NDIS Commission portal once you submit your application will confirm which pathway applies to you.

If you're not sure which pathway you're on, our comparison of Certification vs Verification audits walks through the differences.

Tip: Only apply for the registration groups you intend to deliver. Adding extra groups just in case can trigger a much more expensive audit and create non-conformance risk if you aren't prepared for the additional standards.

What a Certification audit assesses

A Certification audit assesses you against the Core Module of the NDIS Practice Standards, which covers four sets of standards:

• Rights and Responsibilities of Participants: including privacy, dignity, independence, decision-making support, and freedom from violence, abuse, neglect, exploitation and discrimination.
• Provider Governance and Operational Management: including governance, risk management, quality management, information management, feedback, complaints, incident management, human resources, continuity of supports, and emergency and disaster management.
• Provision of Supports: including access to supports, support planning, service agreements, support delivery, and transitions to and from a provider.
• Provision of Supports Environment: including safe environment, participant money and property, management of medication, mealtime management, and management of waste.

If your registration groups also trigger one or more supplementary modules, you'll be assessed against those in addition to the Core Module. Examples are High Intensity Daily Personal Activities (Module 1), Implementing Behaviour Support Plans (Module 2A) and Supported Independent Living (Module 5A). Your Initial Scope of Audit will list any supplementary modules that apply.

Documents and evidence you'll need

The auditor will review your policies, your records, and evidence that your system is being used. The list below is not exhaustive, but it covers the categories to have ready:

• Policies and procedures demonstrating how you meet the Core Module standards. The Certification Toolkit builds these from your answers about how your service operates.
• Service agreements with current participants, demonstrating the required information is included and that participants are aware of and have agreed to what's included.
• Participant records including support plans, risk assessments, consent documentation, and progress notes.
• Incident records with entries showing how incidents have been recorded, investigated, and resolved.
• Complaints records with evidence of how complaints have been received and addressed.
• Continuous improvement register or records showing improvement activity over time.
• Workforce records including NDIS Worker Screening clearances, NDIS Worker Orientation Module completion, qualifications, right-to-work evidence, induction records, and supervision records.
• Risk register or similar documentation listing your identified organisational risks and the controls in place to manage them.
• Insurance certificates including public liability, professional indemnity (where relevant), and any other insurance specific to your services.
• Emergency and disaster management plan with evidence it has been tested and reviewed.
• Internal audit records including audit findings and actions taken to address gaps.

If you're missing any of these, that's the work to focus on before the audit, and our free Practice Standards Gap Analysis lets you review the evidence you hold and see what's missing. For more on this, see my article on what NDIS auditors are looking for.

Stage 1: Desktop review

A Certification audit happens in two stages. Stage 1 is a desktop review, conducted before the auditor visits your site.

You provide your documentation electronically, either uploaded to the NDIS Commission's portal or through a portal or secure file transfer the auditor sets up. The auditor reads through your policies and records, identifies any gaps, and provides a report to help you prepare further for the site visit. They may come back with clarifying questions or requests for additional evidence at this stage. This is normal. Have someone available to respond promptly.

The Stage 1 review usually takes one to two weeks, depending on how quickly you respond to questions and how complete the documentation is.

Stage 2: Site visit

Stage 2 is the on-site portion of the audit. The auditor (or a team of auditors, for larger providers) visits your premises and spends time observing how the service operates, reviewing physical records, and interviewing staff and participants.

The auditor or their admin team will work with you on sampling: selecting a subset of participant files, staff files, and records to look at in detail. The number of files sampled is determined by a formula based on the size of your business (the square root of your participant or staff numbers, roughly), and the auditor will let you know which files they want to see. Our article on participant, worker and site sampling covers the rules.

How long the site visit takes depends on the size and complexity of the provider. For a small Certification provider with one location and a handful of staff, the visit might take one day. For a larger provider with multiple sites or supplementary modules, it can be several days.

During the site visit, the audit team will:

• Review physical files and environments: checking that medication storage, vehicle records, participant files, or other physical evidence supports what the policies describe.
• Interview the executive team and management: covering governance, oversight, how decisions are made, and how the system is monitored.
• Interview staff: asking how they handle incidents, how they support participants with specific needs, what training they've received, and how they raise concerns.
• Interview participants and their families (where consent is given): asking about their experience of the service, whether they feel safe and listened to, and whether they know how to make a complaint.
• Verify evidence sampled at Stage 1: confirming that the records reviewed remotely match what's held on-site.

For providers delivering services in participants' homes or in the community rather than at a fixed premises, the site visit is sometimes conducted at the provider's office (with separate arrangements for participant interviews), and might include the auditor accompanying a worker on a shift. Your auditor will discuss the arrangements with you in advance.

Participant and staff interviews

The auditor isn't testing whether your staff or participants can quote the policy. They're testing whether what staff and participants describe is consistent with what the documentation says. If your policy describes how concerns are raised and your support workers describe a different process, or no process at all, that can result in a non-conformance. The same applies if your participants describe a service that doesn't match your service model.

Make sure your team understands the systems they're part of, so they can describe how their work happens in their own words. Don't coach them on what to say.

Participant interviews are voluntary and the auditor will ask which participants are willing to be interviewed. You'll need to facilitate the contact, and participants are interviewed without you in the room.

The decision

After Stage 2, the auditor compiles their findings into an audit report. The report identifies any non-conformances (minor or major) and either recommends or doesn't recommend you for certification.

If non-conformances are identified, you'll have time to respond. Minor non-conformances typically need to be closed out within eighteen months, while major non-conformances are more serious and need to be either closed out or downgraded within three months, often via a follow-up audit. Critical non-conformances are rare and trigger immediate reporting to the Commission and other authorities if relevant. Our articles on audit non-conformities and corrective action plans cover this in more detail.

Once your audit report is complete and any required follow-ups are done, the auditor submits their recommendation to the NDIS Commission. The Commission performs the final assessment and, if approved, issues your registration certificate. From the auditor's submission to the certificate being issued, processing usually takes several months to more than a year, depending on the Commission's current workload.

Certification audit cost

A Certification audit costs significantly more than a Verification audit, and the range varies widely based on your participant numbers, staff numbers, sites, and supplementary modules.

As a rough guide, expect about $4,000 to $15,000 for an initial Certification audit for a small-to-medium provider. Mid-term audits and renewals are priced separately. Each supplementary module adds to the scope and the cost.

Prices vary by auditor. See questions to ask before engaging an NDIS auditor before you compare quotes.

Certification audit timeline

Roughly, from application to registration certificate:

• Application submission to Initial Scope of Audit: Immediately.
• Engaging an auditor and receiving quotes: One to two weeks.
• Stage 1 desktop review: One to two weeks.
• Stage 2 site visit: One to several days, scheduled around the auditor's availability.
• Audit report and any follow-up actions: Two to four weeks.
• Commission processing: Several months to more than a year, variable and (unfortunately) out of your hands.

Frequently asked questions

Can I be present during participant interviews? You shouldn't be. Participant interviews are conducted without you so that participants can speak openly. You facilitate the scheduling and may be present for introductions but don't sit in.

What happens if I get a major non-conformance? You have three months to either close it out completely or have it downgraded to a minor non-conformance. Until that happens, your auditor cannot recommend you for certification.

Do I need to be at the site visit the whole time? Someone authorised to make decisions for the business needs to be available throughout for interviews and to answer questions.

How often does the Certification audit happen? Initial certification is followed by a mid-term audit at roughly the eighteen-month mark, and then a renewal audit is due three years after your registration approval date. Each audit is its own event, with its own scope and cost.