The auditor has sent through the document request, your renewal date is set, and somewhere in it is a line about your information management system. For most providers that line is the least prepared part of the file. This NDIS audit checklist covers what an auditor asks for once they reach your records and systems, and what you can fix in the fortnight before they arrive.
Policies are the easy half. The auditor is there to see whether the system behind the policy works on an ordinary Tuesday.
Supported independent living: the 1 October 2026 deadline has passed
That date has gone, and it sorted supported independent living providers into two groups. If you lodged a valid registration application before 1 October 2026 you can keep delivering while it is assessed, and if you did not, the NDIS Quality and Safeguards Commission’s position is that you need to stop.
Mandatory registration for supported independent living commenced on 1 July 2026. The concession that followed was never an extension of that start date. It was permission to keep working during the assessment, and it was conditional on applying in time.
Providers who applied are now somewhere inside the audit. The pathway runs through a certification audit against the core module and the supported independent living Practice Standards, under class of support 0138 Assistance with supported independent living, and the Commission’s own transition pathway for supported independent living providers has them continuing to deliver through both the audit and the application review that follows it. NDIS digital platform providers came into mandatory registration on the same 1 July 2026 date, under class 0137.
For providers who did not apply, the Commission is direct:
If you are currently delivering supported independent living (SIL) and chose not to apply for registration, you will need to stop providing supported independent living supports.
Continuing anyway is not a paperwork problem. The Commission calls it a serious offence and attaches a figure to it:
If you deliver supported independent living on or after 1 July 2026 without being registered, you may breach the NDIS Act. The maximum penalty is 2 years’ imprisonment, a fine of 120 penalty units, or both.
Read the date in that sentence rather than the penalty. Exposure runs from 1 July 2026, not from 1 October, so an unregistered provider who kept delivering through winter is not looking at something that started last week.
Stopping has its own obligations, and they are the half that gets missed. The Commission’s guidance on stopping the services you provide sets out what an exit actually requires:
- Notify the NDIS Commission through the provider portal as soon as possible.
- Notify the National Disability Insurance Agency separately, by email to provider.support@ndis.gov.au. Telling one body does not tell the other.
- Write a transition plan covering how affected participants will be notified and supported.
- Tell participants in an accessible way, including dates, options, next steps and contact details.
- Work through the move with each participant individually, because which provider they go to is their decision, not yours.
Unregistered providers are not outside any of this. The Commission applies the NDIS Code of Conduct to providers stopping services whether they hold registration or not, so an exit handled badly carries its own consequences on top of the ones already running.
If you are in the second group, the order matters. Stop delivering supported independent living, notify both bodies, then transition participants properly. Registration can still be applied for afterwards, and a participant left without supports in the meantime is the part nobody gets to repair later.
What is an NDIS audit?
An NDIS audit is an independent assessment of your organisation against the NDIS Practice Standards, carried out by an approved quality auditor rather than by the NDIS Quality and Safeguards Commission itself. Those auditors are accredited by the Joint Accreditation Scheme for Australia and New Zealand. You choose one, you pay them, and they submit the report to the Commission.
Which standards apply depends on what you deliver. The Commission’s guidance on audit types splits it two ways: verification for lower risk, lower complexity supports, certification for higher risk or more complex ones. Verification is largely a desktop review. Certification runs in two stages, an off-site review then an onsite stage within three months, with staff and participant interviews and observation of support delivery.
How often are NDIS audits, and which one will you get?
Registered providers are generally registered for three years, and the audit cycle follows that period. If your initial audit was a certification audit, a mid-term audit follows 18 months into the registration period.
Two other triggers matter. The Commission can require a condition audit at any point, and changing the supports you deliver mid-period can prompt an out of cycle audit. The Commission gives you an initial scope of audit telling you which type applies.
Report timing is tighter than providers expect: up to 14 days after a verification audit, 28 days after a certification or mid-term audit. Whatever the auditor could not verify on the day is what lands in it.
Where the information management standard actually bites
The requirement that catches providers out sits in the core module, under provider governance and operational management. The Practice Standards put the outcome in one sentence:
Management of each participant’s information ensures that it is identifiable, accurately recorded, current and confidential. Each participant’s information is easily accessible to the participant and appropriately utilised by relevant workers.
Read those five words as five separate tests, because that is how they get assessed. Identifiable. Accurately recorded. Current. Confidential. Accessible to the participant. A shared drive every support worker can open fails the fourth while passing the first three, and a locked system nobody can produce a record from has the opposite problem.
Two of the quality indicators underneath it are the ones auditors quote back at you. One asks for an information management system, proportionate to the size and scale of the organisation, recording each participant’s information accurately and in a timely manner. The other is a list: documents stored with appropriate use, access, transfer, storage, security, retrieval, retention, destruction and disposal processes.
Nine processes. Most providers can evidence three of them.
NDIS audit checklist: the systems and records an auditor asks for
This is the information management side of the file, not the whole audit.
| What the auditor asks | What counts as evidence | Where it usually falls over |
|---|---|---|
| Who can see participant records, and how you know | An access list per system, tied to roles, with a date it was last reviewed | Everyone can see everything, because the service grew and nobody revisited it |
| How a participant gets a copy of their own information | A written process, and one worked example you can show | The right exists in the policy, and nobody has ever used it |
| Consent to collect, use, retain and disclose information | Signed consent covering purpose, and when information may be disclosed without consent if law requires it | Consent forms that cover collection and go quiet on disclosure |
| What happens when a worker leaves | An offboarding record showing access revoked, with the date, across every system and device | Accounts still active weeks later, which is also a worker screening problem |
| Retention and disposal | A schedule with periods and a disposal record. The Commission’s provider guidance says participant records should be retained for a minimum of seven years after service provision | Nothing is ever deleted, so disposal cannot be evidenced at all |
| Incident records, end to end | One incident traced from report through to resolution, with dates that line up | The record exists but the timeline has gaps the auditor can see |
| Backup and recovery of participant records | A restore that was actually tested, with the date and who did it | Backups run, and no one has restored from them |
| Records held on personal phones | Device management, or a defensible reason there is none | Progress notes and photographs on staff phones, outside any system you control |
That last row is the one most providers have no answer for. If your support workers record notes in participants’ homes, our case study on securing a field workforce using personal devices is the closest match.
Before you build the evidence file, the free Essential Eight Maturity Level 1 assessment scores the technical controls under most of those rows.
Incident records are assessed on timing, not just content
Incident management appears in both the core module and the verification module, so every registered provider is assessed on it. The notification clock is the part auditors test against your records.
Registered providers must notify the Commission within 24 hours of becoming aware of the death of a person with disability, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, or sexual misconduct. Use of a restrictive practice that is unauthorised or outside a behaviour support plan carries five business days, unless it caused harm, in which case the 24 hour clock applies. The Immediate Notification Form goes in within 24 hours, the 5 Day Form within five business days.
The second stage is the 5 Day Form, carrying the additional information and the actions you took. It is due within five business days of becoming aware of the incident, not five days after you lodged the first notification, so a late immediate notification eats into the same window.
The Commission’s guidance also fixes when awareness starts: when a worker tells a member of key personnel, a supervisor or manager, or whoever your incident management system names as responsible for notifying. Your records have to make that provable afterwards, which means a recorded time, not just a date.
How much does an NDIS audit cost?
Nobody can quote you a figure from a table. In the Commission’s words, “The NDIS Commission doesn’t set prices for audit services.” Registration itself costs nothing; the audit is the cost.
What drives it is the size and scale of your organisation and how many participants you support, which is why the Commission encourages providers to get quotes from several auditors and compare them. A quote that arrives without questions about participant numbers and site count is for a different organisation.
Do unregistered NDIS providers get audited?
Until recently this was a clean no: the quality audit exists to assess providers against the Practice Standards for registration, so an unregistered provider had no registration audit to sit. Supported independent living has changed that, and platform providers with it. If you deliver SIL, the answer is now that you will be audited, because you have to register.
For everyone else the older answer still holds, with a caveat. The NDIS Code of Conduct applies to unregistered providers, their key personnel and their workers exactly as it applies to registered ones, and the Commission can act either way. Only participants who self-manage or plan-manage can choose an unregistered provider, and some supports require registration outright.
A second obligation follows you regardless of registration. If you provide a health service and hold health information, the Privacy Act 1988 applies no matter what you turn over. The $3 million small business threshold does not help a health service provider, as the OAIC states plainly. Allied health practices delivering NDIS supports sit under both regimes at once.
How to pass: the fortnight before
Pick the evidence, not the policy. An auditor asking how you know participants are safe wants a record with a date on it, and you can assemble those in two weeks even if the underlying system is imperfect.
Four things, in order.
- Pull the access list for every system holding participant information, and remove anyone who has left.
- Trace a single incident from first report to resolution, and check the dates are consistent with the notification timeframes above.
- Restore one file from backup. Note who did it and when, because the note is the evidence, not the restore.
- Find your retention schedule. If there is not one, a single page on how long you keep records and how you destroy them will do.
If a suspected data breach lands during your audit window, the Notifiable Data Breaches scheme gives you 30 calendar days to complete an assessment, not 72 hours. The OAIC’s guidance sets that out under section 26WH(2), and expects 30 days to be treated as a maximum rather than a target.
What to do this week
Book the auditor first. Lead time is the constraint you cannot compress, and everything else here can be done while you wait. Then spend an hour on the access list, the only item that gets worse every week you leave it.
Structural gaps are a different job. Mapping obligations to controls and producing evidence an auditor will accept is what our governance and risk service does, with patient and participant data protection underneath it.
Before either, get a baseline. The free Essential Eight Maturity Level 1 assessment takes five minutes and tells you which controls you already have.
Last reviewed: 15 September 2026.
This article is general information about NDIS and privacy obligations. It is not legal advice, and it does not describe your organisation’s legal position. Confirm your own obligations with the NDIS Quality and Safeguards Commission, the OAIC, or your own adviser.