Three auditors, three quotes, and a gap wide enough that you wonder whether they read the same application. That is the normal experience of pricing an NDIS audit, and it is not auditors being opportunistic. Your NDIS audit cost is set mostly by a scope document the Commission emails you, and most providers never read it closely enough to see what they are being charged for. What follows is what sits inside the number, and which parts of it you control.
How much does an NDIS audit cost?
There is no published price and no official range. The NDIS Quality and Safeguards Commission states plainly that it “doesn’t set prices for audit services”, and that registering with the Commission costs nothing. What you pay for is an approved quality auditor, engaged by you, as a commercial arrangement between your organisation and that firm.
The Commission does say what moves the figure. Cost depends on the size and scale of your organisation and the number of NDIS participants you support. It also encourages providers to get quotes from several approved quality auditors and compare them, which is a strong hint that the spread between quotes is wide and expected.
So treat any article that gives you a confident dollar range with suspicion, including the ones that rank above this page. Nobody can source those numbers to the regulator, because the regulator does not publish them. What you can do is work out which cost structure you fall into, and that is knowable before you ask anyone for a price.
Verification or certification decides most of the price
The audit type is the largest single factor in what you pay, and you do not choose it. A verification audit is a desktop review of documentary evidence. A certification audit runs in two stages, and one of them puts auditors in your building.
Verification applies to providers delivering lower risk, lower complexity supports. Many providers in this group already sit under professional regulation, through AHPRA or another professional body, so their competence to practise is already monitored elsewhere. The audit is a document review against a defined list, and it is the cheaper pathway by a wide margin.
Certification applies to providers delivering one or more higher risk or more complex supports. Stage 1 is a desktop audit where the auditor asks for information and evidence, usually off site, and it is where a thin evidence base tends to show up first. Stage 2 is onsite. Records viewed, sites visited, staff and participants interviewed, service delivery observed, and the Commission expects all of it inside the three months after Stage 1 finishes.
That onsite stage is where the money goes. Auditor days, travel, and the number of sites all feed in, which is why a provider with four locations across regional Victoria and a provider with one office in Preston get very different numbers for supports that look similar on paper.
The mid-term audit almost nobody budgets for
If you went through a certification audit, you have a second audit inside your registration period, and it is a separate engagement you pay for separately. The Commission sets two markers for it. At twelve months after your registration date you prepare, which means engaging an approved quality auditor and confirming scope and timing with them. By eighteen months the mid-term audit has to be finalised, with your auditor submitting the final report by the deadline.
The twelve month marker is the one that costs money when it slips. Engaging an auditor then gives you six months of runway and a real choice of firms. Leave it until the eighteen month deadline is in sight and you are taking whoever has capacity, at whatever they charge.
The mid-term audit assesses you against the NDIS Practice Standards covering provider governance and operational management, any standard that was previously assessed as requiring a corrective action plan, and any further standards the Commission decides to add. The scope is narrower than a full certification audit, which is the good news. The bad news is in the middle clause.
Every non-conformity you carry out of your first audit becomes scope in your second one. A corrective action plan is not just rework now, it is a larger and more expensive audit in twelve months. That is the clearest financial argument for getting your information management evidence in order before the first audit rather than after it.
Mid-term audits do not apply to an individual or partnership that only needed certification for early childhood early intervention supports, to a provider registered only for specialist disability accommodation, or to a transitioned provider.
Two more audits that can land mid-cycle
The Commission can require any registered provider to be audited and can specify when it happens. That is a condition audit, and it is not a penalty so much as a correction, which is why providers are often surprised to be paying for one.
It can be imposed during your registration period if you initially completed a provisional certification audit, if not all of your certification classes of support were witnessed at your audit, if you have minor non-conformities still outstanding, if a change of ownership significantly changes the organisation or its governance, or if the Commissioner simply considers it necessary. The first three of those are consequences of how your last audit went, which is the same pattern as the mid-term: today’s loose ends are next year’s invoice.
The other one is voluntary. An out of cycle audit is something you organise yourself, at a time you choose, to support an application to change your registration, for example to add registration groups or expand what you deliver. Worth knowing before you promise a new service to a participant, because the audit sits between the promise and the delivery.
Where the money actually goes across a registration cycle
Costs arrive as separate events, not as one invoice. Laying them out by pathway shows why two providers quote so differently.
| Cost event | Verification pathway | Certification pathway |
|---|---|---|
| Registering with the Commission | No fee | No fee |
| Initial audit | Desktop review of documents | Stage 1 desktop, then Stage 2 onsite within three months |
| Onsite auditor days and travel | Not generally applicable | Billed, and driven by site count and location |
| Mid-term audit, prepared at twelve months and finalised by eighteen | Not required | Required, with limited exclusions |
| Carrying a corrective action plan | Rework and fresh evidence | Rework, fresh evidence, and wider mid-term scope |
| Condition audit imposed by the Commission | Possible | Possible, and the Commission can set the timing |
| Out of cycle audit to change your registration | Optional, and you choose when | Optional, and you choose when |
| Re-registration before expiry | Repeat the verification audit | Repeat the certification audit |
| A condition imposed over your application | Possible | A fresh certification audit, both stages |
Before you ask for quotes, it is worth knowing which of your systems would survive a Stage 2 visit. The free Essential Eight Maturity Level 1 assessment takes five minutes and tells you where your access control and backup evidence sits today.
How to get quotes you can actually compare
Send every auditor the same Initial scope of audit document, and the quotes become comparable. Without it you are asking several firms to price an unknown, and you will get back numbers that cannot be lined up against each other.
The Commission emails that document after you submit your application. It sets out the type of audit you need, your registration groups, also called classes of support, and the types of supports you intend to deliver. The Commission’s own advice on applying for registration is to use it to request a quote, to get more than one, and to ask the auditor questions to confirm they suit your organisation.
Ask about the things that drive the invoice rather than the headline figure. How many auditor days, how many of them onsite, whether travel is included or billed separately, and what happens to the fee if a non-conformity means re-work. A quote that arrives without any questions about participant numbers and site count was priced for a different organisation.
One operational note worth knowing: from 12 October 2026 the Commission runs two provider portals, and new applications go through the new NDIS Commission Portal. In that portal you select your approved quality auditor after submitting Part 2. Staying with the same auditor across a full cycle also tends to pay off, because an auditor already familiar with your service gives more consistent audits and clearer feedback.
The most expensive mistake is buying your policies
Purchased policies that do not describe how your organisation actually works can cost you an entire second certification audit. The Commission can impose a condition on your registration requiring a new certification audit, stage 1 and stage 2, together with a new self-assessment against the applicable NDIS Practice Standards.
Consultants are allowed. What the Commission expects is that you were substantially involved in preparing the application, that you understand what was submitted and can explain it, that it accurately represents your organisation, and that the responses are specific to you rather than a direct copy of purchased documents. It also warns that consultants supplying the same or very similar material to many providers can itself indicate that the provider does not understand the standards, and that this may subvert the audit and suitability assessment process. An application in that position may be refused.
There is a harder edge to this as well. Providing false or misleading information in a registration application contravenes section 73D of the National Disability Insurance Scheme Act 2013, carrying a civil penalty, and is a criminal offence under section 137.1 of the Criminal Code Act 1995. Existing registered providers can have registration suspended or revoked for it.
Read that as a pricing question and the arithmetic turns around. The cheapest route to an application that looks compliant is also the one that risks paying for the most expensive audit twice.
Leaving re-registration until the last month
You can start re-registration at any point in the six months before your registration expiry date, and starting inside that window keeps your current registration valid until the Commission decides on your application. Start after your expiry date and your registration has already lapsed.
A lapsed registration means you have no valid registration while the application is assessed. That is a revenue and continuity problem rather than an administrative one, and it is avoidable. Auditor availability is the real constraint, because the firms worth using are booked well ahead, and a provider counting backwards from expiry with six weeks in hand has lost the ability to compare quotes at all.
What to do this week
Find your Initial scope of audit document and confirm from it whether you are verification or certification. That one line determines most of what you will pay, and a surprising number of providers are not certain which applies to them.
If you are certification, put two dates in the calendar: twelve months from your registration date to engage an auditor for the mid-term, and eighteen months for the final report to be in. Put any corrective action plan next to them, because that is what decides how big the mid-term becomes. Then find your expiry date and count back six months, so re-registration starts inside the window rather than after it. The NDIS audit checklist covers what an auditor asks for once the engagement starts.
Where the gaps are structural rather than clerical, that is a different job. Mapping obligations to controls and producing evidence an auditor accepts is what our governance and risk service does.
Before any of it, get a baseline you can show an auditor. The free Essential Eight Maturity Level 1 assessment takes five minutes and tells you which controls you can already evidence.
Last reviewed: 18 October 2026.
This article is general information, not legal advice. Audit requirements and costs depend on your registration groups, your scale and your circumstances. Confirm your own obligations with the NDIS Quality and Safeguards Commission or your approved quality auditor.