An NDIS audit is an independent assessment of your organisation against the NDIS Practice Standards by an approved quality auditor. Lower risk supports need a verification audit, which is a desktop review of documents. Higher risk supports need a certification audit, with a desktop stage and an onsite stage. There is no fee to register with the NDIS Commission, but you pay the auditor, and the Commission does not set that price.
Which audit you need
The initial scope of audit the NDIS Commission gives you names the audit you need. As a general rule, verification is for lower risk, lower complexity supports, and certification is for higher risk or more complex supports. The Commission's registration groups table lists the audit for each support.
- Verification: a desktop review of documents, with at least 1 auditor
- Certification: a desktop stage and an onsite stage, with at least 2 auditors
- Mid-term: for most certified providers, finished 18 months into registration
- Condition: when the Commission requires one, for example after a change of ownership
- Out of cycle: when you apply to change the supports you are registered for
What a verification audit covers
Schedule 8 of the Practice Standards Rules sets four standards for verification: risk management, complaints management and resolution, incident management, and human resource management. The auditor reviews your documents against them, along with the qualifications and memberships listed in the Commission's documentation guide.
“Risks to participants, workers and the provider are identified and managed.”
Practice Standards Rules Sch 8 cl 3
What a certification audit covers
Section 5 of the Rules defines certification as a desk audit of your documents, an inspection of your sites, facilities, equipment and services, and interviews with key people and participants. The assessment has to be proportionate to your size, your scale and the complexity of your supports, and the auditor can use sampling.
Stage 1 usually happens off-site. The Commission says stage 2, the onsite audit, should take place in the 3 months after stage 1 is complete.
What an NDIS audit costs
The Commission says the cost depends on the size and scale of your organisation and the number of participants you support. It does not set prices, and it encourages you to get quotes from more than one approved quality auditor and compare them. We do not quote a typical figure here because it varies with those factors.
What the auditor looks for
The Commission describes the focus moving quickly from what your policies say to what happens in practice. Expect to show real examples, including incident reports, complaints records, training logs and supervision notes.
- Staff files sampled for screening clearances, qualifications, induction, training and supervision
- An incident followed from the first report through to its review and any notifications
- Private conversations with participants about safety, respect and how to complain
- Observation of how workers communicate, seek consent and follow the participant's plan
Telling participants about the audit
Audit sampling works on an opt-out basis. You have to tell all participants they are included and give them a chance to speak with the auditors. If someone does not want to take part, you respect that decision, document it and tell the auditor.
Ratings and what happens next
Each standard and quality indicator gets a rating. A major non-conformity gives you 3 months to fix the issue, and your registration does not progress until you have. A minor non-conformity gives you longer, and the registration process can continue.
The auditor submits the report to the Commission within 14 days of a verification audit, or within 28 days of a certification or mid-term audit.
- 3: conforms with elements of best practice
- 2: conforms with the NDIS Practice Standards
- 1: minor non-conformity
- 0: major non-conformity
The mid-term audit
Most providers who completed a certification audit need a mid-term audit. It covers the governance and operational management standards, any standard that needed a corrective action plan, and anything extra the Commission requires. The Commission's timeline has you engaging an auditor by 12 months after your registration date, with the final report in by 18 months.
It does not apply to a provider registered only for specialist disability accommodation, a transitioned provider, or an individual or partnership that needed certification only for early childhood supports.
Who has to be registered
Section 7 of the Rules lists the supports that need registration whoever funds them. A participant whose funding is managed by the NDIA also needs a registered provider.
- Specialist disability accommodation
- Supports where a regulated restrictive practice is, or is likely to be, needed
- Specialist behaviour support that includes a behaviour support assessment or plan
- Assistance with supported independent living
- An NDIS digital platform service
NDIS audit: straight answers
How much does an NDIS audit cost?
It depends on the size and scale of your organisation and the number of participants you support. The NDIS Commission does not set prices and encourages you to compare quotes from several approved quality auditors.
How long does an NDIS audit take?
It varies, because the assessment has to be proportionate to your size, scale and supports. The dates the Commission does give are these: the stage 2 onsite audit should follow within 3 months of stage 1, and the report goes in within 14 days of a verification audit or 28 days of a certification audit.
What is the difference between a verification and a certification audit?
Verification is a desktop review for lower risk supports, against the four Schedule 8 standards. Certification is for higher risk or more complex supports and adds an onsite stage with site inspections and interviews.
What documents do I need for an NDIS audit?
Policies and procedures for each standard in your scope, plus the records that show you follow them: registers, incident reports, complaints records, staff files, training logs and supervision notes. Your initial scope of audit sets which standards apply.
What happens if I get a major non-conformity?
You have 3 months to fix the issue, and your registration does not progress until it is addressed and the quality audit is complete. The Commission says a non-conformity does not mean you have failed.
Do participants have to speak to the auditor?
No. Participants are included by default but can opt out. You respect the decision, document it and tell the auditor.
Sources
Read from these editions on 5 November 2026. This guide explains the rules; it is not advice on one person's pay or one incident.
- NDIS Quality and Safeguards Commission, The quality audit process
- National Disability Insurance Scheme (Provider Registration and Practice Standards) Rules 2018, Compilation No. 6 (1 July 2026)
- NDIS Quality and Safeguards Commission, Information for quality auditors