The NDIS Commission’s enforcement activity rose 214 percent year on year in its latest Annual Report. Real NDIS audit readiness is a standing state, not something you assemble in the weeks before an auditor arrives.
Most providers who fail part of an NDIS audit don’t fail because the policy didn’t exist. They fail because nobody could show the auditor the policy actually being followed. This article sets out what NDIS audit readiness actually looks like, drawn directly from the NDIS Commission’s own auditor guidance rather than a generic checklist, and where providers most commonly get caught out.
Why This Matters More Than It Used To
The NDIS Commission’s 2024-25 Annual Report, tabled in Parliament on 6 November 2025, reported a significant increase in compliance and enforcement activity, with outcomes increasing 214 percent year on year, alongside major uplifts in banning orders, compliance notices and civil penalty actions. Separately reported figures put the Commission’s compliance and enforcement activity at 6,841 actions in a single reporting period, including banning orders against both organisations and individuals. The Commission has described itself as maturing into a risk-based, data-driven regulator, which in practice means audits increasingly test whether your evidence holds up, not just whether your policy folder is complete.
Verification Audit or Certification Audit: Which Applies to You
Your audit pathway depends on what you deliver, not on the size of your organisation. The verification audit vs certification audit distinction comes down to risk level. Verification audits apply to lower-risk supports and are largely a documentation review, generally requiring one auditor and no site visit. Certification audits apply to higher-risk or more complex supports, involve at least two auditors, and include site visits, staff interviews and direct observation of service delivery, not just a desktop review.
Certified providers face a mid-term audit roughly 18 months into their three-year registration cycle, and the full registration renews every three years through a recertification audit. Both audit types assess you against the NDIS Practice Standards Core Module, plus any supplementary modules relevant to the supports you deliver.
What “Ready” Actually Means
An NDIS Practice Standards audit doesn’t stop at whether a policy document exists. Auditors assess evidence across four sources: your documents, your records, what they observe directly in your service delivery environment, and what your workers and participants say when interviewed. A policy that has never been tested against a real participant, a real shift, or a real incident is exactly the kind of gap an NDIS Approved Quality Auditor is trained to find.
The Corrective Action Plan Clock You Don’t Want to Discover Mid-Audit
If an auditor raises a NDIS non-conformity, you don’t get an open-ended timeline to fix it. Under the NDIS Commission’s own auditor guidance, once a non-conformity is raised, you must provide a NDIS corrective action plan within seven calendar days of written notification. That first week is where most providers lose ground, because a rushed corrective action plan is easier for an auditor to reject than a considered one.
From there, the timeframes diverge by severity. A minor non-conformity generally needs to be closed out within 18 calendar months, checked at your next mid-term or recertification audit, whichever comes first. A major non-conformity carries a much tighter clock: a follow-up audit within three calendar months to verify the corrective action was genuinely implemented, not just documented. If a major non-conformity remains unresolved at that follow-up, certification is automatically suspended.
A minor non-conformity left open past its 18-month window doesn’t just sit there either. It escalates to a major, and an escalated major cannot be downgraded back to a minor. It has to be fully closed out, on the tighter three-month clock, before certification is safe again.
The Most Common Reasons Providers Fail
The pattern behind most audit findings is consistent across the sector: incomplete or missing policy documents, no evidence that policies are actually implemented day to day, gaps in incident management records, missing worker screening checks, insufficient staff training records, and thin documentation of participant consent and support planning. Almost none of these are a single catastrophic failure. Nearly all of them are a record that should exist, somewhere, but can’t be produced on request.
A Working NDIS Audit Readiness Checklist
Treat this as a starting working document, not a substitute for guidance from your Approved Quality Auditor.
Documentation
- Every policy is dated, version-controlled, and reviewed on a defined schedule, not last touched at your previous audit.
- Policies describe what actually happens in your service, not an aspirational version written to look complete.
Records
- Incident records show structured follow-up through to resolution, not just the initial report.
- Worker screening checks are current for every worker delivering supports, with expiry dates tracked, not assumed.
- Staff training and competency records exist per worker, not as a single generic induction certificate.
Evidence of practice
- Participant files show consent and support planning as an ongoing process, not a one-off form signed at intake.
- Workers can describe, in their own words, how your policies apply to a specific participant, since interviews are part of a certification audit.
Corrective action readiness
- A named person owns the response if a non-conformity is raised, so the seven-day corrective action plan clock doesn’t start with nobody assigned.
- Previous corrective action plans are tracked to their 18-month or 3-month close-out date, not filed away and forgotten.
Where This Actually Breaks Down Operationally
In practice, most providers already do the underlying work. What breaks is the trail connecting a policy to a specific participant, worker, and date, when incident records, training certificates, and worker screening checks live in separate systems, spreadsheets, and filing cabinets that don’t talk to each other.
This is where NDIS software built around evidence, rather than adapted from a generic business tool, earns its keep. Inclusify’s exception management flags an expiring worker screening check or an unresolved incident follow-up before an auditor does, and duty packs keep the evidence for each Practice Standards outcome attached to the participant and shift it relates to, so a corrective action plan response starts from an existing record instead of a reconstruction project. You can see how the pieces connect on our platform overview page.
This pattern shows up across every major reform hitting the sector this year, from the stronger regulator powers in the NDIS Integrity and Safeguarding Act 2026 to the specific evidence categories auditors now check under the SIL Practice Standards. Different modules, same underlying requirement: evidence that already exists, connected and retrievable, beats evidence assembled under pressure.
Frequently Asked Questions
What does NDIS audit readiness actually mean?
It means your policies, records, and evidence of day-to-day practice can be produced on request, without needing to be reconstructed under deadline pressure once an audit is booked.
What’s the difference between a verification audit and a certification audit?
Verification audits apply to lower-risk supports and are largely a documentation review by one auditor. Certification audits apply to higher-risk or more complex supports, require at least two auditors, and include site visits, interviews, and direct observation.
How long do I have to submit a corrective action plan?
Seven calendar days from written notification of the non-conformity, under the NDIS Commission’s Approved Quality Auditor guidance.
How long do I have to close out a non-conformity?
Minor non-conformities generally need to be closed within 18 calendar months, checked at your next mid-term or recertification audit. Major non-conformities have a much tighter three-month follow-up window, and certification is automatically suspended if a major remains unresolved at that point.
What happens if a minor non-conformity isn’t closed in time?
It escalates to a major non-conformity. An escalated major cannot be downgraded back to a minor. It must be fully closed out on the tighter three-month timeline.
What are the most common reasons NDIS providers fail an audit?
Incomplete policy documents, no evidence that policies are actually followed, gaps in incident management records, missing or expired worker screening checks, thin training records, and inadequate documentation of participant consent and support planning.
Building Readiness In, Not Bolting It On
The providers who find audits stressful are usually the ones treating readiness as a project that starts when the audit is booked. NDIS audit readiness that holds up is built long before the auditor is booked, as a by-product of how records are kept day to day, not as a separate exercise squeezed in before an assessment.