NDIS audit-readiness checklist

A verification audit is for lower-risk, lower-complexity supports. The Commission describes it as a desktop review of the documentary evidence listed in its Required Documentation Guide.

A certification audit is for higher-risk supports and has two stages. Stage 1 is a desktop audit, usually off-site, where the auditor asks for information and evidence. Stage 2 is on-site, where the auditor looks at how you are implementing your policies and procedures. That can mean viewing records, visiting sites, interviewing staff and participants, and observing. Stage 2 should take place within three months of Stage 1. A provider who first completed a certification audit has a mid-term audit 18 months into the registration period.

Each indicator is rated from 3 (conforms, with elements of best practice) down to 0 (a major non-conformity). The Commission says a major non-conformity gives you three months to fix it, and a minor one a longer time. Participant sampling is opt-out: you tell every participant they are included, and record and pass on anyone who opts out.

So the lists below are the floor, not the finish. Stage 2 is about what actually happens: the auditor follows a record back to the shift, the worker and the participant it came from.

The core module's governance standards carry most of the documents an auditor asks for first. Their quality indicators point to:

• A defined governance structure that covers your financial, legislative, regulatory and contractual responsibilities, and monitors quality and safeguarding.
• Strategic and business planning that considers legislative requirements, organisational risks and NDIS requirements.
• A documented system of delegated responsibility and authority for when the usual person is away, and conflicts of interest managed and documented.
• A documented risk management system covering incident management, complaints management and resolution, financial management, governance and operational management, human resource management, information management, work health and safety, and emergency and disaster management, with infection and outbreak measures where relevant.
• Appropriate insurance, including professional indemnity, public liability and accident insurance.
• A quality management system with a documented program of internal audits, and continuous improvement that uses outcomes, risk data and feedback from participants and workers.
• An information management system that records participant information accurately and on time, with consent to collect, use and disclose it, and processes for retaining, securing and disposing of documents.
• A complaints management and resolution system and an incident management system, each complying with its 2018 Rules, with policies that are regularly reviewed and workers trained in them.
• Emergency and disaster management plans, developed with participants and their support networks, tested, reviewed, communicated, and with every worker trained in them.

The human resource management standard is where an auditor samples staff files. Its indicators point to:

• The skills, responsibilities, scope and limits of each position, documented.
• Records of pre-employment checks, qualifications and experience for each worker.
• An orientation and induction process, including the mandatory NDIS worker orientation program.
• A system that identifies, plans, records and evaluates training, including mandatory training and infection prevention and control training with refreshers.
• Worker performance managed and documented, and timely supervision.
• Each worker's contact details and any secondary employment, recorded and current.

The provision of supports standards, and the rights standards around them, point to records held for each person:

• A support plan, developed with the participant after an assessment, reviewed annually or earlier, available to them and to their workers, and including preventative health and their emergency and disaster arrangements.
• Risk assessments, regularly undertaken and documented in the support plan, including what a disruption to supports would mean for them.
• A service agreement developed with them, signed by the participant and the provider with a copy given (or a record of why not), and setting out arrangements for an emergency or disaster.
• Their consent to the personal information you collect and why, including audio and visual recordings, and advice on your confidentiality policies.
• Their needs and preferences documented and given to workers before those workers start.
• Any transition to or from your service documented, with its risks identified and responded to.
• Allegations and incidents acted on, with records of the details and outcomes of reviews and investigations.

Where these apply to the supports you deliver, the environment standards point to:

• Medication records identifying each participant's medication and dosage, with medications stored securely and handled only by appropriately trained workers.
• Mealtime management plans for participants who need them, reviewed annually or as professional advice says, accessible to workers, with workers trained in safe meals and responding to choking.
• Protocols for medical emergencies for each participant, and systems for escalating urgent health situations.
• Infection prevention and control standard precautions in every setting, PPE available, and workers trained with refreshers.
• Processes that keep participant money and property managed, protected, accounted for and used only with consent.
• Policies for waste and hazardous substances, with incidents involving them reported, recorded, investigated and reviewed.

The verification module is shorter. Its indicators point to records of each worker's identity, right to work, pre-employment checks and qualifications, the NDIS orientation module and continuing professional development; an incident management system and a complaints management and resolution system, each complying with its 2018 Rules; a documented risk management system for work health and safety risks that includes emergency and disaster planning; appropriate insurance; and regular risk assessments.

The Commission's Required Documentation Guide, linked from the verification module page, lists the documentary evidence a verification auditor reviews.