Which NDIS audit are you preparing for?
The NDIS Commission's initial scope of audit tells you the audit type. Its general rules are that a verification audit covers lower-risk, lower-complexity supports and services, a certification audit covers higher-risk supports and services, and providers who completed a certification audit have a mid-term audit 18 months into their registration period. Condition audits and out-of-cycle audits can also apply. A certification audit has two stages: a desktop audit, usually off-site, where the auditor asks for information and evidence, and an on-site audit that may include viewing records, visiting sites, interviewing staff and participants and observing practice. Plan the mock audit to match.
Which standards and indicators should the mock audit test?
The NDIS Practice Standards are organised into modules. The core module applies to registered providers delivering higher-risk supports and covers participant rights and responsibilities, governance and operational management, provision of supports and the support provision environment. Supplementary modules apply depending on the supports you deliver, and a verification module applies to providers delivering lower-risk supports. Each module has outcomes and quality indicators, and auditors use the indicators to assess compliance. Build your mock audit worksheet from the indicators in the modules that apply to you. The Commission runs a Practice Standards reform program, so confirm you are working from the current published version.
Which records should you sample?
Sample across every support type, site and staff group so the review reflects the whole service and includes files nobody has tidied for the audit. Pick participant files at random within each group, include your newest workers as well as long-standing ones, and take incidents and complaints from a defined period. Write down how you chose the sample so you can repeat the method. For each record, note the evidence the indicator calls for, what you found and where it is stored. Keep participant information inside your usual systems and limit access to the people doing the review.
- Participant files: service agreements, support plans, consent and progress notes
- Worker files: screening clearances, induction and required training
- Incident register entries and their outcomes
- Complaints register entries and responses
- Policies and procedures with version dates and owners
- Risk register and review records
What should a gap analysis record?
Use one register for every finding. For each quality indicator tested, record the evidence expected, the evidence found, a rating, the owner, the corrective action, the due date and the date it was re-tested. Use ratings that mirror the audit: the NDIS Commission's audit page describes auditors identifying major or minor non-conformities and giving providers a timeframe to address them. Rank gaps by risk to participants first and by audit consequence second. A gap that recurs across several files usually points to a process or training problem, so fix the process as well as the individual records.
How do you test whether staff follow the policies?
The on-site stage of a certification audit can include interviews with staff and participants and observation of supports, so a document review alone will miss the gaps auditors look for. Ask frontline workers, as well as managers, to walk you through how they report an incident, respond to a complaint, record consent or escalate a concern. Compare their answers with the written procedure. With consent, ask a few participants or their supporters whether they understood their service agreement and know how to make a complaint. Where answers and procedures differ, decide which one needs to change.
Where can automation help with audit preparation?
Administrative automation can check expiry dates on worker screening and training records, flag missing fields or unsigned documents in participant files, compile evidence lists against each indicator and track corrective actions to their due dates. It cannot judge the quality of a support, decide whether you conform to a standard or replace the conversations an auditor will have with your staff and participants. Keep a person responsible for every rating in the gap register. If you use software for this work, check where participant information is stored and who can see it, as you would for any system holding sensitive information.