How to Survive an NDIS Desk Audit
This episode breaks down what auditors actually look for in a remote NDIS verification audit, from worker credentials and risk registers to complaints and incident reporting. It also explains why empty registers, vague policies, and cosmetic fixes can trigger nonconformities, and how to keep evidence audit-ready year-round.
Show Notes
- The quality audit process | NDIS Quality and Safeguards Commission: https://www.ndiscommission.gov.au/provider-registration/apply-registration/types-audits
- NDIS Compliance for Providers: What Auditors Check — TakeCareOS Blog: https://www.takecareos.com/blog/ndis-compliance-audit-guide/
Chapter 1
The Remote Trap
Will, EnableUs Community
Say you run a therapy practice or provide low risk equipment under the NDIS. No auditor is walking through your front door. No one is sitting in your waiting room. It is just you uploading a bunch of PDFs to a portal.
Winter, EnableUs Community
Which makes it feel, um, almost like a formality, right? Like a, a rubber stamp exercise. You buy some template policies online, upload them, and you are done.
Will, EnableUs Community
Yeah, and that is precisely where people get tripped up. Providers think a desk audit means an easy audit. But Approved Quality Auditors are knocking back pristine, four hundred page policy manuals every single week.
Winter, EnableUs Community
Because having a policy that says you do something is not the same as proving you actually did it. In a remote audit, the auditor cannot see your warm bedside manner. They cannot see that you genuinely care about participants. They are sitting in their own office, reading what you gave them.
Will, EnableUs Community
Auditors assess conformity to the NDIS Practice Standards by reviewing documentary evidence. That is it. That is their whole universe. If it is not in the file, it never happened.
Winter, EnableUs Community
Right. So when you get that Initial Scope of Audit document from the Commission, that is your actual checklist. It lays out the exact registration groups, the service types, the standards you are being measured against. But people treat it like a garage sale. They take their entire Google Drive, years of unlabelled emails, random spreadsheets, and just dump the whole link on the auditor.
Will, EnableUs Community
Which causes immediate auditor fatigue. Imagine having to comb through sixty untitled PDFs just to check whether one worker has an active screening check. You want to make it ridiculously easy for them. For a verification audit, you are really mapping evidence against four main pillars: worker credentials, complaints management, incident reporting, and risk management.
Winter, EnableUs Community
And on those registers, there is this fascinating paradox that catches almost every newcomer off guard.
Will, EnableUs Community
The empty register trap.
Winter, EnableUs Community
The empty register! People submit a completely blank complaints log and a spotless incident register, and they think, look at us, zero complaints, zero incidents, we run a perfect ship!
Will, EnableUs Community
And to an auditor, that is an immediate red flag. A gleaming, empty register does not tell them your service is perfect. It tells them your workers do not know what an incident is, or your participants do not know how to speak up. If you have been operating for a year and nobody has logged a minor trip, a late arrival, or a misplaced medication note, the auditor assumes your reporting system simply does not work in practice.
Winter, EnableUs Community
They want to see a register with minor issues logged, followed by dated entries showing management reviewed it, took action, and closed the loop. That shows the system is alive. A remote audit is totally blind to good intentions. Without a dated record, a supervision note, or an active screening clearance tethered to each worker, the system basically does not exist to the regulator.
Chapter 2
The Clarification Call and the Ninety Day Clock
Will, EnableUs Community
Now, what happens once you hit submit? People assume you just wait in silence. But remote does not mean completely hands off. Very often, the auditor reaches out with clarifying questions.
Winter, EnableUs Community
And when that email arrives, providers often freak out. They think, oh no, I failed, they are investigating me.
Will, EnableUs Community
Right, but it is not an interrogation. The NDIS Commission guidance explicitly allows auditors to ask for more information about your everyday practices. If a file was mislabelled or an AHPRA registration was not clearly linked to a specific staff member, that clarification email is your chance to explain how the pieces fit together. Just be transparent. Do not try to fake a backdated document on the spot.
Winter, EnableUs Community
Because they have a strict clock to follow. An Approved Quality Auditor has to submit their formal audit report to the Commission up to 14 days after the completion of a verification audit. That is a tight turnaround.
Will, EnableUs Community
It is, and that report uses a specific scale from zero to three. Three is best practice. Two means you conform with the standard. One is a minor non conformity, which gives you extra time to fix things while your application keeps moving. But zero?
Winter, EnableUs Community
Zero is a major non conformity. And that freezes everything.
Will, EnableUs Community
Completely. If you get a major rating, your registration stops in its tracks. You get a strict three month window, ninety days, to address the underlying problem and prove you fixed it. If you fail to close it out in those three months, the audit decision is suspended.
Winter, EnableUs Community
And here is the mistake people make when that ninety day clock starts ticking. They open their complaints policy, change three words in paragraph four, and send it back. They think a policy wording change fixes a major finding.
Will, EnableUs Community
Cosmetic edits do nothing. If the finding was that you had no risk management system, sending back a fresh paragraph saying we manage risk does not prove anything. The auditor wants to see the operational change. Show them the revised risk register. Show them the training log where your three staff members were walked through the new escalation procedure. Show them how the process actually works now.
Winter, EnableUs Community
It comes down to shifting your whole mindset. You cannot view the desk audit as this horrible hurdle you cram for once every three years. If you are staying up until three in the morning the night before your upload, hunting down first aid certificates and inventing shift logs, you are setting yourself up for findings.
Will, EnableUs Community
Ask yourself: if an auditor emailed you at two o'clock on a Tuesday asking for proof of worker screening and your latest risk review, could you pull defensible records within thirty seconds? If the answer is yes, you are not just ready for a desk audit. You have actually built a business that works.