NDIS Verification: What Auditors Really Want
This episode breaks down NDIS verification for low-risk providers, explaining why a massive policy binder can backfire and what auditors actually look for in the Initial Scope of Audit. Learn the four core systems—HR, risk, complaints, and incidents—plus how nonconformities are rated and why being audit-ready is really about proving how your business actually operates.
Chapter 1
The Danger of the Policy Dump
Winter, EnableUs Community
A sole trader personal trainer uploads four hundred and eighty pages of pristine corporate governance policies to their NDIS verification portal, feeling completely bulletproof.
Will, EnableUs Community
And the auditor opens page twelve, uh, reads two sentences, and immediately knows there is trouble.
Winter, EnableUs Community
Immediately. Because page twelve says, and I quote, all incident reports must be ratified by the clinical governance subcommittee prior to quarterly review by the board of directors. For an exercise physiologist who works out of a local gym boot, by himself.
Will, EnableUs Community
The famous one person board of directors meeting in the mirror before doing squats.
Winter, EnableUs Community
Precisely. People treat a verification audit like a weight competition. They, they think if the PDF bundle is heavy enough, the auditor will just nod, stamp it, and move on. But verification is, is actually built for lower risk, lower complexity registration groups. We are talking household tasks, accommodation and tenancy assistance, therapeutic supports, personal training.
Will, EnableUs Community
Right, so you do not need the compliance architecture of a fifty bed residential facility.
Winter, EnableUs Community
You do not. In fact, doing that hurts you. Your actual blueprint is a document you get right after applying to the Commission, called the Initial Scope of Audit. That paper tells you, in black and white, your exact audit type, your registration groups, and the specific standards you have to answer to.
Will, EnableUs Community
Wait, so if you are only delivering therapeutic supports, the scope literally tells you to ignore all the complex clinical stuff?
Winter, EnableUs Community
It scopes it out entirely. The Verification Module only demands four core systems. Just four. Human resources, risk management, complaints management, and incident management. That is the whole field.
Will, EnableUs Community
Okay, break those down. Because I, I remember when I first saw those four headings, I thought, well, HR, surely that is just an employment contract, right?
Winter, EnableUs Community
No, it is, uh, it is proof of worker identity, right to work in Australia, pre employment screening, required professional qualifications, the mandatory NDIS worker orientation module, and a record of continuing professional development. Current records, not an expired CPR ticket from twenty twenty two.
Will, EnableUs Community
Right. And then risk management is not just a generic statement saying we care about safety.
Winter, EnableUs Community
Not at all. It has to cover actual work health and safety, proper insurance, infection control, and emergency and disaster management that specifically considers what happens to your participants if your service suddenly stops. If there is a flood or you get sick, what happens to them?
Will, EnableUs Community
And the other two, incidents and complaints, they require natural justice and procedural fairness.
Winter, EnableUs Community
Yes, clear paths for someone to speak up without fear of retribution, and a clear sequence of what happens when something goes wrong. Who investigates, where it is logged, how it gets resolved. Simple, proportionate to your scale, but real.
Will, EnableUs Community
That is the trap of those five hundred dollar internet template packs. You buy the binder, you find and replace the company name, but you do not actually change the machinery. So when the auditor asks who handles your complaints intake, you start stammering because your policy says the head of people and culture, and you do not have one.
Winter, EnableUs Community
You are the head of people and culture, the cleaner, and the physiotherapist. And the auditor knows it.
Chapter 2
Audit Ratings and the Clock
Will, EnableUs Community
So walk me through what happens once you actually upload these files. Because it is a desktop review, right? No one is physically visiting your office.
Winter, EnableUs Community
Right. It is an Approved Quality Auditor reviewing your evidence remotely. But do not let the word desktop fool you into thinking it is passive. The auditor grades every single applicable standard and quality indicator using three numbers. Zero, one, or two.
Will, EnableUs Community
Two is what you want.
Winter, EnableUs Community
Two means full conformity. You demonstrated the system exists, it works, and it meets the standard. A rating of one is a minor non conformity. Maybe you have a complaints register, but you forgot to record the date a resolution was communicated back to the participant. Fixable, but flagged.
Will, EnableUs Community
And zero?
Winter, EnableUs Community
Zero is a major non conformity. It means a complete absence of a required system, or a breakdown so severe that participant safety or rights are compromised. And a zero stops your registration dead in the water.
Will, EnableUs Community
Wait, it just halts everything?
Winter, EnableUs Community
Freezes it. If you get a major non conformity, you have a strict three month window to remediate the finding, submit fresh evidence, and get the auditor to close it out. If you cannot fix it in those three months, the audit cannot be successfully completed, and your registration fails.
Will, EnableUs Community
And this is where people get caught on what I call the clarification call. The auditor calls or emails and says, hey, you submitted your incident management procedure, can you show me the record of the last incident you reviewed, or explain your reporting pathway? And the provider has no idea what their own document says.
Winter, EnableUs Community
Because they prepared for the upload, not for the audit. They treated it like submitting an assignment at university, where you hit send and forget it exists. But an auditor is evaluating your operational capability. If your risk assessment form is dated three years ago and lists services you do not even provide, it shows you do not use your own tools.
Will, EnableUs Community
And there is a tight clock running on the auditor side too, isn't there?
Winter, EnableUs Community
Fourteen days. Once the audit is completed, the Approved Quality Auditor has fourteen calendar days to submit their final audit report directly to the NDIS Commission. That means there is zero room for a frantic two week rewrite of your entire operating system at the end.
Will, EnableUs Community
So if you are scrambling to build a complaints process after they point out it is missing, you have already lost.
Winter, EnableUs Community
Completely. And, uh, honestly, the providers who breeze through verification are not the ones with graphic designed manuals. They are the ones who can say, here is how I onboard my sole contractor, here is their screening check, here is how I store client notes securely, and here is how I report an incident within twenty four hours if someone trips. Clean, lean, honest.
Will, EnableUs Community
It turns the whole audit from a scary test into just describing how you run a decent business.
Winter, EnableUs Community
That is exactly what it should be. It is not red tape for the sake of it, it is the foundation that keeps your business standing when you take on your first ten, twenty, or fifty participants.