NDIS Audits: What Non-Conformities Really Mean
This episode breaks down what really happens when an NDIS auditor finds a non-conformity, from the difference between minor and major issues to the seven-day deadline for a Corrective Action Plan. It also explores the costly gap between written policies and day-to-day practice, and why regular self-audits are the best way to stay audit-ready.
Chapter 1
The Audit Rating Scale and the Policy Practice Mismatch
Will, EnableUs Community
So, here is a question. What actually happens when an NDIS auditor walks through your door and finds a non conformity?
Winter, EnableUs Community
Oh, people panic. They think non conformity means, you know, shut the doors, game over, hand back your registration.
Will, EnableUs Community
Right, like a total immediate fail.
Winter, EnableUs Community
Yeah! But it, it really isn't. The framework uses a scale from zero to three. A three means you are demonstrating best practice. Two is solid, you meet the standard. A one is a minor non conformity, and zero, zero is a major non conformity.
Will, EnableUs Community
Okay, so a one or a zero isn't an execution, it's more like a systemic warning light flashing on your dashboard.
Winter, EnableUs Community
Spot on. But where providers get caught out, the big trap, is what I call the policy practice gap.
Will, EnableUs Community
The policy practice gap. Meaning you've written down one thing, but on the ground...
Winter, EnableUs Community
You're doing something completely different. Exactly. You can have this beautiful, shiny hundred page complaints policy, right? But then the auditor sits down with a support worker and asks, um, how do you log a participant concern? And the worker goes, oh, I just text the team leader or write it on a sticky note.
Will, EnableUs Community
Ouch. Yeah. That instantly exposes that the written system isn't real.
Winter, EnableUs Community
It happens constantly. I've seen providers buy these massive off the shelf policy binders for thousands of dollars. They sit on a shelf gathering dust for three years, pristine! And then during certification sampling, the auditor asks for evidence of how that policy is actually used day to day, and everything falls apart.
Will, EnableUs Community
Because an auditor isn't just checking if a document exists, they're checking if it works in practice.
Winter, EnableUs Community
Exactly. And relying on old off the shelf stuff is even riskier now because standards change. Look at the new Supported Independent Living Practice Standards that took effect from July 1, 2026. If you are relying on a static compliance pack from three years ago, you are almost guaranteed to have gaps.
Chapter 2
The 7 Day CAP Clock and True Root Cause Prevention
Will, EnableUs Community
So if an auditor does hand you a zero or a one, what is the actual clock that starts ticking?
Winter, EnableUs Community
It is brutal. You get exactly seven calendar days.
Will, EnableUs Community
Seven days? Not business days?
Winter, EnableUs Community
Seven calendar days. You have to submit a written Corrective Action Plan, a CAP, explaining how you're going to fix the underlying issue.
Will, EnableUs Community
And I guess a quick cosmetic fix doesn't cut it there.
Winter, EnableUs Community
No! That is the biggest mistake people make. Say the auditor finds a missing worker training record. Providers just go, oh, whoops, here is the missing certificate, and upload it. But the auditor will look at that and ask, why was it missing in the first place? What is wrong with your tracking system that allowed a worker on shift without verified training?
Will, EnableUs Community
Ah, right. You fixed the symptom, not the cause.
Winter, EnableUs Community
Precisely. You have to show root cause prevention. Same thing with participant complaints or incidents. It isn't enough to show a log of problems. You have to show the loop closing. Did you investigate? Did you support the participant? And what operational change did you make so it doesn't happen again? That is how continuous improvement actually works.
Will, EnableUs Community
You know, thinking about all this, the best way to avoid that seven day panic is just doing your own mock checks. Every quarter, pick three random participant files, three random staff files, and audit them yourself against the standards.
Winter, EnableUs Community
Yes! Find the gaps before the auditor does. If compliance is built into your everyday routine, an audit stops being a scary event and just becomes proof of how you already operate.
Will, EnableUs Community
100 percent. Well, that is a great place to land it. Talk soon.