Approved quality auditor (AQA)

What is an approved quality auditor (AQA)?

An approved quality auditor (AQA) is an independent audit organisation approved by the NDIS Quality and Safeguards Commission to assess providers against the NDIS Practice Standards. Every provider applying for or renewing NDIS registration must engage and pay an AQA to complete its verification or certification audit. The auditor reports to the Commission, which then makes the registration decision.

The Commission publishes the list of approved quality auditors on its find an auditor page. AQAs are certification bodies, not consultants: their job is to test your evidence against the standards, not to write your policies. They operate under a scheme overseen by the Commission, and auditor organisations are accredited through the Joint Accreditation System of Australia and New Zealand (JAS-ANZ); check the Commission's page for the current requirements.

You will see the term in the registration process, in your Initial scope of audit, and on your audit report.

How working with an AQA works

When you apply or renew, the Commission sends you an Initial scope of audit that sets out the audit type, your registration groups, your service delivery types and the applicable Practice Standards (Apply for registration). You share it with auditors to get quotes. The Commission does not set audit prices and recommends getting more than one quote.

What the auditor does depends on the audit type (NDIS Commission: the quality audit process):

• Verification audit: a desktop review of documents against the Verification module, reported to the Commission up to 14 days after completion.
• Certification audit: a Stage 1 desktop audit, then a Stage 2 onsite audit within 3 months, with record reviews, site visits, observation and interviews with workers and participants. The report is due up to 28 days after completion.
• Mid-term, out-of-cycle and condition audits: a mid-term audit around 18 months into a certification provider's registration; an out-of-cycle audit when you add supports; and audits the Commission requires as a condition.

The auditor rates each standard and quality indicator from 3 (conforms with elements of best practice) to 0 (major non-conformity), using the indicators in the Quality Indicators Guidelines. You get a chance to check the draft report for factual accuracy before it is finalised.

What the auditor will ask participants and workers

In a certification audit, the auditor wants to hear how supports work from the people involved. Participants may be asked simple questions, such as whether they feel safe, whether workers listen to them and whether they know how to make a complaint. Workers may be asked how they would report an incident on a night shift or where a participant's support plan is kept. Participants can have a support person or advocate with them, and anyone who prefers not to take part can opt out.

What an AQA does and doesn't do

AQA vs the NDIS Commission vs a consultant

Three parties are often confused during registration. The NDIS Commission is the regulator: it scopes your audit, assesses suitability, decides registration and takes compliance action. The AQA is the independent assessor the Commission relies on. A compliance consultant is someone you may hire to help prepare.

Keep the roles separate. The Commission expects your application and policies to be specific to your organisation, and says you must understand and be able to explain what you submitted, even if a consultant helped. An auditor that also advised you on your systems would not be independent, so don't ask your auditor to fix your documents for you.

How to choose an approved quality auditor

Only auditors on the Commission's list can conduct NDIS registration audits. Within that list, providers usually compare:

• Scope experience: whether the auditor regularly audits your registration groups and supplementary modules, such as the SIL Practice Standards or implementing behaviour support plans.
• Locations: whether they can visit your sites, including regional ones, for a Stage 2 audit.
• Audit days and price: how many days onsite they plan for your number of sites, participants and workers.
• Availability: whether their dates suit your application timeframe and any transition deadlines.
• What they need before Stage 1, so you can prepare the right evidence.

Send each auditor your Initial scope of audit, your number of sites, participant numbers and worker headcount. If you later want to add supports, the Commission's manage your registration page explains the variation process, which may need an out-of-cycle audit.

Common mistakes

• Booking before reading the scope. The quote depends on your audit type and modules.
• Expecting the auditor to approve you. Only the Commissioner or a delegate approves registration.
• Not telling participants about the audit. For certification, participants are included unless they opt out, and you must notify them and pass on any opt-outs.
• Treating Stage 1 as a formality. Anything queried at the desktop stage will be tested onsite.
• Choosing on price alone. An auditor unfamiliar with your supports may plan too few days and extend the audit.

Before you contact auditors, the free NDIS Practice Standards self-assessment shows where your evidence is thin.