Certification audit

What is an NDIS certification audit?

A certification audit is the more detailed of the two NDIS audit types, required for providers registered to deliver higher risk or more complex supports. An approved quality auditor assesses the provider against the core module of the NDIS Practice Standards, plus any supplementary modules, in two stages: a desktop audit, then an onsite audit with observation and interviews of staff and participants.

It is part of NDIS registration: you complete one to become registered, again at renewal, and in between you have a mid-term audit. The lighter alternative, for lower risk supports only, is a verification audit. Your registration groups decide which one you get, and the NDIS Commission tells you in the Initial scope of audit it sends when you apply or renew.

Who needs a certification audit

Each registration group is assigned an assessment method in section 20 of the Provider Registration and Practice Standards Rules 2018, published on the Commission's registration groups page. The key rule: if any one of your groups needs certification, your whole audit is certification. The Rules also say a certification assessment satisfies any requirement to be assessed by verification.

This is a selection; check the full table before you apply, because groups are occasionally added or changed. Certification is also required:

• for providers implementing behaviour support plans that involve regulated restrictive practices, who are assessed against the implementing behaviour support plans module;
• for government entities (Commonwealth, state, territory or local), which the Rules require to be certified against the core module regardless of group.

How a certification audit works

The Commission's quality audit process page sets out the stages:

Stage 1: desktop audit

The auditor reviews your documents, usually off-site: policies and procedures, registers (incidents, complaints, risks, worker screening), governance records and your self-assessment against each applicable standard. Treat anything queried at Stage 1 as an early warning — it will be tested onsite.

Stage 2: onsite audit

Stage 2 should take place within three months of Stage 1. The auditor looks at how your policies work in practice by viewing records, visiting sites, observing supports and interviewing staff and participants. Participant sampling is opt-out: you must tell participants they are automatically included, and if someone declines you must respect, record and pass on that decision.

Ratings and the report

Each standard and indicator is rated from 3 (conforms with elements of best practice) to 0 (major non-conformity). A major non-conformity must be addressed within three months, and registration won't progress until it is. Minor non-conformities allow more time. The auditor sends the report to the Commission — for certification, up to 28 days after the audit is completed — and the Commission, not the auditor, makes the registration decision.

What happens on the onsite day

Stage 2 tests whether what's written down is what actually happens. The Commission's own description is that the focus moves quickly from what your policies say to what happens in practice. Expect the auditor to:

• trace a participant's file end to end: service agreement, support plan, risk assessments, progress notes, rosters and any incidents;
• trace an incident or complaint from first report to outcome, including any notification to the Commission;
• sample staff files for screening clearances, qualifications, induction, training and supervision records;
• observe supports, checking for consent, clear explanations and accurate documentation;
• ask workers practical questions, such as what they would do if a participant fell on shift, or where they would find a participant's mealtime plan;
• ask managers and directors how incident trends and risks reach leadership, and to show the last report.

Good answers match the written procedure, name specific places and people, and show the worker knows the participant they support.

What standards are assessed

A certification audit always covers the core module of the NDIS Practice Standards — rights and responsibilities, governance and operational management, provision of supports, and the support provision environment — plus every supplementary module that matches what you deliver:

• High intensity daily personal activities (group 0104);
• Specialist behaviour support, and implementing behaviour support plans;
• Early childhood supports;
• Specialised support coordination;
• Specialist disability accommodation;
• Supported independent living, from 1 July 2026 — see SIL Practice Standards.

Certification vs verification audit

After certification: mid-term and other audits

Certification isn't a one-off. Registered certification providers can expect:

The mid-term audit must start no later than 18 months into the registration period unless the Commissioner allows longer. It covers governance and operational management, any standard that previously needed a corrective action plan, and any standard the Commissioner specifies. It doesn't apply to SDA-only providers, individuals or partnerships whose only certification group is early childhood supports, or transitioned providers. A certification provider that goes through a change of ownership that significantly changes its organisation or governance may also need a change of ownership audit; the requirements were amended for ownership changes from 1 July 2026.

How to prepare

• Run an honest self-assessment against every quality indicator in your scope with the free Practice Standards self-assessment.
• Fix high-risk gaps first: incidents, restrictive practices, worker screening, medication and emergency planning.
• Make sure records show systems working: completed registers, supervision notes, reviewed support plans and board minutes that discuss quality and risk.
• Tell participants about the audit early, explain opt-out, and record any opt-outs.
• Roster frontline workers, including casuals, who can be interviewed on the day.
• Gather staff files with screening clearances, qualifications, induction and Worker Orientation Module certificates. A resource-level audit trail makes it easier to show when records were created and changed.

Choose your auditor from the Commission's approved quality auditors list and get more than one quote; the Commission doesn't set audit prices.

Common mistakes

• Adding one certification group late. It turns a verification audit into a certification audit for the whole application.
• Scripted staff answers. Auditors notice identical phrasing; train understanding, not lines.
• Policies nobody has seen. If workers can't say where the complaints procedure is, the indicator is at risk.
• Forgetting participant consent to sampling. Opt-outs must be respected, recorded and passed to the auditor.
• Not diarising the mid-term audit. It is due by month 18 and focuses on governance.