NDIS Practice Standards

What are the NDIS Practice Standards?

The NDIS Practice Standards are the quality and safety standards that registered NDIS providers must meet, and are audited against, to become and stay registered. They set outcomes participants should experience — such as being free from abuse and neglect — and quality indicators auditors use to judge whether a provider achieves them. Which standards apply depends on the supports a provider is registered for.

The standards are made under the NDIS (Provider Registration and Practice Standards) Rules 2018 and published by the NDIS Quality and Safeguards Commission on its Practice Standards page. The quality indicators sit in a separate instrument, the Quality Indicators for NDIS Practice Standards Guidelines 2018, which auditors must take into account.

The standards matter to different people for different reasons:

• Participants and families: they describe the quality of support you can expect from a registered provider.
• Providers: they are the test in every certification or verification audit, and a condition of registration between audits.
• Unregistered providers: not bound by them, but many use them as a benchmark before applying for NDIS registration.

How the Practice Standards are structured

The standards are organised into modules. Each module contains standards, and each standard has two layers:

• An outcome: a participant-focused statement, for example "each participant accesses supports free from violence, abuse, neglect, exploitation or discrimination".
• Quality indicators: the specific things an auditor looks for to decide whether the outcome is met, such as a documented system, records that show it working, and workers who know how to use it.

Read the outcome as the goal and the quality indicators as the test. Auditors rate both, so a provider that "has a policy" but can't show it in practice will usually be rated as a non-conformity.

The modules

Supplementary modules add to the core module; they don't replace it. A SIL provider that also implements behaviour support plans is audited against the core module, the SIL module and the implementing behaviour support plans module. Source: the Commission's NDIS Practice Standards and SIL Practice Standards pages.

The core module in detail

The core module is the heart of a certification audit. It has four divisions:

1. Rights and responsibilities: person-centred supports, individual values and beliefs, privacy and dignity, independence and informed choice, and freedom from violence, abuse, neglect, exploitation and discrimination.
2. Provider governance and operational management: governance, risk, quality, information, feedback and complaints, incidents, human resources, continuity of supports, and emergency and disaster management.
3. Provision of supports: access to supports, support planning, service agreements, responsive support provision, and transitions to or from a provider.
4. Provision of supports environment: safe environment, participant money and property, management of medication, mealtime management, and management of waste.

Governance carries the most quality indicators, so it is where most evidence is needed — and it is the full scope of the mid-term audit for certification providers. Human resource management, for example, expects documented position requirements, pre-employment checks, induction including the mandatory NDIS Worker Orientation Module, training, supervision and performance management.

The verification module in detail

Providers delivering only lower risk, lower complexity supports — many allied health practitioners, plan managers, cleaners and transport providers — are assessed against the verification module instead of the core module. It has four standards:

• Human resource management: records of each worker's identity, right to work, pre-employment checks, qualifications or experience; completion of the mandatory NDIS worker orientation module; continuing professional development; infection prevention and control training; and PPE training.
• Incident management: a system proportionate to the provider's size that complies with the Incident Management and Reportable Incidents Rules.
• Complaints management: a proportionate system that follows procedural fairness and complies with the Complaints Management and Resolution Rules.
• Risk management: a documented system for work health and safety risks, insurance, emergency and disaster planning, and infection prevention and control.

The Commission notes many verification providers already meet professional regulation, for example through AHPRA, which is why the scope is narrower and the audit is a desktop review.

What the standards mean for participants

The Practice Standards are written from the participant's point of view, so they double as a list of what you can expect from a registered provider. Under the core module, for example, you should:

• be given information about supports, costs and how to complain in a way you understand;
• be involved in developing your support plan and have it reviewed at least once a year or when your needs change;
• receive a service agreement developed with you, with a copy you can keep;
• have a say in which workers support you, including a preferred gender for personal care;
• be supported to take reasonable risks and to access an independent advocate;
• be told how incidents involving you were managed.

If these things aren't happening with a registered provider, you can raise it with the provider or make a complaint to the NDIS Commission.

How providers are assessed against the standards

An approved quality auditor assesses the provider against the modules in its Initial scope of audit and rates each standard and indicator. The Commission's quality audit process page sets out the ratings:

A major non-conformity must be fixed within three months, and registration won't progress until it is. Minor non-conformities give more time. The Commission then decides on registration; the auditor only recommends.

Between audits the standards don't switch off. Meeting the applicable Practice Standards is a condition of registration, so a provider can be investigated or required to complete a condition audit if complaints or incidents suggest it has fallen short.

Practice Standards vs the Code of Conduct

People often confuse the two. The NDIS Code of Conduct is a short set of behaviour rules for every NDIS provider and worker, registered or not. The Practice Standards are detailed organisational standards that apply only to registered providers and are tested by audit.

Changes in 2026

The biggest change was the new SIL module, which applies from 1 July 2026 when SIL became a registration-only support. It has four standards — supported decision-making, safeguarding, practice governance, and agreements about tenancy, housing and support arrangements — and is the first module to include expectation statements describing what good looks like from the participant's, worker's and provider's point of view (see SIL Practice Standards).

The Commission has also consulted on a wider review of the Practice Standards, including an NDIS quality framework and changes to how standards are assessed, described on its Practice Standards reform page. As at October 2026 it was still considering that feedback, so the existing modules remain the ones audits use.

How to use the standards before an audit

The most effective preparation is an honest self-assessment, rated against evidence:

1. Confirm your scope: your registration groups decide the modules.
2. Rate every quality indicator — not just the outcome — as met, partly met or not met.
3. For each rating, note where the evidence lives: a register, staff file, participant record or meeting minute.
4. Fix high-risk gaps first: incidents, restrictive practices, worker screening, medication and emergency planning.
5. Re-rate after each fix and brief your team before the audit.

The free NDIS Practice Standards self-assessment lists every indicator by module and prints a gap report. Keeping your evidence in one compliance system makes sampling at audit time far easier.

Common mistakes

• Rating outcomes, not indicators. Auditors test the indicators.
• Policies without records. A complaints policy with an empty register reads as a system that isn't used.
• Forgetting supplementary modules. Using a restrictive practice, or delivering SIL, adds a module to your scope.
• Skipping the review step. Many indicators expect leadership to review incidents, complaints and risks — minutes matter.
• Treating the standards as audit-only. They are a condition of registration every day.