Verification audit

What is an NDIS verification audit?

A verification audit is the simpler of the two NDIS registration audits: a desktop review of documents for providers who only deliver lower risk, lower complexity supports. An approved quality auditor checks your evidence against the four standards of the Verification module — human resource management, incident management, complaints management and risk management. There is no onsite visit and no mid-term audit.

Verification is one of the two audit types used for NDIS registration. The other is the certification audit, a two-stage desktop and onsite audit for higher risk or more complex supports. Which one you need is not your choice: it follows from the registration groups you apply for (NDIS Commission: the quality audit process).

You will hear the term from three groups of people:

• Allied health and other professionals, such as therapists and exercise physiologists, who register to serve participants with NDIA-managed funding.
• Plan management providers, because management of funding for supports (group 0127) is a verification group.
• Providers of practical, lower risk supports, such as household tasks or transport arrangements.

How a verification audit works

The process starts when you apply for registration, or for renewal, through the NDIS Commission's applications portal. After you submit, the Commission sends an Initial scope of audit document that states the audit type, your registration groups and the standards you will be assessed against (Apply for registration). You then choose, contract and pay an approved quality auditor. The Commission does not set audit prices and suggests getting more than one quote using your scope document.

The auditor reviews documentary evidence off-site. The Commission notes that many verification providers already meet professional regulation, for example through AHPRA registration or a professional body, which is why the scope is narrower than certification. Each standard is rated from 3 (conforms with elements of best practice) to 0 (major non-conformity). A major non-conformity must be fixed within 3 months and your registration will not progress until it is; a minor non-conformity allows more time.

The auditor sends the report to the Commission up to 14 days after the audit is completed, compared with up to 28 days for a certification audit. The NDIS Commission then assesses your suitability, including your key personnel, and makes the registration decision. The auditor recommends; only the Commission decides.

The four Verification module standards

The Verification module replaces the Core module for lower risk providers. It contains four outcomes with 12 quality indicators between them:

Plan management providers have extra documentary requirements, including a list of workers, certified copies of qualifications and worker screening clearances. The Commission publishes a required documentation guide on the Verification module page, which is the best document list to work from.

Who gets a verification audit (and who doesn't)

Each registration group is assigned an assessment method in the NDIS (Provider Registration and Practice Standards) Rules 2018, and the Commission publishes the full list on its registration groups page. The rule that catches people out: if even one of your groups requires certification, your whole audit is certification. The Rules also say a certification assessment satisfies any requirement to be assessed by verification.

Verification groups include accommodation and tenancy assistance (0101), assistance with travel and transport arrangements (0108), community nursing care (0114), household tasks (0120), exercise physiology and personal training (0126), management of funding for supports (0127) and therapeutic supports (0128). The list changes from time to time, so always confirm against the official table before you apply.

You will not be eligible for a verification-only audit if any of these apply:

• You deliver any certification group, such as personal care (0107), community participation (0125) or specialist behaviour support (0110).
• You implement behaviour support plans that involve regulated restrictive practices, which brings in a supplementary module assessed by certification.
• You are a Commonwealth, state, territory or local government entity, which the Rules require to be certified against the Core module.
• You deliver supported independent living (0138) or NDIS digital platform services (0137). Both groups were added on 1 July 2026 and both require certification.

Verification audit vs certification audit

The two audits test different things. Verification asks whether the right documents and systems exist for a lower risk service. Certification asks whether your systems work in practice, by visiting sites, observing supports and interviewing workers and participants.

Because certification is more involved, adding one higher risk group to an otherwise low risk application changes the audit type, the preparation effort and the auditor's fee. If you are a therapy practice thinking about adding, say, community participation supports, check the audit impact before you include the group. You can add groups later through a registration variation, which may need an out-of-cycle audit.

How to prepare for a verification audit

Verification is lighter, but it still fails providers who send policies without records. The auditor wants to see that each system has been used, not only written. A practical approach:

1. Read your Initial scope of audit and confirm every group listed is verification. If a certification group has slipped in, raise it before booking.
2. Build a worker file for every worker: identity, right to work, qualifications or professional registration, NDIS Worker Orientation Module certificate, infection control training and CPD records. Registered providers also need NDIS worker screening clearances for key personnel and workers in risk assessed roles.
3. Show your incident and complaints systems in use: the procedure plus the register, even if the register only holds a few entries.
4. Check your insurance certificates are current and cover professional indemnity, public liability and accident insurance.
5. Tailor your emergency plan to the participants who rely on you, not a generic template.

The free NDIS Practice Standards self-assessment covers the Verification module and shows where your evidence is thin. The worker screening tracker keeps clearance numbers and expiry dates in one list.

After the audit

If the Commission approves your application, you receive a certificate of registration listing your groups, your registration period and any conditions. Registration is generally for three years, and you repeat the audit to renew. Verification-audited providers are not subject to the mid-term audit that certification providers complete around 18 months into registration. Between audits you still need to comply with the NDIS Code of Conduct, notify reportable incidents and tell the Commission about certain changes.

Common mistakes with verification audits

• Assuming "desktop" means "easy". Missing records are still non-conformities, and a major one stops your registration until fixed.
• A complaints policy with no register. The auditor wants evidence the system exists in practice.
• Missing orientation module certificates for one or two workers, often recent starters.
• Expired insurance certificates, or cover that doesn't include all three required types.
• Ticking a certification group "just in case". One extra group moves you to a two-stage certification audit.
• Thinking verification applies to SIL. Since 1 July 2026, SIL has its own certification group (0138); see mandatory registration.