NDIS quality audits: verification or certification, and what to expect

Why there is an audit

Before you become a registered provider you are assessed against the relevant NDIS Practice Standards through an independent quality audit carried out by an approved quality auditor. The Commission describes audits as a way of making services safer and more consistent, finding issues early and confirming when they are fixed, and helping providers improve over time.

Which type of audit you need

When you submit your application the Commission gives you an initial scope of audit, which says which type applies. As a general rule, a verification audit is for providers who deliver lower-risk, lower-complexity supports, and a certification audit is for higher-risk or more complex supports. The registration groups table sets out which applies to each class of support.

Other audits exist: a mid-term audit for providers who first completed a certification audit, held 18 months into the registration period; a condition audit the Commission can require; and an out-of-cycle audit that may be needed when you want to change the supports you provide during registration.

What a verification audit involves

A verification audit is a desktop review: the auditor looks at documentary evidence that you meet the requirements. Many providers who need one have already met professional regulation requirements, for example through registration with the Australian Health Practitioner Regulation Agency or another professional body, because professional regulation means a practitioner’s standards and competence are already being monitored.

The Commission publishes a guide listing the documents required, so you can see in advance what the auditor will ask for.

What a certification audit involves

A certification audit has two stages. Stage 1 is a desktop audit, usually off site, where the auditor asks for information and evidence. Stage 2 is an on-site audit that should take place within three months of Stage 1, where the auditor looks at how you are applying your policies and procedures: viewing records, visiting sites, observing, and interviewing workers and participants.

Participants are automatically included in the audit unless they opt out, so you need to let them know. Depending on the supports you deliver, the audit can include site visits to head office and the places supports are delivered, inspection of facilities and equipment, participant and worker interviews, and a review of business documents.

Choosing an auditor and preparing

You are responsible for engaging an approved quality auditor and paying for the audit. The Commission does not set audit prices and recommends getting more than one quote and asking questions to check an auditor suits your organisation. If the auditor finds issues you may be asked to fix them before the auditor sends their recommendation.

The best preparation is the one the Commission suggests for the application: compare your policies and procedures against the Practice Standards, make an action plan for gaps, train staff, and keep your evidence organised in the way the standards expect. General information only; the Commission’s audit page is the authority.

Frequently asked questions

What is the difference between a verification audit and a certification audit?

As a general rule, a verification audit is for providers who deliver lower-risk, lower-complexity supports, and a certification audit is for higher-risk or more complex supports. The registration groups table sets out which applies to each class of support, and your initial scope of audit says which type applies to you.

What happens in a verification audit?

It is a desktop review: the auditor looks at documentary evidence that you meet the requirements. The Commission publishes a guide listing the documents required, so you can see in advance what the auditor will ask for.

What happens in a certification audit?

It has two stages. Stage 1 is a desktop audit, usually off site, where the auditor asks for information and evidence. Stage 2 is an on-site audit that should take place within three months of Stage 1, where the auditor looks at how you are applying your policies and procedures.

Who chooses and pays for the auditor?

You are responsible for engaging an approved quality auditor and paying for the audit. The Commission does not set audit prices and recommends getting more than one quote and asking questions to check an auditor suits your organisation.

Keep learning

• How to become a registered NDIS provider: the steps and what to prepare: Registration is an application, an independent quality audit and a suitability assessment. Here is the sequence, what to have ready, and where the costs and delays usually sit.
• Responding to enquiries: a practical checklist for NDIS and aged care providers: An enquiry is a person asking for information, not a booking. How to reply quickly and respectfully, what to put in a first message, and how to decline well when you cannot help.
• Writing a provider profile that helps people choose you: People comparing providers want specific, checkable answers. What to put in a profile, what to keep current, and what to leave out so that your listing is honest and useful.
• Handling complaints well: a guide for NDIS providers: A complaint handled well can strengthen a relationship. What the Commission expects, the “four As” approach to resolution, and why procedural fairness matters to everyone involved.

More in our NDIS updates and insights, our step-by-step guides, or the NDIS and aged care provider directory.

Official sources

• NDIS Commission: The quality audit process
• NDIS Commission: NDIS Practice Standards
• NDIS Commission: Apply for registration

Source checked 13 October 2026. Rules and guidance can change; verify current details with the responsible agency. How we write and check our guides.