NDIS audit readiness: a provider's checklist.
An NDIS audit is not really a test of whether you delivered good support. It is a test of whether you can prove it. The providers who scramble in the weeks before an audit are rarely bad providers — they just keep their evidence in too many places.
Audit readiness is mostly about where your records live for the other fifty weeks of the year. This guide covers what an auditor asks to see, where providers come unstuck, an eight-point readiness checklist, and how good records keep you ready without the last-minute scramble.
NDIS audit readiness means keeping evidence as a by-product of everyday operations — contemporaneous case notes in one place, worker screening tracked against the roster, claims reconciled to delivery, and a tamper-proof audit trail — so you can produce a participant's complete file on demand, not after a week of digging.
What an NDIS audit actually tests
Whether it is a certification or verification audit against the NDIS Practice Standards, or a payment assurance review of your claims, the underlying question is the same: can you show, for real participants and real shifts, that the support was delivered safely and to a good standard?
That is the part providers underestimate. You can run an excellent service and still fail an audit if the evidence is not there to back it up. The NDIS Quality and Safeguards Commission, and the auditors it approves, do not take "we did the work" on trust — they look for the contemporaneous record that proves it.
The honest test
If an auditor asked for everything you hold on one participant — the last six months of supports, notes and claims, the workers who attended and their clearances at the time — could you produce it this afternoon, or would it take a week of digging? Audit readiness is just making the answer "this afternoon".
What an auditor asks to see
The questions come back to evidence, again and again. For real participants and real shifts, an auditor wants to see:
- —Service agreements and consent — a current agreement and consent on file for each participant you support.
- —Case notes that prove delivery — contemporaneous notes, linked to the participant and the shift, describing the support against the participant's goals.
- —Worker screening and qualifications — checks and credentials that were current at the time the support was provided, not just current today.
- —Incident records — what happened, when it was reported, and what was done about it.
- —Policies and procedures — the documented processes your staff actually follow, not a binder nobody opens.
- —Claims that reconcile — the hours and supports you billed line up with the hours and supports you delivered.
Where providers come unstuck
The failures are rarely about bad care. They are about evidence that cannot be produced when it is asked for.
Records scattered everywhere
Case notes in a notebook, on a phone, in an inbox, in a shared drive, in a spreadsheet. There is no single place to answer "show me everything for this participant", so the answer takes days instead of minutes.
Notes written late, or never
The support happened, but the contemporaneous record does not exist. A note reconstructed weeks later from memory is weaker evidence — and an auditor can usually tell.
Expired clearances on rostered staff
A worker whose NDIS Worker Screening Check or first aid certificate lapsed, but who kept being rostered. One expired clearance can undo an otherwise clean file, because it means support was delivered by someone who was not compliant at the time.
Missing agreements and claims that do not reconcile
A participant supported without a current service agreement on file, or billed hours that do not match delivered hours with no explanation. And when a record was edited, nobody can say by whom or when — there is no trail of changes.
An eight-point readiness checklist
You do not get audit-ready in a sprint before the audit. You get there by how you keep records all year. This is what audit-ready looks like in practice:
Contemporaneous case notes in one place
Written at the time, linked to the shift and participant, and searchable — not spread across phones, notebooks, and drives.
Worker screening and credentials tracked with expiry
Visible where rostering happens, so a lapsed clearance is caught before the shift, not at the audit.
Claims reconciled to delivery
A regular check that billed hours match delivered hours, with the gaps surfaced and explained rather than discovered by an auditor.
Incidents logged and tracked to closure
A register, not a folder of emails — with reporting times recorded and actions followed through to resolution.
A deletion-protected audit trail
Every change to a record, roster, or claim captured automatically, and impossible to quietly erase.
Service agreements and consent on file
Findable per participant on demand, not buried in a filing cabinet or a shared inbox.
Records encrypted and access-controlled
Sensitive participant information protected, and visible only to the people who should see it.
A participant's full history in a few clicks
Supports, notes, claims, and attending workers, pulled together on demand rather than reassembled by hand.
How good records keep you ready year round
The providers who find audits stressful are the ones who treat readiness as something you do before the audit. The providers who find them routine are the ones whose everyday system already keeps the evidence.
The work is not assembling the file when the auditor calls. It is making sure the file assembles itself, every fortnight, whether anyone is watching or not. When the case note is written at the point of support, the clearance is tracked against the roster, and the claim is reconciled as it is raised, audit readiness stops being an event. It becomes a by-product of running the fortnight properly. Purpose-built NDIS case notes software makes that the default, capturing each note on shift and linking it to the participant and roster automatically.
That is the shift worth making: from records you have to hunt down, to records that were always there.
For NDIS providers using practice management software
Rostrel stores case notes, shift records, and claims on the same platform as your roster, so every support is linked to the participant, the worker, and the delivered hours the moment it is recorded. Worker screening checks and credential expiry dates sit alongside the schedule — Rostrel flags any staff member whose clearance would lapse before a rostered shift, preventing a compliance gap before it happens. Every change to a record, roster, or claim is written to a deletion-protected audit trail automatically, so when an auditor asks to see a participant's complete history, you can produce it in minutes without reassembling records from multiple sources.
Frequently asked questions
What does an NDIS audit actually check?
An NDIS audit checks whether you can prove you delivered safe, quality support against the NDIS Practice Standards — not just whether you did. Auditors work from evidence: contemporaneous case notes, current worker screening, service agreements, incident records, and claims that reconcile to the support actually delivered.
What documents does an NDIS auditor ask to see?
Typically service agreements and participant consent, contemporaneous case notes linked to the participant and shift, worker screening checks and qualifications that were current at the time of support, incident records, and your policies and procedures. They also check that claimed hours match delivered hours.
How often are NDIS providers audited?
Registered providers are audited when they first register and at each renewal — generally on a three-year registration cycle, with a mid-term audit in between for certification providers. The NDIS Quality and Safeguards Commission can also conduct reviews at other times, and the NDIA runs payment assurance reviews. Confirm the requirements for your registration groups at ndiscommission.gov.au.
Why do providers come unstuck in an NDIS audit?
Rarely because of bad care — almost always because the evidence cannot be produced. Records scattered across notebooks, phones, and shared drives; case notes written late or never; a worker whose screening check lapsed but who kept being rostered; or billed hours that do not reconcile to delivered hours with no explanation.
How do I keep my records audit-ready year round?
Treat readiness as a habit, not a pre-audit project. Capture case notes at the time and keep them in one place, track worker screening and credentials with expiry dates, reconcile claims to delivered support, log incidents to closure, and keep a deletion-protected audit trail so every change is traceable.
What's the difference between a verification and a certification audit?
It comes down to the risk of the supports you deliver. A verification audit applies to providers offering only lower-risk, lower-complexity supports and services. A certification audit applies to higher-risk or more complex supports, and assesses you against the NDIS Practice Standards — the core module plus any supplementary modules relevant to what you deliver. Your registration groups decide which audit you need, and if your groups span both types, you complete the more rigorous certification audit.
How much does an NDIS audit cost, and how long does it take?
There's no fixed NDIS audit fee. You engage an NDIS Commission–approved quality auditor, and they quote based on your registration groups, the size of your organisation and how many sites you run. A verification audit is generally shorter and cheaper — often a remote document review. A certification audit is larger, usually an on-site assessment against the NDIS Practice Standards run over two stages. It's worth getting quotes from several approved auditors before you commit.
Make the audit a non-event
Rostrel keeps the evidence as a by-product of running the fortnight. Case notes, worker screening, claims, and incident records sit on the same system as the roster, and every change lands in a deletion-protected audit trail — so when the audit comes, the file is already there.
Book a 20-minute demo