Five Records That Decide Your NDIS Audit, and How to Check Them in an Afternoon

From the Rostery team in Sydney. We make NDIS and aged-care rostering software. This is a short, freshly written companion to our longer guide to the evidence NDIS auditors ask for.

If you've sat through a certification audit before, you may remember that the auditor barely lingered on the policy manual. They wanted the paper trail: the dated note, the signed agreement, the training record with a date on it.

So rather than another long list, here are five kinds of record that carry a lot of weight, and a quick way to test each one yourself before an auditor does.

General information only. Your auditor and the NDIS Quality and Safeguards Commission make the calls for your registration.

Why records matter more than policies

A certification audit runs in two parts. First comes a desktop review of documents. Then comes an onsite visit, which the auditor uses to see whether your systems are really running. The NDIS Commission describes it plainly: auditors want real examples like incident reports, complaints records, training logs and supervision notes, not just the policy.

Stage 1 vs Stage 2 evidence: the desktop document review comes first, then the onsite test of whether your systems work

That means a well-written procedure with no records behind it is a weak spot. The good news is that records are something you can check and fix in advance. Block out an afternoon, grab whoever looks after compliance, and work through the five areas below in order. Write every gap on one list with a name and a date next to it.

1. Participant files

Auditors sample participant files at the onsite stage. A file holds up when it tells one consistent story about the person.

The five-file spot check: five questions to ask of five participant files chosen at random

The afternoon test: pull five files at random. For each one, answer the five questions in the graphic above. The last question is the one people forget. Ask the worker who usually supports that participant to talk you through the person's day, then compare it with the plan. Gaps between the two are exactly what an onsite visit is designed to find.

2. Worker files

Staff files get sampled too. The Commission says auditors check screening clearances, qualifications, induction and ongoing training and supervision.

The afternoon test: choose three workers. For each, find the date their screening clearance was verified and the date of their first shift. The first date should come before the second. Then check their induction record and latest training. Our article on the NDIS Worker Screening Check in each state is a handy refresher on how clearances work.

3. The roster itself

Rosters are easy to overlook as audit evidence, but they show who actually delivered each support. If a worker was rostered for a task their training file doesn't cover, the roster is where that shows up.

The afternoon test: take next week's roster and highlight every shift that involves a higher-risk support, such as medication. Check each rostered worker's competency is current. If you support people with medicines, our page on NDIS medication management compliance lists the records that go alongside.

4. The incident register

A register full of incidents isn't a problem in itself. A register where incidents are logged and then nothing else happens is.

The afternoon test: filter for entries with no investigation notes or no recorded outcome. Then check the reportable ones. According to the Commission, most reportable incidents must be notified within 24 hours of the provider becoming aware, with a further report within 5 business days. An unauthorised restrictive practice with no harm has a 5 business day deadline.

5. The improvement register

Your continuous improvement register is where problems found in complaints, incidents and reviews become actions. It's also proof that your governance is alive.

The afternoon test: look at the date of the newest entry. If it's months old, you probably have improvements happening that nobody wrote down. Add them, with the issue, what you changed and the result.

If the auditor still finds something

Gaps are rated as minor or major non-conformities. Under the current Approved Quality Auditors Scheme Guidelines, you have seven calendar days from written notice to give the auditor a corrective action plan. A major has to be downgraded or closed within three calendar months, and it stops certification from being recommended until then. A minor has to be closed out by the mid-term or recertification audit, within 18 calendar months, or it turns into a major.

The Commission's own advice is reassuring here: a non-conformity isn't a fail. It's a list of things to fix, with a deadline.

Keep going

The Rostery team

Comments