Most NDIS providers have folders full of policies. They have an incident management procedure, a complaints policy, a risk register and a set of forms for every situation. On paper, everything looks ready.

Yet many audits still end with findings that surprise the provider. The policy said incidents are reviewed within 24 hours, but the register shows gaps of a week. The complaints procedure promised a written response, but nobody can find one. Workers say they have never seen the medication policy. None of these are documentation problems. They are gaps between what the paperwork says and what actually happens.

That gap is exactly what auditors look for. This guide explains how to run an internal check that tests real practice, not just paperwork, so you find the gaps before your auditor does.

Why Auditors Look Beyond Your Documents

For providers on the certification pathway, the audit happens in two stages. Stage One is generally a remote desktop review of your application and uploaded documents. Stage Two is where the real test happens. According to National Disability Services, Stage Two confirms that the NDIS Practice Standards are being implemented, and whether people with disability and their support networks experience your services in the way your policies and practices describe.

In practical terms, that means auditors talk to your workers, interview participants and families where they agree, sample records and observe the environments where supports are delivered. They compare what they hear and see with what your documents promise.

Each standard is then given a rating, ranging from a major nonconformity through to conformity and, occasionally, best practice. A well-written policy cannot lift that rating on its own. The evidence of practice is what counts.

A genuine internal check therefore follows the auditor’s path: from the policy, to the people, to the records, to the participant’s experience.

Seven Areas to Test Across the Core Module

The core module covers participant rights, governance and operational management, the provision of supports and the environment in which supports are delivered. When you carry out an NDIS practice standards self assessment focused on practice, these areas tend to reveal the most.

1. Participant rights and choice. Check whether participants genuinely direct their own supports. Look for evidence that their preferences, culture and communication needs are recorded and acted on, that consent is sought and documented, and that privacy is respected in everyday practice, not just in the privacy policy.
2. Incident management. Choose a recent incident and trace it from the moment it happened. Was it recorded promptly? Was it assessed, escalated and, where required, reported to the NDIS Commission on time? Were the participant and family informed? Did anything change as a result? An incident register that stops at “recorded” is a common finding.
3. Feedback and complaints. Ask workers how a participant would make a complaint, and whether they know how to support someone to do it. Then review recent complaints for acknowledgement, investigation, outcome and follow-up. If there are no complaints at all, ask why. A silent register can suggest participants do not feel safe to speak up.
4. Risk management. Compare your risk register with what is happening on the ground. Are new risks, such as a participant’s changing health needs or a new worksite, being identified and recorded? Are controls in place and reviewed? A risk register written once and never updated will not stand up to scrutiny.
5. Human resource management. Sample worker files for current NDIS worker screening clearances, qualifications, induction records, training and supervision. Check that training matches the supports workers actually deliver, particularly for higher-risk tasks.
6. Support planning and service agreements. Review a selection of participant files. Are support plans current, written with the participant, and reviewed when needs change? Do service agreements match the supports being delivered and the prices being charged? Out-of-date plans are one of the most frequent gaps auditors find.
7. The support environment. Visit the places where supports happen. Look at safety hazards, emergency and disaster plans, medication storage and records, mealtime management and how participants’ money and property are protected. Ask workers what they would do in an emergency and whether their answer matches your plan.

These areas are where policy and practice most often drift apart. Providers delivering supplementary module supports, such as high intensity daily personal activities, should add those requirements too.

Rating What You Find Honestly

Once you have gathered evidence, give each area an honest rating. A simple approach is to mirror the audit scale. Is the requirement fully met and evidenced? Partly met, with some gaps in records or consistency? Or not met at all?

Be strict with yourself. If a process is described in a policy but you cannot find records showing it happens, treat it as a gap. If two workers describe the same process in two different ways, treat that as a gap too. The purpose of an NDIS self assessment is not to produce a good score for your own comfort. It is to see your service as an auditor would, while you still have time to fix what you find.

It also helps to involve a reviewer who did not write the policies, as they are more likely to notice assumptions the author takes for granted.

Six Ways to Gather Honest Evidence

Good evidence comes from more than one source. These methods help you build a reliable picture of how your service really operates.

1. Sample records at random. Do not pick the files you know are in good shape. Choose participant files, worker files and incident reports at random, the way an auditor would. The results will show you how consistent your practice really is.
2. Talk to workers on the floor. Ask frontline workers to explain how they would handle an incident, a complaint or a change in a participant’s health. Listen for whether their answers match your procedures. Gaps here usually point to training or communication issues rather than poor intent.
3. Ask participants and families. With their agreement, ask participants and their support networks about their experience. Do they feel listened to? Do they know how to raise a concern? Do their supports reflect what they asked for? Their answers are some of the most valuable evidence you can gather.
4. Trace one example end to end. Pick a single complaint, incident or new participant intake and follow it through every step, from the first contact to the final outcome. This shows whether your systems connect, or whether information gets lost between people and records.
5. Walk through each site. Visit homes, day programs and offices with fresh eyes. Check emergency information, medication storage, hazards and privacy. Small details, such as an out-of-date emergency contact list, often reveal wider issues.
6. Compare registers with policies. Line up your incident, complaints, risk and training registers against the timeframes and steps in your policies. Wherever the register shows something different from the policy, either the practice or the policy needs to change.

Turning Findings Into Action

A review only creates value if it leads to change. Record every gap in an action plan with a clear owner, a realistic due date and the evidence that will show it has been fixed. Prioritise anything that affects participant safety first, followed by gaps that would likely lead to a nonconformity at audit.

Then close the loop. Update policies where practice has moved on, retrain workers where procedures are not understood and recheck the area once the action is complete. Repeating the review once or twice a year, or after any significant change such as new supports, new sites or a serious incident, keeps your service consistently audit-ready rather than scrambling in the weeks before an audit.

How Angels Compliance and Training Services Can Help

Angels Compliance and Training Services is a compliance consultancy based in Gosnells, Western Australia, supporting NDIS and DVA providers across Australia with registration, renewal, audits, policies and staff training.

We offer guided self-assessment against the Practice Standards, with evidence registers, gap action plans and handover sessions for your team. We also carry out internal audits that test practice the way an auditor would, help develop policies that reflect how you genuinely operate, and provide compliance coaching to keep your systems current between audits.

Final Thoughts

Strong policies are only the starting point. Auditors want to see that what you have written is what happens for participants every day. Test your service through records, workers, participants and environments, rate what you find honestly and act on every gap, and you will be ready for audit and, more importantly, safe and responsive for the people who rely on you.

Disclaimer: This article is general information for NDIS providers and is not legal or financial advice. NDIS rules, Practice Standards and audit requirements can change, and your obligations depend on your registration groups and circumstances. Always check current guidance from the NDIS Quality and Safeguards Commission before relying on anything described here.