NDIS compliance is not optional. The NDIS Quality and Safeguards Commission actively monitors registered providers, and non-compliance can result in sanctions, conditions on registration, or deregistration. In 2026, enforcement has intensified, with civil penalties exceeding $15 million for serious breaches.
This checklist covers every major compliance area that registered NDIS providers must address. Use it as your audit preparation guide.
1. Worker Screening and Credentials
Every worker in a risk-assessed role must hold valid screening checks. This is the most commonly audited area and the easiest to get wrong.
- NDIS Worker Screening Check for all workers in risk-assessed roles
- Working With Children Check (WWCC) where applicable by state
- National Police Check (criminal history)
- First Aid certificate (current, not expired)
- CPR certificate (must be renewed annually)
- Manual handling training
- Medication management competency (where workers administer medication)
- COVID-19 vaccination records (check current requirements)
- Driver licence and vehicle insurance (for transport support)
- Professional registration (for allied health workers)
2. Incident Reporting
The NDIS Commission requires providers to report certain incidents within strict timeframes. There are five categories of reportable incidents:
- Death of a participant
- Serious injury of a participant
- Abuse or neglect of a participant
- Sexual misconduct involving a participant
- Unauthorised use of restrictive practices
Reporting Timeframes
- Within 24 hours: Initial notification to the NDIS Commission for all reportable incidents
- Within 5 business days: Detailed follow-up report with investigation findings
- Within 60 days: Final report including outcomes and preventive actions
3. Practice Standards
The NDIS Practice Standards set the quality benchmarks against which registered providers are audited. Key areas include:
Rights and Responsibilities
- Participant consent documented for all data collection
- Mechanism for participants to withdraw consent
- Service agreements signed before supports commence
- Information provided in accessible formats
- Participant feedback mechanism in place
Governance and Operational Management
- Documented policies and procedures (reviewed annually)
- Risk management framework
- Quality improvement plan with measurable outcomes
- Complaints management process
- Business continuity plan
- Audit trail for all participant record changes
Provision of Supports
- Individual support plans aligned with NDIS goals
- Progress notes for every support session
- Case notes linked to participant goals and outcome domains
- Service delivery records with participant, worker, date, time, and type
- Transition planning for participants changing providers
Support Provision Environment (SIL/SDA)
- Safe and appropriate physical environment
- Emergency and disaster management plans
- Medication management procedures
- Mealtime management plans where required
- Fire safety compliance and evacuation procedures
4. Documentation and Record Keeping
Good documentation is the foundation of compliance. During an audit, if it is not documented, it did not happen. Key requirements:
- All participant records retained for minimum 7 years
- Soft-delete policy (never permanently delete participant data)
- Version control on care plans and service agreements
- Case notes completed within 24 hours of each support session
- Timestamped entries showing who created or modified records
- Secure storage with appropriate access controls
5. Financial Compliance
- Invoicing aligned with NDIS Price Guide rates
- No charging above price limits for each support category
- Accurate recording of service hours matching shift records
- PRODA portal access for bulk claiming
- Separation of participant funds from business funds (for plan managers)
- Regular reconciliation of NDIS payments against delivered services
6. Privacy and Data Security
- Privacy policy published and accessible to participants
- Compliance with the 13 Australian Privacy Principles (APPs)
- Encryption of participant data in transit (HTTPS) and at rest
- Role-based access controls (staff only see data relevant to their role)
- Notifiable Data Breach scheme compliance
- Cross-border data disclosure documented (for cloud services)
- Regular security assessments
How Software Helps With Compliance
Manual compliance tracking with spreadsheets and paper files is no longer viable for most NDIS providers. The volume of requirements, the strict timeframes, and the severity of penalties demand automated systems that proactively alert you to issues before they become findings.
Purpose-built NDIS software should automatically track credential expiry dates and alert you before workers become non-compliant, enforce incident reporting timeframes with workflow automation, maintain timestamped audit trails for every record change, generate compliance reports on demand for audits, and ensure care plans and case notes meet documentation standards.
Stay Audit-Ready with WattleOps
WattleOps tracks credentials, automates incident reporting, maintains full audit trails, and alerts you to compliance issues before they become findings. Built specifically for Australian NDIS providers.
Start Your 60-Day Free Trial →Preparing for Your Next Audit
Whether your audit is scheduled or unannounced, preparation is the same: ensure your systems are continuously compliant, not just compliant on audit day. The providers who perform best in audits are those whose daily operations naturally produce the documentation and evidence that auditors need.
Review this checklist quarterly. Update your policies annually. And invest in systems that make compliance a by-product of doing your job well, rather than a separate burden on top of it.
This checklist is for general guidance only. For the most current NDIS Practice Standards and regulatory requirements, refer to the NDIS Quality and Safeguards Commission.