NDIS Audit Preparation: The Twelve Documents You Will Be Asked For

Most NDIS providers know an audit is coming but do not know exactly what to prepare. This checklist covers the twelve document categories you will almost certainly be asked for, what the auditor is checking in each, and where providers typically fall short.

1. Worker qualification records and expiry dates

What the auditor checks: That every worker who has delivered supports holds the qualifications required for those supports, and that those qualifications are current.

Where providers fall short: Qualifications stored in a spreadsheet or in individual email threads. Nobody owns the expiry tracking. A First Aid cert expired six months ago and nobody noticed because the worker has been rostered continuously without anyone checking.

How to get it in order: Maintain a single register of every worker's qualifications with issue dates, expiry dates, and a copy of the supporting document. Set alerts before expiry -- ideally 60 days and 30 days out.

2. Worker screening clearances

What the auditor checks: That every worker holds a valid NDIS Worker Screening Check, and that you have the clearance number on file. Clearances can be suspended or cancelled -- the worker may still have the original certificate but the clearance is no longer valid.

How to get it in order: Do not rely on the original certificate alone. Before the audit, log in to your state's worker screening portal and verify the current status of every clearance on your register. Document the date you verified it.

3. Signed service agreements for every active participant

What the auditor checks: That every participant you are currently supporting has a signed service agreement that covers the supports being delivered, and that the agreement is current.

Where providers fall short: Agreements signed at intake but never updated when the participant's plan changed. Agreements where the participant or their nominee never signed.

How to get it in order: Run a report of every active participant and cross-check against service agreement status. Flag any unsigned, expired, or mismatched agreements and resolve them before the audit date.

4. Shift notes and support delivery records

What the auditor checks: That supports were actually delivered, that delivery is documented in a way that matches what was claimed, and that notes are contemporaneous.

Where providers fall short: Notes that are too vague to constitute evidence. Notes written in batches at the end of the week. A mismatch between what was claimed and what the notes describe.

How to get it in order: See the companion article on writing shift notes that stand up in an audit. Before the audit, sample ten to twenty recent shift notes across different workers and apply the same scrutiny the auditor will.

5. Incident reports and follow-up evidence

What the auditor checks: That incidents were reported, reported to the NDIS Commission within the required timeframes (within 24 hours for reportable incidents), and that there is evidence of follow-up action.

Where providers fall short: Incidents handled informally and never formally documented. Reports filed with no follow-up recorded. Gaps in the incident register where months of supports show no incidents at all -- which is sometimes implausible and prompts closer scrutiny.

How to get it in order: Cross-check your incident register against shift notes. If notes mention a fall or a behavioural incident, there should be a corresponding incident report.

6. Complaints register

What the auditor checks: That you have a complaints management process, that complaints are recorded, and that they are responded to.

Where providers fall short: Complaints handled verbally with nothing in writing. A register that exists but has not been used.

How to get it in order: Every complaint -- including informal ones -- should be entered in the register with the date, the nature of the complaint, who raised it, and what was done in response.

7. Medication management records (where applicable)

What the auditor checks: If your workers administer or prompt medication, that there are medication management plans in place, that workers are trained to the correct level, and that administration is documented shift by shift.

Where providers fall short: Medication administration recorded in the shift note but no formal medication chart. Workers prompting medication without a documented plan.

How to get it in order: For every participant who receives medication support, there should be a current medication management plan, a medication chart, and training records for the worker.

8. Restrictive practices authorisation (where applicable)

What the auditor checks: If any participants are subject to regulated restrictive practices, that every practice is authorised by the relevant state or territory body, that the behaviour support plan is current, and that practices are being implemented and monitored as required.

Where providers fall short: A practice introduced informally and never formally authorised. An expired authorisation.

How to get it in order: If you support participants under any restrictive practice, your evidence file for that participant needs to be comprehensive. Getting authorisations in order can take time -- start early.

9. Participant risk assessments

What the auditor checks: That you have assessed the risks specific to each participant and have documented how those risks are managed.

Where providers fall short: Generic risk assessments that say nothing specific about the individual. Risk assessments completed at intake and never reviewed.

How to get it in order: Each participant's risk assessment should be specific to them -- their health conditions, their environment, their behaviours of concern, and any specific hazards.

10. Staff training records

What the auditor checks: That workers have completed mandatory training -- NDIS Worker Orientation Module, infection control, manual handling, emergency procedures, and any role-specific training.

Where providers fall short: Training done but not documented. Certificates stored in emails but not in the provider's records.

How to get it in order: Every worker's training should be recorded centrally with the completion date and a copy of the certificate. If it is not in your system, for audit purposes it did not happen.

11. Emergency management plans

What the auditor checks: That you have emergency procedures in place and that workers know how to find them.

Where providers fall short: A plan written once and never reviewed. Plans that exist at the organisational level but no participant-specific emergency information.

How to get it in order: Each participant who receives in-home supports should have emergency information documented -- evacuation requirements, emergency contacts, medical alerts, and any specific needs that first responders would need to know.

12. Subcontractor agreements

What the auditor checks: If you use subcontractors or agency staff, that there are written agreements in place including NDIS Code of Conduct compliance, worker screening requirements, and reporting obligations.

Where providers fall short: Using agency staff without formal agreements that specify NDIS compliance obligations. Not verifying that the subcontractor's workers hold current NDIS Worker Screening clearances.

How to get it in order: Every subcontractor relationship should have a written agreement. Review those agreements before the audit and confirm they include NDIS-specific provisions.

Using Teiro for audit preparation

All twelve of these document categories can be managed directly in Teiro. Worker qualifications and expiry tracking, participant records and service agreements, shift notes, incident reports, and compliance documentation all live in one place with full audit trails.

Book a demo to see how Teiro supports audit preparation, or start for free -- free for organisations with 5 or fewer active users.