Preparing for an NDIS Certification Audit: A Workforce Compliance Checklist

Scope of this guide

NDIS certification audits cover a wide range of Practice Standards. This guide covers one slice only: workforce compliance evidence. It does not cover participant outcomes, service delivery quality, governance structures, or financial management.

The workforce piece is important in its own right — it is consistently one of the areas where providers are found to have gaps, and it is largely within your control to address before an audit begins.

Practice Standards that govern workforce requirements

Two parts of the NDIS Practice Standards directly govern workforce:

Standard 2.1 — Worker Screening. Registered providers must not allow a worker in a risk-assessed role to provide NDIS supports unless that worker holds a valid NDIS Worker Screening clearance. The provider must have systems to verify and monitor clearance status.

High Intensity Daily Activities module. For providers supporting participants with complex health needs, this module requires evidence that workers delivering high intensity supports have been assessed as competent — not just trained, but assessed — by a qualified assessor.

Workforce requirements also appear in the context of Standard 1.3 (Support Planning) (workers must have the skills and knowledge to implement support plans), Standard 4.1 (Continuity of Supports) (disruptions caused by workforce non-compliance are a risk to continuity), and Standard 2.2 (Incident Management) (incident investigations may reveal workforce compliance failures).

The six evidence requests auditors make about workers

1. Clearance register

Auditors will ask for evidence that every worker in a risk-assessed role holds a valid NDIS Worker Screening clearance.

Adequate evidence: A register showing clearance number, jurisdiction of issue, current status, expiry date, and date of last status verification for every active worker in a risk-assessed role. The register should be current — not a snapshot from three months ago.

What a gap looks like: A folder of clearance certificate PDFs with no indication of current status. A spreadsheet with expiry dates but no verification dates. Workers on the roster with no clearance entry in the register.

More detail on what the register must contain is in the article on the NDIS Worker Screening Check compliance guide.

2. Qualification and training records

Auditors will select a sample of worker files and review qualification records for each. The specific qualifications checked depend on the supports being delivered.

Adequate evidence: For each worker, a record of each required qualification — certificate name, issue date, expiry date, uploaded document — with evidence that the qualification was current for the period the worker delivered supports. For first aid and CPR, both the certificate and the CPR refresher (often a separate renewal cycle) should be present.

What a gap looks like: A certificate on file with an expiry date that has passed. A certificate covering a previous period with a gap between expiry and renewal. A qualification type required for a support being delivered, but not present in the worker's file.

See NDIS Worker Qualification Tracking for a complete list of qualification types and register requirements.

3. Orientation and induction records

The NDIS Commission expects evidence that workers have completed appropriate orientation before they begin delivering supports. This covers the NDIS Code of Conduct, mandatory reporting obligations, the organisation's policies and procedures, and — where relevant — participant-specific support plans.

Adequate evidence: A completed orientation checklist signed by both the worker and a manager or supervisor, with a date. For organisations with a structured induction program, completion records from any online or in-person modules. Signed acknowledgement of the NDIS Code of Conduct as a standalone document.

What a gap looks like: A new worker on the roster before orientation documentation is complete. An orientation checklist without a manager countersignature. No record of Code of Conduct acknowledgement.

4. Competency assessments for High Intensity supports

If any workers deliver supports classified as High Intensity Daily Activities, auditors will specifically look for competency assessment records — not just training certificates.

Adequate evidence: A competency record for each high intensity activity, showing the specific procedure, the assessment date, the assessor's name and AHPRA registration number, the assessment method, the outcome, and any conditions or limitations. An authorisation to practise independently (or a current supervision arrangement if independent practice has not yet been authorised).

What a gap looks like: A training certificate for "enteral feeding" with no corresponding competency assessment. A competency record with no assessor credentials. A worker delivering a high intensity support independently with no "authorised to practise independently" notation.

Detailed requirements for clinical competency records are in the article on clinical competency management for NDIS providers.

5. Supervision records

For workers who are new to a role, new to a specific support type, or under a development plan, evidence of supervision is required. This is distinct from clinical delegation supervision — it covers general workforce management supervision.

Adequate evidence: Dated supervision notes, even brief ones, that record the topic covered and the supervisor's name. For clinical support workers under delegation, a delegation record specifying the supervising RN and the conditions of supervision.

What a gap looks like: No supervision records for a probationary worker. A clinical delegation arrangement with no documented supervision component. Supervision records that are generic ("discussed workload") rather than specific to the support being delivered.

6. Incident-to-worker linkage

If there have been reportable incidents during the period under review, auditors may look for evidence of how workforce compliance was considered as part of the investigation.

Adequate evidence: Incident records that include the assigned worker's details, an assessment of whether the worker was appropriately qualified and supervised at the time, and any workforce-related corrective actions taken.

What a gap looks like: Incident records that do not reference the assigned worker's compliance status. Corrective actions that address participant-side factors but not workforce factors. A pattern of incidents involving the same worker with no workforce compliance review triggered.

Initial certification vs recertification: what is different

Initial certification (first-time registered providers) tends to be more document-intensive because there is no audit history to draw on. Auditors are establishing a baseline. They may review a larger sample of worker files and ask for evidence of how compliance systems were established — not just that they exist now.

Recertification (providers renewing registration) involves a comparison to the previous audit. If a previous audit raised workforce compliance findings, auditors will specifically check whether those findings were addressed. A finding from the previous audit that has not been resolved is the worst possible outcome — it suggests the organisation is not responsive to the Commission's requirements.

For recertification, the key question is: what has changed since the last audit? If the answer is "nothing — our workforce has grown but we are still using a spreadsheet," that is a risk flag.

The complete worker file: what should be in it

When an auditor selects a worker for spot-check review, a complete file should contain:

Not every worker will need every item. What matters is that the file contains all items required for that worker's role and support types, and that it is easy to navigate — a single place, not a cross-reference exercise across three systems.

Red flags that attract more scrutiny

Auditors are experienced at identifying organisations where compliance is genuinely embedded versus organisations that have assembled documentation specifically for the audit. The following patterns attract more scrutiny:

Documents with identical issue or upload dates. If twenty worker files all have orientation checklists dated one week before the audit, that is a red flag that documents were backdated.

Templated competency records with no individual detail. A competency record that reads the same for every worker (same assessor, same date, same wording) suggests it was completed as a batch exercise rather than as a genuine individual assessment.

No lapsed qualifications anywhere. In any workforce of meaningful size, some qualifications will lapse and be renewed. A register showing 100% current compliance with no lapses in history is either a sign of an excellent system or a sign that the register is not the source of truth.

Roster entries that cannot be traced to worker files. If the roster shows a worker delivering a support but there is no file, or the file has no relevant qualifications, the gap is immediately visible.

Using technology to make audit prep a reporting exercise

The organisations that find audits least stressful are those that treat audit prep not as a separate project but as a reporting exercise against a system they maintain continuously. The question "can I produce this evidence?" has an immediate yes — because the evidence is live, not assembled on demand.

What that requires: a system where clearances, qualifications, competency records, and training completion are maintained against worker profiles, with document uploads and expiry tracking built in. When the audit request arrives, the response is a series of exports and reports — not a manual data-gathering exercise.

Teiro gives you a workforce compliance register that is maintained in real time and can be exported for audit. Book a demo to see how audit preparation works in practice, or sign up to start building your register.