Guides

Audit documents

What documents do I need for an NDIS registration audit?

For small providers getting an NDIS registration or renewal audit ready.

Short answer: Start with the documents your auditor asks for. That usually means policies, registers, worker records and examples of your procedures in use. Keep them in one index. See the source.

The list below is our way to organise a starting set. Your auditor's written request and your agreed scope decide what you must send.

Start with your agreed scope

Before you collect files, write a one page scope sheet. Put these facts on it.

• Your legal or trading entity.
• Your registration status today.
• The supports you deliver or plan to.
• Your modules, sites and operating area.
• How many workers you have, and the relevant date.

If you are not registered, say so. Note any high intensity supports. If you run a platform, describe what it does. Mark anything you are not sure about as Unsure.

Your index should say six things about each file: which entity owns it, which support or module it covers, and who owns the control. Then the version or review date, what the file shows, and whether it is missing. Never write a new dated record to suggest you did the work earlier.

Build a sensible preparation list

1. Governance and scope. Entity details, role descriptions, written scope, policy index, document control rules and who is responsible now.
2. Rights, privacy and service delivery. Your policies, your controls on participant information and a short description of how you deliver the service.
3. Incidents and complaints. Written workflow, escalation and notification steps, registers, closeout fields and redacted examples.
4. Risk and continuity. Risk register, review schedule, emergency plans, owners and proof that actions get tracked.
5. Workers. An index showing screening, expiry dates, induction, training, supervision and competency. Use a redacted sample.
6. Evidence organisation. One index with file IDs, owner, date, status, handling limits, location and how each item links to your scope.

Keep identifying details out of working copies unless a secure process needs them.

Test the folder before you send it

Ask someone who did not build the folder to find a sample for each main control. Can they tell which version is current, who owns the next action, and a template from a completed record? Do the date, the scope and the handling limits show without opening every file?

Then compare your documents with your practice. A policy may say you escalate incidents. A redacted example shows whether the fields, owner, dates and closeout steps are really used. Where you do not know, write that down. Label draft and approved versions clearly.

Common mistakes

• Using a generic pack and assuming it matches your supports, sites or modules.
• Offering a policy index as proof that workers are trained or that a workflow runs.
• Sending full participant or worker data when a redacted sample would answer the question.

Sources

• NDIS Quality and Safeguards Commission, Types of audits, accessed 25 August 2026. This supports the audit types and process; the checklist above is Clearharbour practical guidance.