Guide 06 · corrective action

What should an NDIS provider do when an auditor finds a non-conformity?

Last verified: 12 August 2026 · Applies to: providers with a written audit finding, condition, notice or evidence request.

Short answer: Preserve the exact written finding, confirm its scope and deadline, identify the control or practice that failed, find the cause rather than only the symptom, assign an owner, and map a truthful corrective-action response to evidence. Do not backdate records, invent practice or promise that a regulator or auditor will accept the response. The provider remains responsible for factual approval and implementation.

Start with the finding as written

Save the original report, notice or request with its issue date, source, affected module or standard, requested response, stated deadline and any evidence already attached. Make a short “finding card” that quotes the relevant passage and separates what the auditor observed from what the provider believes is true.

Do not translate a detailed finding into a broad label such as “policy problem” before checking the evidence. A finding may relate to a missing control, an incomplete record, unclear ownership, inconsistent practice, an unclosed action or a scope mismatch. The response needs to address the issue that was actually raised.

The local due-diligence file records that public audit ratings or disclosed compliance records should not be treated as proof that every detailed audit finding is publicly disclosed. Your internal response should therefore work from the provider's own written notice and evidence, not from a public summary or a generic example.

Source and date: Aged Care Quality and Safety Commission, “Graded assessment and audit ratings” and “Audit process”, accessed 12 August 2026; local due-diligence discrepancy D-005 limits the wording to public ratings and disclosed records.

Use a five-part response structure

1. Observation: what was found, where, when and against which agreed scope.
2. Cause: why the control or practice did not produce the expected result. Distinguish a missing policy from a policy that was not implemented, a one-off record error from a system pattern, and a resource issue from an unclear owner.
3. Correction: what the provider has done to contain or correct the immediate issue.
4. Corrective action: what will change so the same cause is less likely to recur. Name the owner, due date, dependency and review evidence.
5. Evidence: what the provider can truthfully provide now, what will only exist after implementation, and how the auditor or regulator can locate each item.

This structure is a working method, not a claim about what any particular auditor will accept. The request or engagement controls the final response format.

Keep evidence honest

A new policy can show a planned control. It cannot prove that workers used it before the policy was issued. A newly created register can establish a controlled structure. It cannot recreate a historical event or make a past record accurate. If the corrective action depends on training, supervision, worker practice or participant-facing change, the evidence must be generated by real operations.

Use a response index with stable IDs, document title, owner, date, status, privacy treatment and a sentence explaining the link to the finding. Mark draft, implemented, awaiting evidence and not applicable clearly. If a fact is uncertain, ask for clarification or state the limitation. A calm limitation is safer than a confident statement that the evidence cannot support.

What to do in the first written work block

1. Read the finding once for scope and once for evidence requests. Highlight dates, standards, sites, workers and required response fields.
2. Create a finding card and a response index. Keep the original wording beside the interpretation.
3. List the immediate containment step, the root-cause question and the owner for each action.
4. Mark which evidence exists now and which must come from implementation. Do not use placeholders as if they are completed records.
5. Send a written clarification question if the finding, deadline or required format is ambiguous.

Common mistakes

• Arguing against the finding before establishing what the report actually says.
• Changing a policy and calling the finding closed without evidence that the control was implemented.
• Giving one owner an action with no due date, dependency, review step or evidence location.

When a written rescue scope helps

Audit Rescue is designed for a written notice, non-conformity, condition or adverse report where the cause, corrective-action plan and evidence response need a defined scope. Its first step is a triage memo, not a closure decision. The Commission, auditor and provider decide whether a response is accepted, implemented or closed.

Related: policy versus evidence and preparation timing. This guide is operational information, not legal advice; last verified 12 August 2026.