Guides

Nonconformity response

What should an NDIS provider do when an auditor raises a nonconformity?

For providers with a written audit finding, condition, notice or evidence request.

Short answer: Keep the exact written finding, and check its scope and deadline. Work out which control failed and why, give each action an owner, and answer with truthful evidence. See the source.

Never backdate a record or invent practice. The five fields below are our way to organise a written response.

Save the finding as written

Keep the original report, notice or request. Keep its issue date, source, the module or standard it names, the response asked for, the deadline and any attachments.

Write a finding record that quotes the exact passage. Keep what the auditor observed separate from what you believe is true.

Do not shrink a detailed finding to "policy problem" before you check the evidence. It may be a missing control. It may be an incomplete record, an unclear owner, uneven practice, an open action or a scope mismatch. Answer the issue that was actually raised.

Use five response fields

1. Observation. What was found, where, when and against which agreed scope.
2. Cause. Why the control did not do its job. Was the policy missing, or written but not used? Was it one bad record, or a broken system?
3. Correction. What you have already done to contain the issue.
4. Corrective action. What will change so the cause is less likely to return. Name the owner, due date and review evidence.
5. Evidence. What you can send now, what will only exist later and where each item sits.

Use the response format your auditor asks for. Use these five fields to check that you answered every request.

Keep evidence accurate

A new policy shows a planned control. It cannot prove workers followed it before you wrote it. A new register gives you a structure. It cannot recreate a past event.

Evidence about training, supervision, worker practice or participant changes must come from real work.

Build a response index. Give each item a file ID, title, owner, date, status, handling limits and one line linking it to the finding. Label draft, implemented, awaiting evidence and not applicable. Where a fact is uncertain, say so and name the evidence you still need.

Your first actions

1. Read the finding twice. First for scope, then for the evidence it asks for.
2. Write the finding record and the response index. Keep the original wording next to your reading of it.
3. For each action, name the containment step, the cause question and the owner.
4. Mark what evidence exists now and what must come later. A placeholder is not a completed record.
5. If the finding, deadline or format is unclear, ask your auditor in writing.

Common mistakes

• Arguing against the finding before you understand what the report says.
• Editing a policy and calling the finding closed with no proof the control runs.
• Giving an owner an action with no due date, review step or evidence location.

When to use written triage

Audit Rescue is built for a written notice, nonconformity, condition or adverse report. It suits cases where the cause, the corrective action plan and the evidence response need a clear scope.

The first step is a written triage of your finding and deadline. Your auditor or the Commission decides whether the response is accepted. You carry out the action and keep the evidence accurate.

Sources

• NDIS Quality and Safeguards Commission, Information for quality auditors, checked 8 September 2026. This source covers corrective action plans and auditor follow-up; the five response fields above are Clearharbour practical guidance.