Key Takeaways
An NDIS compliance checklist only works when every item has an owner, a review date and saved evidence. Review six areas: worker screening and qualifications, training records, incident management, participant and service records, policies, and audit evidence. Reportable incidents are time-critical, and most must be notified within 24 hours of becoming aware. Do a short monthly check instead of a panic before audit. Software such as Ausvanta keeps records together, but responsibility stays with your team.
Most compliance problems are not dramatic. A screening check expires unnoticed. A policy is two reviews out of date. A shift was delivered but nobody can find the note that proves it. Each is small, but together they are what an auditor finds, and what slows a claim down when records and billing do not match.
That last link matters more than it looks. A claim is only as defensible as the service record behind it, which is why compliance and claims and billing should be reviewed together. This checklist covers the records and processes worth reviewing, who should own them, and how often.
An NDIS compliance checklist is a working list of the records, processes and checks a provider reviews to show it meets its obligations under the NDIS Act, the NDIS Practice Standards, the Code of Conduct and the incident management rules. A good one names an owner, a review frequency and the evidence for each item.
Generic checklists tell you what to have. They rarely say who checks it, how often, or what proof to keep. Three fixes make a checklist usable:
Registered providers must ensure workers in risk-assessed roles hold an NDIS worker screening clearance, and must keep a written record of those roles and of each worker engaged in them. Providers verify and check status through the NDIS Commission Portal. Our worker screening check guide walks through the process.
Review monthly:
Evidence: screened-workers report from the portal, role register, qualification copies.
Training records are where good providers lose marks, usually because the training happened but was never recorded.
Review quarterly:
Evidence: training matrix, certificates, sign-off forms.
This is the most time-critical area. Registered providers must have an incident management system that records all incidents, reportable or not, and must notify the NDIS Commission of reportable incidents through the portal. Timeframes run from when the provider became aware.
| Incident type | Notify the NDIS Commission |
|---|---|
| Death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault of a person with disability | Within 24 hours, then additional information within 5 business days |
| Unauthorised use of a restrictive practice | Within 5 business days (24 hours if it causes harm) |
A final report may also be required within 60 business days of the 5-day report, if the Commission asks for one. Check the NDIS Commission's reportable incidents guidance for the current list.
Review monthly:
Evidence: incident register, portal notification receipts, corrective action records. Ausvanta's incident management feature is built to capture, triage and track incidents in one place.
Participant records prove that supports were agreed, delivered and billed correctly.
Review monthly (sample 5 to 10 participants):
A useful test: pick one claim and trace it back through the invoice, timesheet, roster and note. If any link is missing, you have a gap. Our guides to NDIS time tracking, rostering and the claims process cover each link.
Evidence: agreements, plans, notes, timesheets, claim batches.
Auditors want to see that you do what your policies say, so a policy nobody follows is worse than none.
Review quarterly:
Evidence: policy register with review dates, meeting minutes, improvement log entries.
Audit pathways differ. Providers delivering lower-risk supports generally go through a verification audit, while others go through certification, which includes a mid-term audit roughly halfway through the three-year cycle. Check your registration groups with the NDIS Commission, and see our audit preparation checklist for the full process. Allied health providers can find specific guidance in our NDIS software for allied health article.
Keep ready all year:
A 45-minute monthly review is enough if the items have owners.
| Check | Owner | Evidence |
|---|---|---|
| Screening: expiries in next 90 days, new starters linked | Compliance coordinator | Portal report |
| Qualifications and registrations in date | Compliance coordinator | Staff records |
| Incident register: open items, notifications sent on time | Quality manager | Register, portal receipts |
| Training matrix gaps | Operations manager | Training matrix |
| Sample trace of 3 claims back to notes | Quality or billing lead | Roster, timesheet, note |
| Policies due for review in next 60 days | Quality manager | Policy register |
| Complaints and feedback logged and closed | Quality manager | Complaints register |
| Corrective actions overdue | Provider manager | Improvement log |
Software cannot make decisions about what is reportable or whether support was appropriate. It can stop records scattering across inboxes, spreadsheets and folders. Ausvanta's compliance and audit tools cover service verification, audit packs and registers, alongside rostering, time tracking and incidents in one platform. For a wider view, read how technology helps NDIS providers, and if you run supported accommodation see software for SIL providers. If you engage contractors, our subcontracting vs direct hiring guide covers the compliance side.
See how Ausvanta keeps compliance records in one place:
What should an NDIS compliance checklist include? Worker screening and qualifications, training records, incident management, participant and service records, policies and procedures, and audit evidence. Each item should have an owner, a review frequency and named evidence.
How often should I review NDIS compliance? A short monthly review for screening, incidents and records, with policies and training reviewed quarterly, works for most providers. Review incidents on the day they happen.
How quickly must reportable incidents be notified? Most must be notified to the NDIS Commission within 24 hours of the provider becoming aware, with additional information within 5 business days. Unauthorised restrictive practices generally have 5 business days, or 24 hours where harm results.
What records must I keep for worker screening? Registered providers must keep a written record of risk-assessed roles and of each worker engaged in those roles, and keep it up to date.
How often are NDIS providers audited? Registration runs on a three-year cycle. Certification providers also have a mid-term audit. Check your registration groups for your pathway.
This article is general information, not legal advice. Rules change, so confirm requirements with the NDIS Quality and Safeguards Commission.
Start your free 14-day trial — unlimited users, no credit card required.
