If you run an NDIS business, understanding an NDIS internal audit is no longer optional.
With the NDIS Commission increasing compliance activity across Australia, providers are under more pressure to prove that their systems actually work.
Many providers think audits are just about paperwork.
They are not.
An internal audit is about proving your organisation can deliver safe, high-quality supports consistently. It shows that your policies match real-life practice.
At LMS Compliance Services, I often see providers panic before a certification or mid-term audit because they waited too long to review their systems. The good news is that most audit issues are preventable with the right structure and preparation.
If you understand how internal audits work, you can:
- Reduce compliance risks
- Prepare confidently for external audits
- Improve participant outcomes
- Avoid costly corrective actions
- Build a stronger quality management system
Quick Summary
- An NDIS internal audit is part of the Quality Management requirements under the NDIS Practice Standards.
- Certification providers are expected to maintain a documented internal audit program.
- Internal audits help providers prepare for verification, certification, mid-term, and condition audits.
- Auditors assess more than policies. They review interviews, observations, records, and evidence of implementation.
- Common non-conformities include poor incident management, incomplete worker records, and outdated registers.
- A good internal audit focuses on continuous improvement, not box-ticking.
- Small providers can stay audit-ready with a practical risk-based review schedule.
What Is an NDIS Internal Audit?
An NDIS internal audit is a structured review of your systems, processes, and evidence against the NDIS Practice Standards.
Think of it as a health check for your business.
It helps identify gaps before an external auditor or the NDIS Commission finds them.
The NDIS Commission states that providers assessed against the Core Module must maintain “a documented program of internal audits” proportionate to their size and complexity (Source: NDIS Practice Standards).
Internal audits typically review:
- Policies and procedures
- Staff training records
- Incident management
- Complaints handling
- Participant documentation
- Risk registers
- Governance systems
- Evidence of continuous improvement
Internal Audit vs External Audit
This is where many providers get confused.
| Audit Type | Purpose | Conducted By |
|---|---|---|
| Internal Audit | Self-assessment and improvement | Internal team or consultant |
| Verification Audit | Lower-risk registration review | Approved Quality Auditor |
| Certification Audit | Full compliance assessment | Approved Quality Auditor |
| Mid-Term Audit | Ongoing compliance review | Approved Quality Auditor |
| Condition Audit | Targeted compliance review | Approved Quality Auditor |
An internal audit is proactive.
An external audit is formal regulatory assessment.
Is an NDIS Internal Audit Mandatory?
Yes — for many registered providers
The confusion usually comes from the difference between verification and certification pathways.
According to the NDIS Commission, providers assessed under the Core Module must maintain a documented internal audit program as part of their quality management system.
This requirement sits inside the Quality Management indicators under the Practice Standards.
(Source: NDIS Commission Practice Standards)
Why providers get mixed messages
Verification providers often complete a simpler desktop assessment.
Because of this, some smaller providers assume internal audits are optional.
In practice, internal audits are still considered best practice because they:
- Reduce compliance risk
- Improve service consistency
- Prepare providers for future growth
- Support evidence collection
Sharon Floyd, an NDIS compliance consultant, publicly stated:
“Internal Audits are a mandatory requirement…”
(Source: LinkedIn public commentary)
Which Providers Need Internal Audits and When?
Verification providers
Verification applies to lower-risk supports.
Examples include:
- Plan management
- Transport
- Assistive product sales
Verification is mainly document-based.
However, providers still benefit from internal reviews to ensure systems remain current.
Certification providers
Certification providers face much higher scrutiny.
This includes providers delivering:
- SIL supports
- High-intensity supports
- Behaviour support
- Specialist disability accommodation
Certification involves:
- Stage 1 audit
- Stage 2 audit
- Mid-term audit at 18 months
- Renewal audit
(Source: NDIS Quality Audit Process)
Mid-term and condition audits
Mid-term audits focus heavily on governance and operational management.
Auditors assess whether your systems are still functioning effectively between registration periods.
The Commission may also impose a condition audit if concerns arise.
How Often Should Internal Audits Happen?
The NDIS Commission does not prescribe a fixed frequency.
Instead, audits should be “proportionate” to the provider’s:
- Size
- Complexity
- Risk level
- Scope of supports
This means there is no one-size-fits-all schedule.
A practical rolling schedule
At LMS Compliance Services, I usually recommend a rolling audit model.
Here is a practical example:
| Area | Suggested Frequency |
|---|---|
| Incident reviews | Monthly |
| Complaints review | Monthly |
| Staff records | Quarterly |
| Risk registers | Quarterly |
| Governance review | Six-monthly |
| Full system audit | Annually |
High-risk providers may require more frequent reviews.
Paperbark’s public NDIS guide recommends reviewing audit areas across a rolling 12–18 month schedule rather than auditing everything at once.
(Source: Paperbark NDIS Internal Audit Guide)
What Evidence Do Auditors Expect to See?
This is one of the biggest misconceptions in the sector.
Auditors do not simply check whether policies exist.
They assess whether your organisation actually follows them.
The NDIS Commission states that audits may include:
- Site visits
- Inspections
- Worker interviews
- Participant interviews
- Document reviews
- Requests for additional information
(Source: NDIS Quality Audit Process)
Documents and registers
Common evidence includes:
- Policies and procedures
- Risk registers
- Incident registers
- Complaints registers
- Internal audit schedules
- Corrective action registers
- Training records
Worker and participant interviews
Auditors often ask workers:
- How incidents are reported
- Where policies are located
- How restrictive practices are managed
- What to do during emergencies
Participants may be asked about:
- Choice and control
- Communication
- Safety
- Complaint processes
Observation and site evidence
Auditors also assess what they can physically observe.
Examples include:
- Medication storage
- Environmental safety
- Staff interaction quality
- Privacy protections
- Emergency preparedness
A LinkedIn compliance discussion explained it well:
“Audits do not just assess documents.”
(Source: Public compliance commentary)
Who Should Conduct the Internal Audit?
There are several options.
Self-audit
Small providers sometimes perform internal reviews themselves.
This is cost-effective but can reduce objectivity.
Peer review
Another staff member or department reviews the system.
This works better when there is enough organisational separation.
Consultant-led audit
Many providers engage external consultants for independence and expertise.
This is especially common before:
- Certification audits
- Mid-term audits
- Registration renewals
Mock external audit
This is the most rigorous option.
The process simulates a real certification audit, including interviews and evidence sampling.
Many providers use this approach to reduce audit stress.
What Are the Most Common Non-Conformities?
In my experience, most non-conformities fall into a few predictable categories.
Incident management
Common issues include:
- Missing incident records
- Delayed reporting
- Incomplete investigations
- Lack of corrective actions
Complaints management
Providers often fail to show:
- Complaint trends
- Resolution timeframes
- Participant feedback integration
Worker records
Auditors frequently identify:
- Expired screening checks
- Missing induction evidence
- Incomplete training records
- Outdated competencies
Policies that do not match practice
This is one of the biggest problems.
A provider may have excellent policies, but staff cannot explain them in interviews.
That disconnect creates compliance risk.
What Happens If Providers Ignore Audit Findings?
The consequences can be serious.
Between January and March 2025, the NDIS Commission reported:
- 6,841 compliance and enforcement activities
- 1,036 corrective action requests
- More than 4,000 education activities for providers in breach of conditions
(Source: NDIS Commission media release)
In 2026, the Commission highlighted a $1.1 million penalty involving serious reporting failures by an NDIS provider.
(Source: NDIS Commission enforcement announcement)
NDIS Commissioner Louise Glanville stated:
“The safety of people with disability is non-negotiable.”
How Internal Audits Support Continuous Improvement
The best providers do not treat internal audits as box-ticking exercises.
They use audits to improve participant outcomes.
A recent scholarly publication on disability safeguarding warned against compliance systems becoming:
“a box-ticking exercise disconnected from day-to-day practice.”
(Source: Springer publication on disability safeguarding)
Corrective action registers
Every audit finding should lead to:
- An action
- An owner
- A due date
- Evidence of completion
Quality improvement registers
Good providers track patterns over time.
This helps identify recurring issues before they become serious problems.
Leadership reporting
Internal audit results should be reported to leadership regularly.
This strengthens governance and accountability.
Suggested Internal Audit Framework for Small Providers
Here is a simple framework many small providers can follow:
- Create an annual audit schedule
- Review one system each month
- Record findings clearly
- Assign corrective actions
- Monitor closure dates
- Review trends quarterly
- Prepare evidence continuously
This approach reduces panic before audits.
Frequently Asked Questions About NDIS Internal Audit
What is the purpose of an NDIS internal audit?
An internal audit helps providers identify compliance gaps and improve systems before an external audit occurs.
Is an internal audit mandatory for NDIS providers?
Certification providers assessed against the Core Module are expected to maintain a documented internal audit program.
How often should internal audits occur?
The NDIS Commission recommends a proportionate approach based on risk, size, and complexity.
What do NDIS auditors look for?
Auditors assess documents, interviews, observations, records, and evidence showing policies are implemented in practice.
Can I conduct my own internal audit?
Yes, but external or independent reviews often provide stronger objectivity.
What is the difference between a mid-term audit and an internal audit?
A mid-term audit is an external compliance review conducted by an Approved Quality Auditor. An internal audit is conducted internally or by a consultant to prepare and improve systems.
How can LMS Compliance Services help?
LMS Compliance Services helps providers with:
- Internal audits
- Audit readiness
- Corrective action support
- Policy reviews
- Mid-term audit preparation
- Governance and compliance systems
Final Thoughts
A strong NDIS internal audit program is one of the best ways to protect your organisation, improve participant outcomes, and stay prepared for regulatory scrutiny.
The providers who succeed long-term are usually the ones who treat audits as a quality-improvement tool, not just a compliance requirement.
If you want expert support preparing for your next audit, LMS Compliance Services can help you build a practical, evidence-based NDIS internal audit system.
