NDIS Auditing

The NDIS Audit Cycle and Mid-Term Audit Explained

If your organisation is registered to deliver NDIS supports through the certification pathway, your registration runs on a fixed three-year cycle. Inside that cycle there is a checkpoint many providers overlook: the mid-term audit. Getting the timing wrong, or assuming it does not apply to you, can leave a provider scrambling. This guide sets out the full NDIS audit cycle in plain English: when the initial audit happens, exactly when the mid-term audit falls due, which providers are exempt from it, and what the renewal audit at the three-year mark involves.

It is written for anyone working in or moving into NDIS quality and compliance, including people considering a nationally recognised auditing qualification such as the BSB50920 Diploma of Quality Auditing delivered by TalentMed Pty Ltd (RTO 22151). All audits described here are conducted against the NDIS Practice Standards by third-party bodies, not by TalentMed.

Every registered NDIS provider holds registration for a set period, and for most providers that period is three years. Registration is not a one-off tick of approval. It is a rolling arrangement that the NDIS Quality and Safeguards Commission expects a provider to maintain through ongoing compliance and periodic audit.

Which audit path a provider follows depends on the risk level of the supports it delivers. There are two pathways, and knowing which one applies is the first step to understanding your audit cycle:

• Verification pathway: for providers of lower-risk, less complex supports. It is a single-stage, off-site desktop review carried out by one auditor.
• Certification pathway: for providers of higher-risk or more complex supports, including registration groups that require specialist standards. It involves a two-stage audit (a Stage 1 desktop review and a Stage 2 on-site audit) carried out by an audit team of at least two auditors.

The distinction matters here because the mid-term audit only exists on the certification pathway. For a full plain-English breakdown of the two pathways, read our companion guide on NDIS certification versus verification audits. This article focuses on the timeline that follows once a provider is on the certification pathway.

A provider enters the certification cycle by passing its initial certification audit. This is the two-stage audit conducted by an Approved Quality Auditor, the independent body accredited to assess NDIS providers. Stage 1 is a desktop review of the provider’s policies, procedures and systems. Stage 2 is an on-site audit that tests whether those systems work in practice, including interviews with staff and, with consent, with participants.

When the audit team is satisfied that the provider meets the NDIS Practice Standards, it recommends the provider for registration. The provider’s registration is then granted by the NDIS Commission. This point, the date the Commission approves registration, is the anchor for everything that follows in the cycle. It is worth writing that date down, because the mid-term audit is measured from it rather than from the day the audit itself took place.

People who assess providers against these standards typically hold a recognised auditing qualification and complete the NDIS Commission’s own auditor training. The auditing skills that underpin that work, planning an audit, gathering objective evidence, testing against a standard and writing up findings, are the same skills taught in a nationally recognised auditing course. Our guide on becoming an NDIS quality auditor in Australia walks through that pathway in detail.

The mid-term audit is a compliance checkpoint that sits roughly halfway through the three-year certification cycle. Its purpose is to confirm that a provider has kept its quality systems working between the initial certification audit and the renewal audit, rather than letting standards slip once registration was granted.

Timing is the detail providers most often get wrong. The mid-term audit is due at approximately 18 months from the date the NDIS Commission approved the provider’s registration. It is measured from the Commission approval date, not from the date of the initial certification audit. Those two dates can be weeks or months apart, so using the audit date to plan your mid-term review can leave you late. Always count 18 months forward from the Commission approval that granted your registration.

The mid-term audit is narrower in scope than the initial or renewal audit. Rather than re-testing every NDIS Practice Standard, it concentrates on:

• The Governance and Operational Management standards, which cover how the organisation is led, how risk is managed, and how systems and records are maintained.
• Any outstanding corrective actions raised at the initial certification audit. If the audit team recorded non-conformities that the provider agreed to fix, the mid-term audit checks that those fixes were made and are holding.

Because the scope is focused, a well-run provider that has kept its governance systems current and closed out its corrective actions should find the mid-term audit far less demanding than a full audit. It is best treated as a reason to keep quality systems live year-round rather than a once-every-three-years event.

Not every registered provider has a mid-term audit in its cycle. Two groups are exempt:

• Verification-only providers. Because verification providers deliver lower-risk supports and follow the single-stage verification pathway, they do not have a mid-term audit at all. Their cycle runs from initial verification to renewal without a mid-point checkpoint.
• Specialist Disability Accommodation (SDA) only providers registered in group 0131. Providers registered solely for SDA under registration group 0131 are also exempt from the mid-term audit.

The mid-term audit therefore applies to certification-pathway providers other than those SDA-only 0131 providers. If your organisation delivers higher-risk or complex supports and sits on the certification pathway, plan for the mid-term audit unless you fall squarely within one of these two exemptions. If you are unsure which pathway or registration groups apply to your organisation, the NDIS Commission is the authoritative source, and a provider’s certificate will state its registration groups.

The table below sets out the full certification-pathway cycle so you can see how the pieces fit together across three years. Read the timing column as measured from the NDIS Commission approval date, since that is the anchor for the mid-term audit.

Verification-pathway providers and SDA-only group 0131 providers follow the same start and renewal points but have no mid-term audit row in their cycle.

Registration does not roll over automatically. To stay registered beyond the three-year period, a certification-pathway provider must pass a renewal audit before its current registration expires. The renewal audit mirrors the initial certification audit: it is a full two-stage assessment (desktop plus on-site) against all the NDIS Practice Standards that apply to the provider’s registration groups, conducted by an Approved Quality Auditor team of at least two auditors.

Providers generally begin the renewal process several months ahead of expiry, because the audit needs to be scheduled, conducted and reported, and the Commission needs time to decide on renewal, all before the current registration lapses. Leaving it to the final weeks risks a gap in registration, which can interrupt a provider’s ability to deliver supports. A provider that has treated the mid-term audit seriously and kept its systems current usually enters the renewal audit in a much stronger position than one that let compliance drift after year one.

Understanding the NDIS audit cycle is valuable for two groups of people: those running a provider who need to stay compliant, and those who want to build a career in quality and compliance auditing. For both, the underlying discipline is the same. Every audit in the cycle, initial, mid-term and renewal, relies on an auditor who can plan an audit, gather objective evidence, test performance against a documented standard, and report findings clearly and fairly.

Those are the exact skills covered in the BSB50920 Diploma of Quality Auditing. The Diploma includes the nationally recognised lead-auditor units that make up the auditing skill set, and it builds broad quality-auditing competency that transfers across sectors, including health, aged care, NDIS and generic management-system auditing. The quality auditing hub explains how the whole field fits together.

One important boundary to be clear about. Completing the Diploma builds recognised auditing competency, but it does not by itself authorise you to conduct NDIS audits. Auditing NDIS providers is done through Approved Quality Auditors, and individual auditors also complete the NDIS Commission’s mandatory auditor training and work under an accredited body. The Diploma is the recognised auditing qualification that sits at the base of that pathway, not a licence to audit on its own. For eligible students, the BSB50920 Diploma of Quality Auditing is approved for VET Student Loans (VSL), which can help with the cost of study. Current fees and payment options are on the course page.