NDIS Auditing

NDIS Certification vs Verification Audit: Which Applies to Your Organisation

If you run, or want to work with, a business that delivers National Disability Insurance Scheme (NDIS) supports, you will run into one of two audit words fairly quickly: verification or certification. They sound similar, but they lead to very different audit processes, timeframes and costs. Choosing the wrong one, or assuming both work the same way, can slow down your registration and add expense you did not need to spend.

This guide sets out what each pathway is, what the audit actually looks like, who conducts it, and how to tell which one applies to your organisation. It is written in plain English for providers, aspiring auditors, and anyone weighing up a career in quality auditing. TalentMed Pty Ltd (RTO 22151) trains people in the auditing skills used across this space through the BSB50920 Diploma of Quality Auditing, and we will explain where that fits near the end.

One thing to say up front: TalentMed does not conduct NDIS audits, and we do not advise on your specific registration. For decisions about your own audit, always check the current guidance from the NDIS Quality and Safeguards Commission and speak with an approved auditor.

Both audit pathways measure the same thing: whether a provider meets the NDIS Practice Standards. These are the quality and safety rules that registered providers must follow. They cover areas such as rights and responsibilities, provider governance and operational management, the provision of supports, and the environment those supports happen in. Some supports also have their own module of standards on top of the core ones.

The difference between verification and certification is not what the standards say. It is how deeply an auditor examines the provider against them, and that depth is decided by the level of risk in the supports being delivered. Lower-risk supports get a lighter-touch check. Higher-risk or more complex supports get a fuller, on-site examination. Everything below flows from that single idea.

The verification audit is the lighter of the two. It applies to providers delivering lower-risk supports, where a full on-site certification audit would be more scrutiny than the risk calls for. Think of supports that are lower-intensity and carry less chance of harm to a participant if something goes wrong.

A verification audit is a single-stage process. There is only one round, not two. It is usually conducted off-site, which means the auditor reviews your documents and evidence remotely rather than visiting your premises. It is typically carried out by one auditor. Because it is a document-based check by a single auditor in one stage, it is generally faster and less costly than a certification audit.

During a verification audit, the auditor looks at whether your organisation has the right policies, procedures and records in place to meet the parts of the NDIS Practice Standards that apply to your supports. They are checking that your systems exist and are sound on paper, rather than watching your supports being delivered in person.

The certification audit is the fuller process. It applies to providers delivering higher-risk or more complex supports, such as supports that involve close personal care, behaviour support, or specialist services where the consequences of poor quality are more serious.

A certification audit runs in two stages. Stage 1 is a review of your documented systems, similar in spirit to the verification check but more detailed. It confirms you are ready for the deeper look that follows. Stage 2 is the main event: an on-site assessment where auditors observe how your supports are actually delivered, interview staff and, with consent, participants, and test whether your day-to-day practice matches your paperwork.

A certification audit is conducted by an audit team of at least two auditors, and because it includes an on-site stage across two rounds, it takes longer and costs more than a verification audit. Certification is also the pathway that carries ongoing audit obligations across a registration cycle, including a mid-term check, which we cover in a separate guide.

Here is the side-by-side view. Use it as a quick reference, then read the section below for how the pathway is actually decided.

You do not simply pick the pathway you prefer. The pathway is set by the supports you are registering to deliver. When a provider applies to register with the NDIS Commission, the registration groups they select determine the level of risk, and the risk level determines whether they follow the verification or the certification pathway. Some providers deliver a mix, which can bring both types of assessment into play across their scope.

Because the classification of supports and registration groups can change, the safest move is never to guess. Check the current NDIS Commission guidance for your registration groups, or ask an approved auditor to confirm the pathway before you commit to a quote. The two links you will want for your own supports are the NDIS Practice Standards themselves and the Commission’s provider registration information.

If you are researching this for a career rather than a registration, the practical takeaway is that a working auditor needs to understand both pathways, because they may be assigned to either depending on the provider. Our companion article on the NDIS quality auditor role in Australia walks through what the job looks like day to day.

Neither audit is run by the NDIS Commission itself. Both are carried out by independent bodies called Approved Quality Auditors, often shortened to AQAs. An AQA is a certification body that has been approved to audit NDIS providers against the Practice Standards.

AQAs are accredited under the ISO/IEC 17021 standard for bodies that audit management systems, and the approval scheme is administered by the Joint Accreditation System of Australia and New Zealand (JASANZ). Individual auditors do not operate on their own. They work for, or on behalf of, an AQA, and it is the AQA that holds the approval to sign off an audit.

Two points are worth knowing. First, the availability of AQAs is not fixed. As at the time of writing, the NDIS Commission is not accepting new AQA applications, following the NDIS Review and the Disability Royal Commission, while the scheme goes through reform. Second, because the AQA model is under review, some of the finer detail may change over time. Always confirm the current position with the NDIS Commission rather than relying on any single article, including this one.

For a provider, the practical effect is that your choice of auditor comes from the pool of AQAs currently approved for your registration groups. For someone building an auditing career, it is a reminder that the NDIS space is active and evolving, which is exactly why solid, transferable auditing skills matter more than knowing one scheme’s rules by heart.

If reading about audits has you thinking about doing them for a living, here is how the skill side works. To audit NDIS providers as an individual, you generally need two things. The first is a recognised auditing qualification, and the Lead Auditor Skill Set (BSBSS00128) is the qualification named for this purpose. The second is the NDIS Commission’s own mandatory auditor training, which is specific to the scheme and sits on top of your general auditing skills.

This is where the BSB50920 Diploma of Quality Auditing fits in. The Diploma builds the core auditing competencies that underpin quality auditing across many settings, and it contains the four nationally recognised lead-auditor units that make up the BSBSS00128 Lead Auditor Skill Set. In other words, studying the Diploma is a way to build the auditing foundation that the individual NDIS auditor pathway asks for.

To be clear about the boundary, the Diploma on its own does not authorise you to conduct NDIS audits. That requires the scheme-specific NDIS Commission training and working under an approved AQA, both of which sit outside any single course. What the Diploma does is give you the transferable auditing skillset that this and other auditing careers are built on. For eligible students, BSB50920 is approved for VET Student Loans (VSL), which can help with the cost of study. Eligibility and terms are set by the Australian Government.

If you are comparing where auditors sit inside and outside an organisation, our guide on the difference between an internal and external auditor is a useful next read. You can also explore the full picture of the field on our quality auditing hub, or see the course detail on the BSB50920 Diploma of Quality Auditing page.

TalentMed Pty Ltd, RTO 22151, delivers the BSB50920 Diploma of Quality Auditing 100 percent online with flexible study. If you want to build the auditing skillset that underpins careers across NDIS, healthcare, aged care and ISO quality management, explore the BSB50920 Diploma of Quality Auditing or browse more guides on our quality auditing hub.