Very few providers set out to cut corners. Problems usually build quietly: a register that stops being updated, a worker whose screening lapses, a policy that no longer matches how the team works. Then an audit, a complaint or a reportable incident brings it all into view at once.
What happens next depends heavily on how you respond. A clear, timely response can turn a finding into a routine fix. A slow or defensive one can turn a minor gap into a major finding, or draw the attention of the NDIS Quality and Safeguards Commission.
This guide explains what the rules expect of every provider, how the regulator can respond when things go wrong, how audit findings work and the steps to take when a problem is found.
What the Rules Expect of Every Provider
Many people assume NDIS compliance only matters for registered providers. In fact, every NDIS provider and worker must follow the NDIS Code of Conduct, and the NDIS Commission can receive complaints and take action against registered and unregistered providers alike, including banning orders against organisations and individual workers.
Registered providers carry extra obligations. They must meet the NDIS Practice Standards for their registration groups, comply with their conditions of registration, maintain incident management and complaints systems, notify reportable incidents, make sure workers in risk-assessed roles are screened and complete audits at the required points in their registration cycle. These obligations apply every day, not just in audit week. Auditors can sample records from across your registration period, so a strong final month cannot make up for gaps in the months before it.
The stakes are rising. Registration is now compulsory for supported independent living and digital platform providers, with higher-risk supports to follow. Recent reforms have also tightened notification timeframes and introduced audits for some ownership changes. For many providers, the gap between what policies promise and what happens day to day is where problems usually start. As compulsory registration expands, today’s everyday habits will become tomorrow’s audit evidence.
How the Regulator Can Respond
When NDIS provider compliance falls short, the NDIS Commission has a graduated set of tools. Most matters are resolved at the lower end, but it helps to know the full range, because many actions are published on the Commission’s website.
- Education and warnings. For less serious issues, the Commission may start by explaining what is required and expecting the provider to fix it. This is the best outcome to aim for, and a prompt, cooperative response makes it more likely.
- Compliance notices. A compliance notice directs a provider to take specific action to fix a failure by a set deadline. Ignoring or missing that deadline can lead to further action.
- Enforceable undertakings. These are formal, written commitments a provider makes to the Commission, such as improving systems or training staff. Once accepted, they can be enforced in court if they are not kept.
- Infringement notices. For certain breaches, the Commission can issue a fine as an alternative to court proceedings.
- Suspension or revocation of registration. In more serious cases, the Commission can suspend or revoke a provider’s registration, which stops them delivering registered supports and affects every participant they support.
- Banning orders. The Commission can ban providers and individual workers from some or all NDIS work. Banning orders apply to both registered and unregistered providers and are published.
- Civil penalty proceedings. For the most serious breaches, the Commission can take a provider to court, where significant financial penalties can apply.
Regulatory action is not only triggered by audits. Complaints from participants, families or workers, reportable incidents and information from other agencies can all prompt the Commission to look closer. That is why everyday records matter so much: they are your evidence when someone asks what happened and what you did about it.
Understanding Audit Findings
For most registered providers, the audit is where gaps first come to light. The rules auditors follow are set out in the NDIS Approved Quality Auditors Scheme, and knowing them takes much of the fear out of a finding.
Auditors rate each relevant outcome. A minor non-conformity usually means a process exists but is not fully documented, or is documented but cannot be shown to be implemented, reviewed or evaluated. A major non-conformity means the provider cannot demonstrate appropriate processes, systems or structures to meet the required outcome at all.
The timeframes are strict. A corrective action plan must be presented within seven calendar days of written notification of any non-conformity. Major non-conformities must be closed or downgraded within three calendar months, and a major non-conformity prevents a certification recommendation. Minor non-conformities must be closed within eighteen months, at the mid-term or recertification audit, whichever comes first, or they are escalated to major.
Good NDIS audit compliance is therefore as much about the response as the result. A provider with minor findings and a clear, realistic corrective action plan can still be recommended for registration. A provider that lets findings drift risks escalation, and in some cases suspension of certification. Handled well, a finding becomes evidence of continuous improvement at your next audit.
Auditors also have duties of their own. If they identify a critical risk to participants, they must notify the NDIS Commission, immediately where criminal acts or child protection concerns are involved.
How to Respond When a Problem Is Found
Whether the problem comes from an audit, a complaint or the Commission itself, the first few days matter most. These steps help you respond in a way that protects participants and your organisation.
- Make participants safe first. If the finding points to a current risk, such as an unscreened worker or a restrictive practice used outside a plan, deal with that immediately. Paperwork can wait a few hours; participant safety cannot.
- Read the finding carefully. Identify exactly which outcome or obligation is involved and what evidence was missing. If anything is unclear, ask the auditor or the Commission to explain before you start fixing the wrong problem.
- Find the root cause. A missing training record may point to a broken onboarding process, not one forgetful manager. Fixing the cause prevents the same finding at your next audit.
- Write a specific corrective action plan. For each finding, state the action, who owns it, the due date and the evidence that will show it is done. Submit it within the deadline, and keep it realistic.
- Fix the system, not just the file. Update the policy, the form, the training and the practice together. Never backdate or recreate records after the event, as this can turn a fixable gap into a far more serious problem.
- Bring your team with you. Explain the finding and the changes to the workers who need to know, and record that briefing. Auditors often test whether a fix has reached frontline staff.
- Check that the fix holds. Revisit the issue weeks or months later with a short internal check. Evidence that a change has stuck is exactly what an auditor looks for when closing a finding.
If you receive a formal notice from the Commission, respond within the timeframe it sets and consider independent legal advice, particularly for enforcement action. It also helps to keep a single register of open findings, whatever their source, so nothing is forgotten when staff change or priorities shift.
How Angels Compliance and Training Services Can Help
Angels Compliance and Training Services is a compliance consultancy based in Gosnells, Western Australia, supporting NDIS and DVA providers across Australia. Because we are not an approved quality auditor, we can do what auditors cannot: advise you and help you build the evidence and systems you need.
If an audit has raised findings, we can help you understand them, write a clear corrective action plan and work through close-out with you. Our internal audits are scoped to your registration groups, test your documents against daily practice through staff interviews and end with a written report in which every finding has a specific fix, an owner and a due date.
Final Thoughts
Every provider will face a finding at some point. What matters is how quickly and how well you respond. Make participants safe first, understand the finding, fix the root cause and meet every deadline, from the seven-day corrective action plan to the final close-out. Treat each finding as a chance to strengthen your systems, and you will spend far less time worrying about the regulator and far more time delivering good support.
Disclaimer: This article is general information for NDIS providers and is not legal or financial advice. NDIS rules, audit requirements and enforcement powers can change, and your obligations depend on your registration and circumstances. Always check current guidance from the NDIS Quality and Safeguards Commission, and seek legal advice if you receive formal enforcement action.
