A back-office guide for NDIS compliance

Foreword

Navigating the National Disability Insurance Scheme (NDIS) in Australia can be quite a challenge, especially for smaller operators. The NDIS Quality and Safeguards Commission (NDIS Commission) sets standards for the safety and wellbeing of participants, and the rules change often. Effective back-office processes, such as thorough documentation, regular staff training and good incident management, make it easier to meet those standards and to show an auditor that you do.

This guide separates two things. Provider-wide compliance (registration, the NDIS Practice Standards, worker screening, incidents and complaints) is the provider’s responsibility. Financial operations (bookkeeping, payroll, billing and claims) support it. It reflects the rules as at October 2026 and is general information, not legal or compliance advice.

Putting solid operational structures in place can make compliance a part of everyday routine rather than a daunting task. Regular internal reviews and timely expert advice help NDIS providers stay on top of their obligations and keep improving, which benefits both providers and participants.

Guide for NDIS Providers in Australia: Staying Compliant

1. The Current Compliance Requirements for NDIS Providers

Overview of NDIS Compliance: All NDIS providers, registered or not, must follow the NDIS Code of Conduct. Registered providers have further obligations as conditions of their registration. Key areas include:

• Registration Requirements: Registration with the NDIS Commission is required to provide certain supports, including specialist disability accommodation, specialist behaviour support, supports to participants with NDIA-managed funding, plan management and, from 1 July 2026, supported independent living and NDIS digital platform services. Registration involves an audit against the NDIS Practice Standards and a suitability assessment, and is generally for three years. Unregistered providers can support self-managed or plan-managed participants only where the support does not require registration. Check the applicable transition arrangements for supported independent living and digital platform providers; a participant’s funding-management choice does not override mandatory registration.
• NDIS Practice Standards: These apply to registered providers and cover participant rights, provider governance and operational management, provision of supports and the support environment, with extra modules for some supports. Registered providers must show they meet them at audit.
• Worker Screening: Registered providers must make sure workers in risk-assessed or key personnel roles hold an NDIS Worker Screening Check clearance. The check, done by state and territory screening units, assesses whether a worker poses a risk to people with disability. A clearance is valid for up to 5 years.
• Incident Management: All providers must respond to incidents under the Code of Conduct. Registered providers must have an incident management system and report certain serious incidents (reportable incidents) to the NDIS Commission.
• Complaints Management and Resolution: Providers need a clear system for handling complaints so participants’ concerns are dealt with promptly and fairly.
• Quality Management Systems: Implementing and maintaining a quality management system helps ensure continuous improvement and compliance with NDIS standards.
• Documentation and Record-Keeping: Maintaining accurate and comprehensive records is also crucial. This includes service agreements, incident reports, worker training records, and participant feedback.

How does this impact your back-office?

This heightened level of compliance requires NDIS providers to take back-office operations seriously, keeping financial records to the same standard as operational information. Key scenarios include:

• Detailed Record-Keeping: Ensure all transactions, including payments to workers, services provided, and any incidents or complaints, are meticulously documented. Accurate records help in tracking compliance and financial health.
• Worker Screening and Payroll: Regularly check that workers in risk-assessed roles on your payroll hold a current clearance, and track expiry dates (clearances last up to 5 years). Pay workers under the right award, usually the SCHADS Award, whose rates change on 1 July each year and again from 1 December 2026 for disability home care employees.
• Incident Management Records: Keep detailed reports in the controlled incident-management system, with access limited to authorised people. Record only necessary incident-related costs and a non-identifying reference in the accounts. Restrict access to any link between those records and the participant or incident details.
• Accurate Billing and Invoicing: Keep precise records of every support delivered. For NDIA-managed and plan-managed funding, do not exceed the applicable maximum in the current NDIS Pricing Schedule. These statutory price limits do not apply to self-managed funding; agree the price with the participant. See the pricing determination and its scope. How you claim depends on how the participant’s plan is managed: NDIA-managed claims go through the myplace provider portal, plan-managed invoices go to the plan manager, and self-managed participants pay you directly. New laws passed in August 2026 require claims to be made within 90 days of delivering a support from December 2026.

2. NDIS Audits and Common Issues

How NDIS Audits Work:

Registered providers are audited by an approved quality auditor, which the provider engages and pays. Providers of lower risk supports have a verification audit (a desktop review). Providers of higher risk supports have a certification audit (a desktop stage, then an onsite stage within 3 months) and a mid-term audit 18 months into their registration period. The NDIS Commission can also require condition audits. The auditor assesses how well you meet the NDIS Practice Standards and records findings such as:

1. Conformity: you meet the requirement.
2. Improvement opportunity: you meet the requirement, but the auditor suggests a way to strengthen it.
3. Minor non-conformity: a gap, often in documentation, that needs a corrective action within the timeframe the auditor sets.
4. Major non-conformity: a more serious gap that needs prompt corrective action.

If You Fail an NDIS Audit:

A non-conformity doesn’t mean you have failed. It means something needs to be corrected. The auditor explains what evidence is needed and the timeframe for corrective action.

• Minor non-conformities: fix them within the agreed timeframe and keep evidence of the fix.
• Major non-conformities: arrange corrective action immediately. Under the approved quality-auditor scheme, they must be downgraded or closed within three calendar months of initial written notification; unresolved findings trigger the scheme’s escalation and suspension rules. Rechecking at a mid-term or recertification audit is additional to this deadline.

After the audit, the outcome depends on what was found:

• The auditor sends a final report to the NDIS Commission, after you have had a chance to check it for factual accuracy.
• The NDIS Commission makes the registration decision, and can impose conditions, including a condition audit.
• If serious issues remain, the NDIS Commission decides whether you can keep providing registered supports.

Common Reasons for Failing Audits:

1. Poor Documentation: Not having adequate documentation is a common issue. Use NDIS management software to keep everything organised and up to date.
2. Lack of Preparation: Auditors need to see evidence of your compliance. Make sure all your documents, incident records, and risk assessments are ready for review.
3. Outdated Staff Information: Ensure your staff’s qualifications and competencies are up-to-date and documented. Use software that helps manage staff information and qualifications.

Ramifications of Non-Compliance: Failing to meet NDIS compliance requirements can lead to severe consequences, including:

• Enforcement action: The NDIS Commission can issue compliance notices and infringement notices, and can seek civil penalties in court. These can be a significant burden, especially for smaller providers.
• Suspension or Revocation of Registration: Serious breaches can result in the suspension or cancellation of a provider’s registration. This can lead to the loss of ability to provide services under the NDIS, affecting revenue and business operations.
• Damage to Reputation: Non-compliance can lead to loss of trust and damage to the provider’s reputation, affecting their ability to attract and retain participants. A tarnished reputation can have long-term impacts on business growth and sustainability.

3. The Operational Structures and Expert Resources Recommended to Remain Compliant

Establishing Effective Operational Structures:

• Governance and Leadership: Strong leadership and governance structures are vital. This includes a dedicated compliance officer or team responsible for overseeing compliance efforts. Effective governance ensures accountability and strategic oversight.
• Staff Training and Development: Regular training sessions for all staff on NDIS standards, incident management, and complaint handling are essential. Continuous professional development helps staff stay updated on best practices and regulatory changes.
• Internal Audits and Reviews: Conducting regular internal audits helps identify and address compliance gaps before external audits. Internal audits should cover all aspects of service delivery and administrative processes.

Leveraging Expert Resources:

• Compliance Consultants: Hiring NDIS compliance consultants can provide valuable insights and guidance on maintaining compliance.
• Legal Advisors: Legal experts can help you understand complex regulatory requirements and your legal obligations.
• Technology Solutions: Compliance management software can simplify documentation, incident reporting and audit preparation.

Checklist: Operational Structures

1. Appoint a dedicated compliance officer
2. Establish compliant financial processes
3. Establish governance and leadership structures
4. Conduct regular staff training and development sessions
5. Implement internal audits and reviews
6. Leverage expert resources and technology solutions

Impacts on Bookkeeping and Payroll: Red tape and extra compliance requirements can mean more headaches, especially for the inexperienced operator. Accessing expert resources early in your establishment can greatly improve your operational efficiency and avoid issues in future.

• Keep financial records ready for review: Make sure all transactions are accurately recorded and categorised, and reconcile accounts regularly. Good bookkeeping and payroll processes make internal and external reviews much easier.
• Governance and Oversight Costs: Budget for the salaries of compliance officers or consultants. Ensure financial plans include provisions for compliance oversight.
• Training Expenses: Allocate funds for regular staff training sessions and development.

4. The Ongoing Processes and Timings to help you Remain Compliant and Complete ‘Self-Audits’

Ongoing Compliance Processes:

• Regular Training and Updates: Continuous education for staff on updated NDIS standards and practices. Regular updates ensure that staff are aware of any changes in compliance requirements.
• Incident and Complaint Management: Promptly addressing and documenting all incidents and complaints. A proactive approach to incident management helps in mitigating risks and maintaining trust.
• Participant Feedback: Regularly collecting and acting on feedback from participants to improve service quality. Participant feedback is crucial for continuous improvement and ensuring service satisfaction.

Suggested Timing for Compliance Activities:

• Monthly: Review incident and complaint logs, conduct staff training sessions. Monthly reviews help in early identification of potential compliance issues.
• Quarterly: Internal audits to assess compliance with NDIS standards, review participant feedback. Quarterly audits ensure ongoing compliance and allow for timely corrective actions.
• Annually: Comprehensive self-audit, update quality management systems, check worker screening clearances that expire in the next year (they last up to 5 years and can be renewed from 90 days before expiry), and make sure all documentation is up to date. An annual self-audit also helps you prepare for external audits.

Self-Audit Checklist:

1. Review of Compliance Documentation: Ensure all required documents are complete and up to date. This includes policies, procedures, incident reports, and training records.
2. Staff Training Records: Verify that all staff have completed necessary training. Maintain a log of all training sessions and participant details.
3. Incident and Complaint Logs: Check for thorough documentation and appropriate responses. Review incident logs for patterns and take corrective actions as needed.
4. Participant Feedback: Evaluate feedback for areas of improvement. Implement changes based on feedback to enhance service quality.
5. Quality Management System Review: Assess the effectiveness of the quality management system and identify areas for enhancement. Ensure that the quality management system aligns with NDIS standards and best practices.

Impacts on Bookkeeping and Payroll:

• Documentation Review: Regularly review financial documents to ensure compliance with NDIS standards. This includes ensuring that all expenses are properly recorded and justified.
• Training Costs: Track and manage costs associated with staff training and development. Include training expenses in financial forecasts.
• Audit Costs: Budget for the costs of internal and external audits. Ensure that audit costs are factored into the annual financial plan.
• Incident Management Costs: Document and manage costs related to incident management and resolution. Include these costs in financial reports to ensure transparency.

These steps help smaller NDIS providers meet their obligations and look after their participants. Check the NDIS Commission’s website for changes, as registration rules, pricing and claiming requirements are changing through 2026 and 2027.

How Visory Can Help You Stay Compliant

Provider-wide compliance stays with you, but the financial side doesn’t have to. Visory runs bookkeeping, payroll, accounts payable and accounts receivable for NDIS providers, with a dedicated team and our AI, Delphi, overseen by that team. Here’s how we can support you:

• Bookkeeping and payroll: We keep your books reconciled and run payroll, so your financial records are current.
• Document Management: We help you keep thorough, organised financial records.
• Audit Preparation: When an audit or review is coming, we help you pull together the financial records it needs.

Visory Insights and a Business Performance Partner then turn your numbers into decisions. Book a discovery call to see how it would work for your organisation.

Or see how Visory works in practice.