NDIS audits that go sideways rarely fail because a provider did something terrible. They fail because the evidence isn't there, or it isn't organised, or it exists somewhere on a shared drive that nobody can find in twenty minutes under pressure. The training records are almost always the messiest part. Workers who finished a course months ago but never had their completion logged. A refresher that everybody knows happened but nobody can prove. A gap that looks fine on paper because you're counting the module from the worker's last employer, except you never actually checked whether it was the right module.
So this is the guide worth having handed to you before the auditor arrives. It covers what NDIS auditors are looking for when it comes to training, how verification and certification audits differ in what they ask of you, and a checklist you can work through before your next audit date. It's not a substitute for reading the standards. But it'll tell you where to look.
Verification versus certification: what changes for training evidence
The NDIS Quality and Safeguards Commission runs two audit pathways, and the depth of what they examine is different.
A verification audit applies to lower-risk support types. It's primarily document-based: the auditor reviews your policies, procedures, insurance, worker screening records, and operational documentation. Training records are reviewed on paper. There's no site visit, no staff interviews. If your documentation is clean and current, this audit is manageable. If it isn't, there's nowhere to hide.
A certification audit applies to higher-risk supports and is considerably more involved. The auditor visits your site, interviews workers, and observes service delivery. Training records still matter, but so does what your workers can actually demonstrate. A worker who has a certificate for something they can't explain in practice is a problem in a certification audit in a way that it might not surface in a verification one.
Both audit types assess you against the NDIS Practice Standards. The Core Module applies to every registered provider. Supplementary modules apply depending on which supports your registration covers.
What NDIS auditors are actually looking for in training
The Practice Standards don't hand you a list of courses to complete. What they expect is that you've made a sound judgement about what training your workforce needs for the people and supports you deliver, and that you can demonstrate it. An auditor isn't just checking that training happened. They're checking that it was the right training, for the right people, and that records show it.
In practice, that means auditors are looking for four things:
- That every worker has completed the Worker Orientation Module (Quality, Safety and You) and that certificates are on file and accessible.
- That each worker's training record links to the supports they actually deliver, not just a generic induction for everybody.
- That your provider has a documented rationale for the training program you chose, and that it connects to the risks and needs of the people you support.
- That you have a system, not just records, meaning auditors want to see that gaps are identified, training is kept current, and completion is tracked in a way that a new quality manager could pick up and understand on day one.
The last point is the one that catches people off guard. You can have done all the right training and still create a non-conformance by not being able to show your system for how you know it's happening and staying current.
The training-evidence checklist
Work through this before your audit date. The further out you start, the more time you have to close gaps without panicking.
| Evidence item | What to check | Common gap |
|---|---|---|
| Worker Orientation Module certificates | Every worker and key personnel has a certificate on file. Certificates from a previous employer are valid, confirm you have a copy, not just the worker's word. | Certificates held by workers but never collected or filed by the provider. |
| Worker screening clearances | Current clearance for every worker in a risk-assessed role. Track expiry dates, clearances are not indefinite under all state provisions. | Clearances that lapsed after the initial check and were never renewed. |
| Role-specific training records | Each worker's record shows training matched to their role and the people they support, with completion dates and the training provider or platform. | Generic induction records with no link to actual supports delivered. |
| High-intensity competency sign-offs | Where workers deliver high-intensity daily personal activities, records show competency assessed by an appropriately qualified health practitioner, before the worker started those supports. | eLearning certificates used in place of a required competency assessment. |
| First aid and CPR currency | Certificates current under HLTAID requirements for every worker in scope. Expiry dates tracked, not just stored. | First aid current but CPR component expired, these are different currency periods. |
| Condition-specific and risk-matched training | Where you support someone with specific needs (behaviours of concern, dysphagia, seizure risk, mental health conditions), the workers supporting them have training specific to those needs. | General disability awareness training standing in for condition-specific training, which will be visible when an auditor looks at who supports whom. |
| Behaviour support and restrictive practices | Where a behaviour support plan exists, workers involved in its implementation have training in it. Authorisation documentation is current and linked. | Workers who are named in a plan but have no training record attached to that plan. |
| Training rationale document | A written record of why your training program was designed as it was, linked to the people you support and the risks in your service. | No written rationale at all, which leaves you unable to answer "why this training?" from an auditor. |
| Refresh and currency tracking | A documented schedule for when each type of training is reviewed or refreshed, with a process for triggering a refresh when needs change, plans change, or a worker has a prolonged gap in delivery. | Refresh "handled as needed" with no documented schedule or trigger, which reads as no system to an auditor. |
| Incident-training linkage | Where incidents have occurred, your quality improvement records show whether they prompted a training response, and whether that response was completed. | Incidents logged and closed with no follow-through to check whether a training gap was a factor. |
The items auditors ask for first
Based on what providers report after certification audits, these are the four things auditors tend to ask for earliest in the process. Have them ready, in a folder you can open in under two minutes, and you start the audit on the right foot.
- A complete staff training register showing every worker, their role, training completed, completion dates, and next review date.
- Worker Orientation Module certificates for at least a sample of workers (sometimes all workers).
- Worker screening records for risk-assessed roles, with clearance numbers and dates.
- The training and induction section of your policies and procedures, specifically the part that explains how you determine what training a worker needs before they start.
If you can hand those four things over cleanly and quickly, you're demonstrating before a word is said that your system exists and is maintained. That impression carries weight through the rest of the audit.
The gap most providers don't see coming
You can have a full training register and still be caught short. If a worker's training record doesn't connect to the specific people they support, an auditor can reasonably ask: how do you know this worker was prepared for this person's needs? A register that shows course completion is only half the picture. The other half is showing your workforce is trained for the people actually on your books. That's the link most providers don't make explicit until an auditor asks for it.
Timing: when to start and what to do when
Twelve weeks out is the point where you want to be running a full audit of your training evidence, not six weeks, and definitely not two. Here's a rough cadence that works.
Twelve weeks out
Pull your complete staff training register and cross-reference it against your current support delivery. Find the gaps, particularly any workers who are delivering supports they don't yet have training evidence for. That work takes longer than you think, especially if your register lives in a spreadsheet and your rosters live somewhere else.
Eight weeks out
Gaps identified at twelve weeks should be closed or have a clear timeline by now. Expired certificates need to be renewals in progress, not renewals you intend to start. If someone's first aid has lapsed, you can't put that on audit week. Get the training scheduled.
Four weeks out
Organise your evidence folder. Auditors shouldn't have to dig. A clear folder structure with named sections for worker screening, the orientation module, role-specific training, and policy documents saves you time on the day and signals organisation.
One week out
Brief your key personnel on what auditors typically ask and where your evidence is stored. In a certification audit, workers get interviewed, and a worker who is surprised by that conversation is not a good look. You don't want workers rehearsing answers, but you do want them not blindsided.
The training problem hiding inside your compliance pass
Here's the honest view of all this: a provider can pass an NDIS audit on training and still have a workforce that isn't ready for the reality of the shift. Compliance asks whether training happened. It doesn't ask whether the training built the kind of judgement that keeps someone safe at 9pm when no one else is around and things are escalating.
Two workers can have identical training records, the same modules, the same completion dates, and one of them reads the situation in seconds while the other one doesn't. That gap never shows up in a training register. Auditors aren't checking for it, and honestly most training programs aren't building for it either.
The organisations that do this well treat the audit as confirming something that's already true, not as the event you prepare for. Your training program is genuinely matched to your people, genuinely building capability, and you can show where your workforce stands against the things that actually matter. That's a different thing from having a clean folder of certificates.
The Workforce Capability Report we built at CORA came out of exactly this problem. Providers kept coming to us with clean compliance records and a nagging sense that their team wasn't actually ready. The report turns training completion data into a picture of capability across the team, so you can see the gaps before an incident or an audit surfaces them for you.
See what your workforce capability report could look like
The CORA Workforce Capability Report maps your team's training completion against capability gaps and flags the risks before your next audit. See a sample report before you commit to anything.
See the Sample Report Browse the training libraryCommon questions
What training evidence do NDIS auditors actually look for?
Auditors want to see that training is linked to the supports your workers deliver and the people they support, not just that courses were completed. Expect requests for the Worker Orientation Module certificates, role-specific training records with dates and completion status, evidence of the rationale for the training you chose, and records that match each worker to the supports they actually provide.
What is the difference between a verification audit and a certification audit?
A verification audit applies to lower-risk supports and is primarily document-based. Auditors review policies, procedures, worker screening records, insurance, and key operational documents. A certification audit includes a site visit, staff interviews, and observation of service delivery. It covers both the Core Module and any relevant Supplementary Modules for the supports your registration includes.
How far in advance should I start NDIS audit preparation?
Start a systematic review of your training evidence at least 12 weeks before your scheduled audit date. That gives you time to find and close gaps, gather and organise evidence, and address non-conformances before the auditor arrives rather than under time pressure on the day.
Does completing training automatically mean we pass the audit?
No. Completing training proves it happened. Auditors also want to see that the training was appropriate for the supports delivered, that records are current and accessible, that workers can demonstrate the knowledge in practice, and that your provider has a system for identifying gaps and keeping training current. Evidence of a system matters as much as the training records themselves.
Sources and further reading
- The quality audit process, NDIS Quality and Safeguards Commission
- NDIS Practice Standards, NDIS Quality and Safeguards Commission
- Information for quality auditors, NDIS Quality and Safeguards Commission
- NDIS Code of Conduct, NDIS Quality and Safeguards Commission
This guide is general information for NDIS providers, not legal or compliance advice. Always check the current requirements directly with the NDIS Quality and Safeguards Commission, because the detail does change.
← Back to all guides