NDIS Human Resource Management: What to Hold

Scope

In short: this covers NDIS-PS-2.7 under the Core Module, and the Human Resource Management standard in the Verification Module. Not payroll, not rostering, not recruitment advertising, and not the state-based worker screening legislation itself, each of those sits outside the Practice Standards.

Applies to every registered NDIS provider for the Core Module standard, and to providers registered under the verification pathway for the five Verification Module indicators. If you landed here looking for software to run payroll, build a roster or post job ads, this isn't that, and CORA doesn't compete with that category. If you're trying to work out what an auditor expects against your own HR records, keep reading.

The two obligations

In short: one Core Module outcome standard that applies to every provider, and a set of five specific Verification Module indicators that apply to providers on the verification pathway. They ask different things and both sit inside the NDIS Practice Standards.

Human Resource Management shows up twice in the Practice Standards, and providers often only know about one of the two.

• NDIS-PS-2.7, Core Module, Provider Governance and Operational Management. An outcome standard: are your workers competent, qualified and experienced for the role they're in. Applies to every registered provider.
• The Verification Module's Human Resource Management standard, a set of five quality indicators specific to identity checks, pre-employment records, and refresher training in infection control and PPE. Applies where a provider is registered under the verification pathway.

For background on how the modules fit together, see the NDIS Practice Standards explained.

Core Module: the outcome

In short: NDIS-PS-2.7 is one sentence, and it's about competence, qualifications and experience matched to the role, not a checklist of courses.

The standard, word for word:

"Each participant's support needs are met by workers who are competent in relation to their role, hold relevant qualifications, and who have relevant expertise and experience to provide person-centred support."

NDIS Practice Standards, Core Module, Schedule 1 clause 15 of F2026C00527. Quality indicators at section 17 of the Quality Indicators instrument, F2026C00528.

It's an outcome, assessed against quality indicators, not a named list of eLearning modules a worker has to tick off. A provider demonstrates it through the records behind the claim: how a worker's skill was identified, how they were recruited and checked against it, and what evidence shows they're actually competent in the role they do, not just that they attended something related to it.

Verification Module: the indicators

In short: five quality indicators under section 74, specific and checkable. These are the four most providers trip on.

Where the Core Module standard is a single outcome, the Verification Module's Human Resource Management standard is broken into five discrete quality indicators under section 74 of F2026C00528, each one a specific record or training item. Four of them, word for word:

• Worker identity and pre-employment records. "Records of worker identity, right to work, pre-employment checks, qualifications and or experience are maintained." Quality indicator 1 of 5, section 74, Compilation No. 3 of F2026C00528, 1 July 2026.
• Infection prevention and control, including refreshers. "Each worker is trained, and has refresher training, in infection prevention and control standard precautions including hand hygiene practices, respiratory hygiene and cough etiquette." Quality indicator 3 of 5, section 74.
• PPE training, including refreshers. "Each worker who provides supports directly to participants is trained, and has refresher training, in the use of PPE." Quality indicator 4 of 5, section 74.
• PPE availability. "PPE is available to each worker, and each participant, who requires it." Quality indicator 5 of 5, section 74.

Note the word "refresher" appears twice. A one-off completion from years ago doesn't satisfy either of those two indicators on its own, a provider needs a record showing the refresher happened and when.

Records, not courses

In short: this is the whole argument. Most of what sits under NDIS Human Resource Management is evidence a provider holds, not a course a worker sits through. A training platform that only produces completion certificates cannot answer an HR question on its own.

Look back at the two standards above. None of them say "complete this module." They say hold a record of identity checks, hold a record of a refresher, demonstrate competence for the role. A learning platform can deliver the infection control and PPE training that two of the five Verification Module indicators ask for, and it can hold the completion date and the refresher date against each worker. But the identity and pre-employment record, the qualification file, and the Core Module's competence outcome are not training questions at all, they're HR records sitting on the worker's own file.

This is why a certificate alone has never been enough for an audit, a point covered in more detail in completion vs capability at an NDIS audit. Human Resource Management is the standard where that gap is most literal: the standard is named after the record, not the course.

Who makes the competence call

In short: the provider's own qualified assessor decides whether a worker is competent. A training platform, including CORA, supplies the instrument and holds the completed record. It never makes the determination.

NDIS-PS-2.7 asks for competence, and competence is a judgement, not a quiz result. A knowledge check inside a course can show a worker understood the content. It cannot show a provider's supervisor watched them do the job and signed off that they can. Those are different claims, and conflating them is one of the more common ways providers overstate their own readiness.

The way this actually gets evidenced is through practical sign-off, supervision and practice observation, records of a worker's practice being watched and assessed by someone qualified to judge it, held against the worker's file over time. A platform can supply the structure for that: the sign-off form, the supervision register, the observation record, the date and the assessor's name. What it cannot do, and should never claim to do, is make the determination itself. The provider's qualified assessor makes that call. The platform holds the completed record.

For what a supervision record actually needs to show, see supervision records for NDIS providers. For what CORA claims about this and doesn't, checked line by line, see what CORA claims, and how to check it.

The worker file

In short: one file per worker holding identity and right to work, pre-employment checks, qualifications and experience, not four systems a quality manager reconciles before an audit.

Quality indicator 1 of the Verification Module's HR standard asks for records of identity, right to work, pre-employment checks, qualifications and experience, maintained. In practice that means a worker file holding:

• Proof of identity and right to work in Australia
• Pre-employment checks relevant to the role, including the NDIS Worker Screening clearance where the role is risk-assessed
• Qualifications and prior experience relevant to the position
• A date confirming when the file was last reviewed, so the record doesn't quietly go stale

What trips providers up is a record held across a filing cabinet, a shared drive and somebody's memory of a phone call. An auditor is checking that the record exists and is current per worker, not asking you to describe your general process for the first time on the day. See NDIS credential tracking for how the expiry side of this file holds up over time.

Refresher training

In short: infection control and PPE training both need a refresher record, not just an initial completion. That means two dates per worker, not one.

Quality indicators 3 and 4 both use the word "refresher" deliberately. A record that shows a worker completed infection control training in their first week and never again does not satisfy either indicator on its own. What the standard is asking for:

• The date of the original training
• The date of the refresher, and evidence the refresher actually happened
• A cadence for when the next refresher is due, so it doesn't rely on someone remembering
• For PPE, a separate record that PPE is actually available to workers and to the people they support, not only that training on using it occurred

A training register that stores a single completion date per course will quietly fail this one, because it has nowhere to put the second date. This is the same structural gap covered in worker screening, first aid and expiry dates, applied to infection control and PPE specifically.

Common gaps

In short: the same handful of gaps show up repeatedly, and almost none of them are about a provider choosing the wrong training.

• Pre-employment records held by the worker, not the provider. The worker has the certificate or the clearance. The provider never actually collected and filed a copy.
• One date stored where two are needed. A refresher requirement treated as a one-off completion, with no record of when or whether it happened again.
• A knowledge check standing in for a competence sign-off. A course completion treated as evidence the worker is competent on the job, when NDIS-PS-2.7 is asking for a judgement a qualified assessor made, not a quiz result.
• PPE availability assumed, not recorded. PPE exists in the cupboard, but nothing shows a provider checked and recorded that it's actually available to the workers and the people who need it.
• The HR record and the training record living apart. Identity checks in one system, course completions in another, supervision notes in a third, so nothing can be produced per worker without a week of chasing.

Getting the records in order

In short: work from the worker outward. One file per worker, with identity checks, qualifications, training completions, refresher dates and sign-offs attached, rather than one system per record type.

The providers who handle this well don't run a better spreadsheet, they stop treating Human Resource Management as four separate record types and start treating it as one file per worker that different teams update. The training register holds completions and refreshers. The credential register holds identity, screening and qualification evidence with expiry dates. The supervision register holds sign-off and observation. None of it needs to be a single piece of software, but it does need to sit against the same worker, with the same name, so a quality manager can answer "show me this worker's HR record" without opening four tabs.

If training was assigned because of a complaint, an incident or an identified risk rather than as routine induction, that reason is worth keeping on record too. See training triggers: why a course was assigned for what that record looks like and why auditors increasingly ask for it.

Sources and further reading

• National Disability Insurance Scheme (Provider Registration and Practice Standards) Rules 2018, compilation F2026C00527, Federal Register of Legislation
• National Disability Insurance Scheme (Quality Indicators for NDIS Practice Standards) Guidelines 2018, compilation F2026C00528, Federal Register of Legislation
• NDIS Practice Standards, NDIS Quality and Safeguards Commission
• The quality audit process, NDIS Quality and Safeguards Commission
• The NDIS Practice Standards explained, CORA
• Completion vs capability: what an NDIS audit looks for, CORA
• NDIS credential tracking: worker screening, first aid and expiry dates, CORA
• NDIS training register: what it must contain, CORA
• Supervision records for NDIS providers, CORA
• Training triggers: why a course was assigned, CORA
• What CORA claims, and how to check it, CORA

This guide is general information for NDIS providers, not legal or compliance advice. Always check the current requirements directly with the NDIS Quality and Safeguards Commission or the Federal Register of Legislation, because compilations are amended and the detail does change.