The question new NDIS providers ask more than any other is some version of: what training do we actually have to do? People expect a tidy checklist handed down from the Commission. There isn't one, not really, and the gap between what's strictly mandatory and what you genuinely need is where most services come unstuck without ever clocking it.
So let's be honest about what's required, what's expected, and what actually keeps people safe. Those are three different things.
The short, honest version
In short: there is exactly one training module the NDIS Commission mandates for every registered provider, the NDIS Worker Orientation Module. Everything else described as "mandatory" is either a precondition that isn't training, like the worker screening check, or something the Practice Standards expect you to decide for yourself based on who you support.
There is exactly one training module the NDIS Quality and Safeguards Commission mandates for every registered provider: the NDIS Worker Orientation Module. That's it. Everything else you've heard described as "mandatory" is either a precondition that isn't training (like the worker screening check), or it's something the Practice Standards expect you to decide on yourself based on who you support.
That surprises people, and then it worries them, because "you decide" is a lot harder to evidence at audit than "we did the required course." Fair. Let's go through it properly.
What's actually mandatory: the Worker Orientation Module
In short: the one mandatory module is Quality, Safety and You, a free 90-minute course covering the Code of Conduct and the rights of the people you support. It applies to your whole workforce, the certificate doesn't expire and it transfers between providers. Treat it as the start line, not the finish.
The module is called Quality, Safety and You. It's a free, interactive online course built by the NDIS Commission and presented by people with disability, and it takes about 90 minutes. It walks workers through the NDIS Code of Conduct, the rights of the people you support, and what's expected of a worker day to day.
A few things worth knowing that save you grief later:
- It applies to your whole workforce, not just frontline support workers. Key personnel, managers, admin staff and volunteers who interact with the people you support are all in scope.
- The completion certificate doesn't expire, and it's transferable. If a worker did it at their last provider, they don't have to do it again, though you'll want a copy of the certificate on file.
- It's foundational, which is the polite way of saying it's a floor. It tells a worker what the Code of Conduct is. It does not tell them how to read a person who's escalating, or what to do when a shift goes sideways at 9pm with no one else in the house.
Do it, log it, keep the certificates somewhere you can produce them in thirty seconds. Then treat it as the start line, not the finish.
The other "must" that isn't training
Every worker in a risk-assessed role needs a valid NDIS Worker Screening Check before they start delivering support. It's not a course, so it won't show up in your LMS, but auditors absolutely check it, and a clearance gap is one of the easiest non-conformances to avoid. Track expiry dates the same way you'd track a first aid certificate.
What the Practice Standards actually expect (this is the bit people miss)
In short: the Practice Standards don't hand you a syllabus. They set quality indicators and expect you to determine the training that equips your workforce to meet them for the specific people you support. Your obligation isn't to complete a named list, it's to make a defensible judgement and be able to show it.
Here's where providers get caught. The NDIS Practice Standards don't hand you a syllabus. They set quality indicators, and they expect you to determine the training that equips your workforce to meet them for the specific people you support. Your obligation isn't to complete a named list. It's to make a judgement, and then be able to defend it.
An auditor isn't going to ask "did you do course X." They're going to ask something more like: you support someone with complex communication needs and a history of choking, so where's the evidence your workers were trained for that before they walked in the door? If your answer is the orientation module and a shrug, that's a problem, and it's a problem you created by treating "mandatory" as the whole job.
So the practical translation of the Practice Standards is roughly this:
| What the Standards expect | What that means for your training |
|---|---|
| Workers are competent for the supports they deliver | Map training to the actual needs of the people each worker supports, not a generic induction for everyone |
| Risks are identified and managed | Train for the specific risks in your service (choking, seizures, behaviours of concern, medication) |
| Rights, dignity and safeguarding are upheld | Code of Conduct, safeguarding, and condition-specific understanding so workers know why, not just what |
| You can demonstrate all of the above | Records that link a worker, the training, the date, and the support they deliver |
That last row is the one that gets ticked off at audit and forgotten the rest of the year. If you can't show it on demand, it may as well not have happened.
High-intensity supports: the real obligation
In short: where you deliver high-intensity daily personal activities, the training is competency-based, delivered and overseen by an appropriately qualified health practitioner, completed before the worker provides the support, and refreshed when needs change, after a three-month gap, and at least annually. An online course cannot sign a worker off as competent for these tasks.
If you deliver high-intensity daily personal activities, the rules get specific, and rightly so. The NDIS high intensity support skills descriptors set out the skills and knowledge a worker needs for things like complex bowel care, enteral feeding, tracheostomy management, and severe dysphagia support.
The approach is competency-based, and there are a few non-negotiables in how that training has to happen:
- It's delivered and overseen by an appropriately qualified health practitioner, matched to the support and to the worker's experience.
- It happens before the worker provides the support, not after they've been thrown in.
- It's refreshed when the person's plan or risks change, when a worker hasn't delivered that support for three or more months, and the Commission recommends an annual competency check on top.
Here is the unpopular thing, stated plainly, because it's the thing CORA exists around: an online course cannot sign a worker off as competent to manage a tracheostomy. eLearning is brilliant for knowledge, judgement and decision-making, the stuff you can genuinely build at scale, on a phone, between shifts. It is not a substitute for supervised, hands-on practicum for high-intensity clinical tasks. Anyone selling you otherwise is selling you a non-conformance.
The training your workers actually need (by role and by who they support)
In short: beyond the one mandatory module, most of what a good provider trains is driven by role and cohort, not legislation: first aid and CPR, manual handling, medication, infection control, positive behaviour support, and condition-specific understanding. You don't train every worker on everything, you assign the right training to the right worker for the people they support.
Beyond the one mandatory module, most of what a good provider trains is driven by role and cohort rather than legislation. None of the following is a blanket legal requirement for every worker, but if your service touches these areas and your training doesn't, an auditor will notice, and so will the next incident.
- First aid and CPR, currency periods apply, and almost every direct-support role needs it.
- Manual handling, for any service involving transfers, hoists or mobility support.
- Medication administration, where workers assist with or administer medication.
- Infection prevention and control, right-sized for community and home settings, not a hospital ward.
- Positive behaviour support and restrictive practices, anywhere behaviours of concern are part of the picture, with proper authorisation and reporting.
- Condition-specific understanding, autism, intellectual disability, mental health, acquired brain injury, dementia. This is the stuff that decides whether a shift goes well or goes wrong, and it's the most under-trained area in the whole sector.
You don't train every worker on everything, and you shouldn't. A worker supporting one person with autism doesn't need the full behaviour-support suite, and a community-access worker doesn't need enteral feeding. The skill is assigning the right training to the right worker for the people they actually support. (If you want a quick way to map that, our Free tools does it free, no sign-up.)
How often should you refresh it?
In short: there's no single legislated interval for most training, so refresh cadence should follow risk, not the calendar. High-intensity competencies get reassessed at least annually and whenever needs change, first aid and CPR follow their own currency rules, and compliance and condition-specific training refresh whenever a plan, a risk, or the guidance changes.
There's no single legislated interval for most training, which trips people up. The honest answer is that refresh cadence should follow risk, not the calendar. High-intensity competencies get reassessed at least annually and whenever needs change. First aid and CPR follow their own currency rules. Compliance and condition-specific training should be refreshed whenever a plan changes, a risk changes, or the guidance itself changes, and the sector moves more than people expect. Build a simple cycle, write down why you chose it, and you've answered the question before an auditor asks it.
Compliance is the floor. Capability is the job.
In short: completing the mandatory training proves you met the minimum. It does not prove your workforce is any good. Two workers can have identical records and one reads a room in four seconds while the other doesn't yet. That difference never shows up on a compliance report, and it's the difference that keeps people safe.
If you take one thing from all of this: completing the mandatory training proves you met the minimum. It does not prove your workforce is any good. Two workers can have identical records, the same module, the same screening, the same certificates, and one of them reads a room in four seconds while the other one doesn't yet. That difference never shows up on a compliance report, and it's the difference that keeps people safe.
The good news, and the reason CORA exists, is that the soft stuff isn't unteachable magic you have to hope you hired. Reading a person, staying calm when things escalate, knowing why a strategy works and not just that it exists, that's all trainable. It just has to be built into training that teaches it, and paired with a way to show where a workforce stands. CORA's Workforce Capability Report exists for exactly that second part, turning completion data into a picture of capability you can put in front of a board or an auditor. For the full picture of that distinction, see the guide to a compliant workforce versus a capable one, and for this same requirements map broken down by role and cohort, read what training NDIS support workers need.
See the right training for your team in two minutes
Tell the Pathway Builder who your workers support, and it maps the courses they actually need from CORA's NDIS-aligned library. Free, no sign-up.
Try the Pathway Builder Browse the libraryFrequently asked questions about NDIS staff training requirements
Is the NDIS Worker Orientation Module mandatory?
Yes. Quality, Safety and You is the one training module the NDIS Commission requires for workers and key personnel of registered providers. It's free, takes about 90 minutes, and the certificate doesn't expire and moves with the worker between providers.
What training do the NDIS Practice Standards require?
They don't give you a fixed course list. They set quality indicators, and each provider decides what training equips its workforce to meet them for the people it supports. At audit you show the training you chose, why you chose it, and that workers completed it.
What training is required for high-intensity supports?
Where you deliver high-intensity daily personal activities, workers need the skills in the high intensity support skills descriptors. That training is competency-based, led by an appropriately qualified health practitioner, done before the worker provides the support, and refreshed when needs change, after a three-month-plus gap, and at least annually.
How often does NDIS staff training need refreshing?
There's no single legislated interval for most training, but auditors expect a sensible cycle. High-intensity competencies get reassessed at least annually and when needs change. First aid and CPR follow their own currency periods. Compliance and condition-specific training refresh whenever a plan, a risk, or the guidance changes.
Do NDIS support workers need a Certificate III to work?
Not as a blanket legal requirement. The NDIS Commission mandates the Worker Orientation Module and a Worker Screening Check for risk-assessed roles, not a specific qualification for every worker. A provider decides, under the Practice Standards, what training and qualifications equip each worker for the supports they deliver, and some funded supports or state rules may require particular qualifications.
Is first aid training mandatory for every NDIS worker?
There's no single NDIS rule making first aid mandatory for every worker, but almost every direct-support role needs current first aid and CPR in practice, and first aid follows its own currency periods. Whether it's required comes down to the role and the risks in your service, which is the judgement the Practice Standards expect you to make and document.
Does the NDIS Worker Screening Check count as training?
No. The Worker Screening Check is a background check for risk-assessed roles, not a training course, so it won't appear in your LMS. Auditors do check it, and a clearance gap is one of the most avoidable non-conformances there is. Track expiry dates the way you would a first aid certificate.
How do I show my NDIS training program to an auditor?
Keep records that link each worker to the training they completed, the date, and the supports they deliver, plus the reasoning for what you chose. Under Human Resource Management an auditor also wants evidence workers can apply what they learned, not just that they attended, which is where a capability measure adds to your completion records.
How long is a first aid certificate valid for NDIS workers?
The nationally recognised unit HLTAID011 Provide First Aid is treated as current for three years. The CPR component, HLTAID009, is refreshed every twelve months in line with Australian Resuscitation Council guidance and Safe Work Australia's recommendation. That twelve month cycle is the one providers most often miss, because the three year date is the one people remember. Note this is the accepted industry currency standard rather than an NDIS rule: the NDIS Commission does not itself set the renewal period, your own risk assessment and WHS obligations do. Track both dates separately.
What training does a worker need before their first shift with NDIS participants?
Three things, in practice. A current NDIS Worker Screening clearance if the role is risk-assessed, which registered providers must have in place before engaging the worker. The free NDIS Worker Orientation Module, "Quality, Safety and You", which takes about ninety minutes, does not expire, and follows the worker between employers. And your own induction, covering your policies, the participants they will support and the specific supports they will deliver. Anything beyond that is set by your own assessment of the role and its risk.
Do volunteers need an NDIS Worker Screening Check?
Yes, if the volunteer is in a risk-assessed role or is key personnel. Screening attaches to the role and its risk, not to whether the person is paid, so volunteers sit in the same category as employees, contractors and students. The clearance is free for genuine volunteers in some states and territories and reduced in others. Providers should document which of their roles are classified as risk-assessed and why, because that record is what an auditor examines when deciding whether the right people were screened.
Sources and further reading
- NDIS Code of Conduct, NDIS Quality and Safeguards Commission
- NDIS Practice Standards, NDIS Quality and Safeguards Commission
- High intensity daily personal activities, supplementary module and skills descriptors
- What training do NDIS support workers need?, CORA, the same requirements mapped by role and cohort
- What a capable NDIS workforce actually looks like, CORA, the workforce capability guide this sits under
- NDIS credential tracking: worker screening, first aid and expiry dates, CORA, how to hold the records these requirements generate
This guide is general information for NDIS providers, not legal or compliance advice. Always check the current requirements directly with the NDIS Quality and Safeguards Commission, because the detail does change.
← Back to all guides