Most conversations about NDIS training software are about courses. Which library, how many modules, whether workers will actually finish them. Underneath that sits a quieter job that gets far less attention and causes at least as much trouble: holding a current, named record of every clearance, certificate and ticket a worker needs, and knowing which ones are about to run out.
It is not interesting work. It is also the thing that turns a routine audit into an awkward one, because a lapsed clearance is not a matter of interpretation. It either has a date in the future or it does not.
What credential tracking actually means
In short: credential tracking is holding a current record of every clearance, certificate, ticket and piece of external training a worker needs for their role, each with an expiry date, and being told which ones are about to lapse before they do. It is a different job from tracking course completions, and most systems only do one of the two.
Completion tracking answers one question: did this worker finish the training we assigned them. Credential tracking answers a different one: do we still hold valid evidence for the things we did not deliver ourselves.
That second category is bigger than most providers expect. A worker screening clearance comes from a state screening unit. A first aid certificate comes from an RTO. A driver's licence comes from a transport authority. A medication administration sign-off comes from a qualified health practitioner. None of it is generated by your training system, all of it expires, and all of it is evidence you are expected to hold.
The two records answer to different clocks and different owners, which is exactly why they drift apart. This sits alongside the broader question of what NDIS staff training requirements actually cover, and the two are easiest to manage when they live in the same place.
Which credentials a provider has to hold
In short: worker screening, first aid and CPR, driver's licences where workers transport participants, site tickets, and any in-person or external training you did not deliver. The trap is that several of these renew on different intervals, so a worker can look compliant on one line and be lapsed on another.
NDIS Worker Screening Check. Required for workers in risk-assessed roles at a registered provider. The Commission defines a risk-assessed role as one involving direct delivery of supports, more than incidental contact with participants as a normal part of the role, or building rapport with participants as normal duties. A clearance is valid for five years from issue and is portable across states and territories. It is also subject to ongoing monitoring rather than being a one-off snapshot, so it can be revoked inside the five years. Five years is long enough that nobody remembers the date, which is precisely the problem.
First aid and CPR. These run on two clocks. HLTAID011 Provide First Aid is commonly renewed every three years, and HLTAID009 CPR every twelve months, in line with Australian Resuscitation Council guidance and most workplace policy rather than a rule written into the Practice Standards. A worker can hold a current first aid certificate and a lapsed CPR component at the same time. A register that stores one date per worker will miss it every time.
Driver's licences and vehicle records where workers transport participants, along with any site tickets or cards a particular service requires.
In-person and external training you did not deliver. Manual handling practical assessments, an RTO unit, epilepsy or enteral feeding training, and sign-offs from a qualified health practitioner for higher-risk supports. This category is the one most likely to be sitting in somebody's inbox rather than in a system. It is also the category an auditor is most likely to ask about, because it is where the higher-risk supports live.
Why the spreadsheet fails
In short: a spreadsheet is a snapshot. It is accurate on the day someone updates it and drifts every day after. It also separates the record from the evidence, so at audit you are matching a row in a file against a certificate saved somewhere else.
Nearly every provider starts with a spreadsheet, and it works for a while. It stops working for three reasons, usually all at once.
It has no owner, or it has one. Either nobody is responsible for keeping it current, or one person is, and the whole thing depends on them remembering. Neither is a system.
It is passive. A spreadsheet never tells you anything. You have to go and ask it, which means someone has to remember to look, which means the thing that catches a lapse is a person's memory rather than a process.
The record and the evidence live apart. The date sits in a cell and the actual certificate sits in an email, a shared drive or a filing cabinet. At audit you need both, attached to a named worker, and reuniting them under time pressure is where the week before an audit disappears. The same pattern shows up across training records generally, which is the ground covered in the NDIS audit preparation checklist.
How expiry warning windows should work
In short: the warning has to arrive with enough runway to actually renew the thing. Roughly 90 days for anything with an application process, 30 to 60 days for a course you can book, 7 to 14 days as a last call. A reminder that lands on the expiry date has already failed.
A single alert on the day a credential expires is not a reminder, it is a notification of a problem you now have. Useful warning windows are matched to how long the renewal actually takes.
- 90 days for anything involving an application to an external body. A worker screening renewal is the obvious one, and it is not something you can turn around in a fortnight.
- 30 to 60 days for a course you can book, such as first aid or CPR. Long enough to find a session that fits around a roster.
- 7 to 14 days as a last call, not a first one. This is the safety net under the other two.
The other half of it is cadence. One-off alerts get missed in a busy inbox. A standing weekly summary of what is coming up turns credential renewal from an interruption into a routine somebody runs on the same morning each week, which is the version that actually holds.
What an auditor asks to see
In short: named records, current on the day, with the evidence attached to the worker it belongs to. Vague assurance is not the currency here, specific and checkable is.
The useful test is whether you could produce, without notice, a register showing every worker, the credentials each of them holds, the expiry status of each one, and the certificate or evidence file itself. If producing that takes a week of chasing, the record is not really a record.
Worth being plain about the boundary: what your audit outcome looks like depends on your whole quality system, not on credential records alone. Anybody promising otherwise is selling something. What good records do is remove a category of easily avoidable findings, and let you spend the audit talking about the harder questions instead.
What a credential register does not do
In short: a register holds and tracks the evidence. It does not verify that the evidence is genuine, and it does not replace observed assessment where that applies.
| What a credential register does | What it does not do |
|---|---|
| Holds the certificate or evidence file against the named worker it belongs to | Confirm the certificate is authentic, which stays with you and the issuing body |
| Records an expiry date for every credential and bands what is coming up | Renew anything on your behalf, or apply to a screening unit for you |
| Tells the right people, on a schedule you set, before something lapses | Replace a manager deciding whether a worker should be on shift |
| Exports the whole picture as a named record you can hand over | Guarantee an audit outcome, which rests on your whole quality system |
| Sits alongside your own observation and sign-off | Sign a worker off as competent on the job, which is your assessor's call |
On that last row, keep the scope honest in both directions. Observed assessment applies to complex and higher-risk supports, and where it applies a qualified assessor watches the work and signs it off. It does not apply to every course a worker completes, and implying it does overstates what any provider is expected to do.
How CORA handles it
In short: the credential and evidence register is included on every CORA plan. It holds screening, first aid and CPR, licences, tickets and records of in-person or external training, each with the evidence file attached, an expiry date, a warning window you set between 7 and 90 days, and a weekly digest telling your admins what is due.
CORA's credential and evidence register holds NDIS worker screening, first aid and CPR, driver's licences, tickets, and records of in-person or external training, with the certificate or evidence file attached to the worker it belongs to.
Every credential carries an expiry date, and the register bands what is coming up so nothing lapses unseen. You set the warning window that suits your organisation, choosing from 7, 14, 30, 60 and 90 days, and a weekly digest tells your admins what is due. You can upload one credential at a time, per worker, for a group, or in bulk by CSV, and export the whole register as CSV whenever you need it.
The register is one of four named records CORA produces for audit, alongside a training register by name, a completion summary with timestamps, and completion certificates carrying the worker's name, the course, the date, the knowledge check result and the mapped NDIS Practice Standards. All of it exports as PDF or CSV. Naming them is deliberate. It is easy to say a platform makes you ready for an audit and hard to check, whereas a list of exactly what you get is something you can hold up against what your auditor actually asks for.
All of that is included on both plans, along with course delivery, role and site pathways, per-course due dates, and automatic due, overdue and renewal reminders. It is worth saying plainly why: none of it is the differentiator. Chasing admin is the minimum a system should do. The part CORA adds on top, on the Capability plan, is the Workforce Capability Report, which shows whether the training your workers finished actually landed, worker by worker and team by team. That is a different question from whether their paperwork is current, and a provider should not have to choose which one to solve.
See the register and the records
If credential expiry is currently living in a spreadsheet, the fastest way to see the difference is to look at the register and the exportable records side by side with what your auditor asks for.
See how it works Request a demoFrequently asked questions about NDIS credential and expiry tracking
How long is an NDIS Worker Screening Check valid for?
Five years from the date it is issued, unless it is revoked during that time. The clearance is portable across all Australian states and territories, and it is subject to ongoing monitoring for the full five years rather than being a one-off snapshot. A provider still needs a record of the clearance and its expiry date for every worker in a risk-assessed role.
How often does first aid need renewing for support workers?
In practice these run on two separate clocks. HLTAID011 Provide First Aid is commonly renewed every three years and HLTAID009 CPR every twelve months, in line with Australian Resuscitation Council guidance and most workplace policy rather than a rule written into the NDIS Practice Standards. Because the two intervals differ, a worker can hold a current first aid certificate and a lapsed CPR component at the same time, which is where a lot of registers go wrong.
What is the difference between training completion tracking and credential tracking?
Completion tracking answers whether a worker finished the training you assigned. Credential tracking answers whether you still hold valid evidence for the things you did not deliver yourself, such as a worker screening clearance, a first aid certificate from an RTO, a driver's licence or an external sign-off. They are different records answering different questions, and a provider needs both.
How far ahead should an expiry reminder be sent?
It depends on how long the renewal takes. Anything with an application process, such as a worker screening clearance, needs the longest runway, so a 90 day warning is sensible. A course you can book, like first aid, usually needs 30 to 60 days. A 7 or 14 day warning works as a last call rather than a first one. A reminder that arrives on the expiry date has already failed.
What credential records does an NDIS auditor ask to see?
Named records, current on the day, with the evidence attached to the worker it belongs to. That typically means a register showing every worker, the credentials they hold, the expiry status of each, and the certificate or evidence file itself. What an audit outcome looks like depends on a provider's whole quality system, not on credential records alone.
Does CORA verify that a credential is genuine?
No. CORA records and tracks the evidence you hold. It doesn't assess or verify the credential itself, that stays with you and the issuing body. What CORA does is make sure the record is complete, attached to the right worker, and that nothing lapses without somebody being told.
Can CORA track training a provider delivered in person?
Yes. The register holds records of in-person and external training alongside clearances and tickets, with the evidence file attached and an expiry date if the training has one. That means a toolbox talk, an RTO unit or a practical assessment run by your own team sits in the same register as the online courses, rather than in a separate folder.
Is credential tracking included on every CORA plan?
Yes. The credential and evidence register is part of the compliance baseline included on both Foundations and Capability, along with course delivery, pathways, due dates and automatic reminders. The Workforce Capability Report is the part that sits on the Capability plan.
Sources and further reading
- NDIS Worker Screening, NDIS Quality and Safeguards Commission
- NDIS Practice Standards, NDIS Quality and Safeguards Commission
- Australian Resuscitation Council guidelines, the basis for the twelve-month CPR refresh convention
- NDIS staff training requirements: the 2026 provider's guide, CORA
- NDIS audit preparation: a training checklist for quality managers, CORA
- How to prove workforce capability at an NDIS audit, CORA
- Common questions from providers, CORA