NDIS Audit Evidence Checklist: Every Requirement, Named

This page is that answer. Every requirement below is the NDIS Quality and Safeguards Commission's own wording, not a paraphrase. Under each one sits the artefact that satisfies it, and where CORA already holds it. Requirements still open sit first, not buried, because a checklist that shows you what's open is more useful than one that shows you a score.

Your CRM already runs the participant side of your service. This page is the workforce side: the records about the people who deliver support, not the people who receive it.

Do I need a Verification or Certification audit?

The Commission puts providers into one of two audit types depending on what they're registered to deliver.

Verification covers lower-risk registration groups. Your auditor works from your worker files and training records, and 14 requirements sit inside it.

Certification covers higher-risk registration groups, including personal care and supported independent living. It asks for everything Verification does, plus position descriptions, performance reviews, an emergency capability list and a workforce disruption plan, and 21 requirements sit inside it. If you're moving into the new SIL registration category, see New SIL Practice Standards: what changed on 1 July 2026 for what that module adds on top of this list.

No percentage, on purpose. A score invites reading it as progress toward passing, and that isn't a claim either of us can make honestly. Three counts, adding to a total, is what's actually true.

What's still open

Workers have the skills and knowledge to deliver the supports they are assigned.

Status: Partial. Support Observation gives you an observed record, on a phone, signed by a named observer, dated, and captured at the point of practice rather than reconstructed from memory afterwards. It's the same shape as the Standard's competency assessment: an observed record rather than a self-report. The fuller artefact also expects the observer's own competence to assess recorded alongside it, and a date set for reassessment.

Status: Not yet held. The credential register already holds who has what, when it was issued and when it's next due, and chases renewals before they lapse. A parallel register, scoped to competency assessments rather than credentials, who's been assessed in what and when they're next due, is the specific artefact this line names.

The worker file

Records of worker pre-employment checks, qualifications and experience are maintained.

Four artefacts satisfy this, all held: proof of identity; proof of the right to work in Australia; the NDIS Worker Screening Check clearance, held in Credentials with its own expiry tracked; and qualifications and experience for the role. See tracking screening renewals across your team for how the clearances due through 2026 and 2027 get held and chased.

Every upload sits in a private vault. Every download is logged, and the log itself only ever grows, nothing in it can be edited or removed.

An orientation and induction process is completed by workers, including the mandatory NDIS worker orientation program.

Two artefacts, both held: the Commission's own module certificate, and your own signed and dated induction record naming what was covered and who delivered it, signed by both the worker and the person who inducted them. CORA holds the Commission's orientation certificate alongside your own induction record, so both live on the one worker file rather than two systems.

An orientation and induction process is completed by workers.

Buddy shift records: who the worker shadowed, on what date, and who decided they were ready. Held, on the worker's own record, each signature an authenticated press rather than a typed name.

Training

A system to identify, plan, facilitate, record and evaluate training and education, which identifies mandatory training and covers obligations under the Practice Standards and the NDIS rules.

Two artefacts satisfy this: a professional development record, a dated list of training completed, and a training plan or matrix with attendance records and evidence that the training worked. Both held, and both covered in detail on the training register and the training plan and matrix.

Four of those five verbs describe a certificate. The fifth doesn't, and it's worth reading properly: see evaluating the effectiveness of training.

Infection prevention and control training, including refresher training, is undertaken by all workers involved in providing supports.

Two artefacts, both held: training records showing the initial training and the date of the most recent refresher, and the same again for PPE specifically. Infection Control & Hygiene carries its own refresher date on completion, so the date lives with the certificate rather than a separate spreadsheet.

Personal protective equipment is available to workers and participants.

Evidence PPE is actually available. Photographs of your supplies generally suffice, filed with your organisation's documents. Held.

What Certification adds

Everything above applies whichever audit you're facing. Certification adds seven more, all held.

Skills, knowledge, responsibilities, scope and limitations of each position are identified and documented. A position description for every role, including the ones directors hold, filed against the role rather than the person, so the register answers the question the indicator actually asks: does every role have one.

Timely supervision, support and resources are available, relevant to the scope and complexity of supports delivered. A supervision schedule, and records that supervision occurred, measured against the schedule you set.

Worker performance is managed, developed and documented, including feedback and development opportunities. Completed performance reviews on a regular cycle, each carrying an agreed development plan and a next-review date.

Workers with capabilities relevant to responding to an emergency or disaster are identified. A document naming people against capabilities, first aid, contingency planning, infection control, assembled from records CORA already holds so it can't drift out of date with the register it comes from. Emergency, Disaster & Incident Response is one of the courses that feeds it.

Plans are in place to identify, source and induct a workforce if workforce disruption occurs in an emergency or disaster. Named arrangements for where extra workers would come from and how they get screened and inducted quickly, filed with your organisation's documents.

Worker contact details are recorded and kept up to date. A worker register that gets regularly reviewed, with a date recording when someone last confirmed it.

Details of worker secondary employment, if any, are recorded and kept up to date. The same register, with the question asked again on a cycle, distinguishing nobody's asked yet from declared none from declared some, three different facts an auditor reads differently.

Every claim on this page is written the same way: about a named artefact, checkable in a demo. See the standard we hold every claim on the site to.

How providers actually use this list

Print it before a mock audit and hand it to whoever's running one. Give it to a new quality manager in their first week, it's a faster education than the Standard's own document. Or work down it category by category, worker file, then training, then the Certification extras, closing what's open in the order an auditor is actually likely to ask.

Build a free pathway around the people you support, or look at a live sample of the Workforce Capability Report.