NDIS Practice Standards: Documentation Obligations for Registered Providers

The NDIS Practice Standards framework

The NDIS Practice Standards are the compliance benchmark against which the NDIS Quality and Safeguards Commission (the Commission) assesses registered NDIS providers. They are established under the National Disability Insurance Scheme Act 2013 (Cth) and the NDIS (Provider Registration and Practice Standards) Rules 2018. All registered providers must comply with the four core Practice Standards. Depending on registration group, supplementary standards also apply — these cover specialist supports including behaviour support, early childhood supports, and specialist disability accommodation.

The Commission assesses compliance through two principal audit mechanisms. Certification audits occur on a three-yearly cycle and cover all four core Practice Standards. They are conducted by Commission-approved quality auditors and involve document review, staff interviews, and participant consultations. Verification audits occur more frequently — annually or bi-annually depending on registration group — and focus principally on Standard 2 governance obligations. They are designed for lower-risk registration groups and assess whether the provider has the operational systems the Standards require, rather than conducting the full assessment of a certification audit.

Unregistered providers are not subject to the Practice Standards. However, the NDIS Code of Conduct applies to all NDIS providers and their workers — registered and unregistered — and is separately enforceable by the Commission. This distinction matters for documentation: unregistered providers have no Practice Standards audit obligation but remain subject to Code of Conduct obligations, and the Commission can investigate complaints and take action against unregistered providers and individual workers under the Code.

Documentation is not incidental to the Practice Standards — it is the evidence base against which the Standards are assessed. A provider that delivers good supports but maintains inadequate records cannot demonstrate compliance. The Commission does not audit intentions or policies in isolation; it audits records.

Standard 1: Rights and Responsibilities

Standard 1 requires that registered providers support participants to understand and exercise their rights, including their right to make decisions about their own life and supports. The documentation obligation flows directly from this: it is not sufficient for a provider to assert in a policy document that it supports participant rights. The records must demonstrate that the assertion is true in practice, for each participant, across time.

Consent is a core documentary obligation under Standard 1. Consent records must be current — they must be updated when a participant's circumstances, capacity, or preferences change. A consent form completed at intake and never reviewed does not satisfy the Standard if the participant's situation has materially changed. Auditors will examine consent records against the timeline of service delivery and look for evidence of ongoing consent processes rather than a single transaction.

Goal records under Standard 1 must be traceable to the participant's NDIS plan. If a participant's plan identifies specific goals — increased community participation, development of independent living skills — the provider's records must show that those goals are understood, documented in the individual support plan, and reflected in the supports actually delivered. A goal listed in the support plan but absent from shift records and progress notes suggests the goal is aspirational rather than operational.

Supported decision-making must be evidenced in the record, not merely asserted in policy. This means that where a participant has made a decision about their supports — about activities, routines, care approaches, or how services are delivered — that decision and its context should appear in the record. Shift notes that record only task completion, without any reference to the participant's expressed preferences or choices, do not satisfy this element of Standard 1. The record should reflect the participant as an active subject of their supports, not a passive recipient.

Access to complaints processes must also be documented — specifically, that the participant has been informed of and understands the complaints process, including the right to complain to the Commission directly. This is typically evidenced through intake records and periodic review documentation.

Standard 2: Governance and Operational Management

Standard 2 is the governance standard, and it is the standard most directly assessed in verification audits. It requires that the provider has adequate systems and processes to govern its operations, manage risk, respond to incidents and complaints, and maintain the quality of its services. The documentation obligations under Standard 2 are operational and systemic rather than participant-specific, although participant records are examined in context.

The incident management system is a core Standard 2 requirement. Providers must maintain a contemporaneous incident register — not a retrospective summary, but a record system that captures incidents as they occur or are identified. Each incident record must document what happened, when, to whom, what the immediate response was, and what follow-up actions were taken or planned. The Commission will review both the register and the underlying incident documentation, including any shift notes that relate to the incident. Inconsistency between a shift note and a subsequent incident report is treated as a documentation integrity concern.

Complaints records must document the complaint received, the process for investigating or addressing it, and the outcome communicated to the complainant. Standard 2 requires that the complaints process is accessible and that outcomes are documented. An unresolved complaint with no recorded progress or outcome does not satisfy the Standard.

Worker screening records are a direct Commission audit target. All workers who deliver NDIS supports in risk-assessed roles must hold a valid NDIS Worker Screening Check clearance. Providers must maintain records showing the clearance number, the worker's name, and the clearance expiry date. A clearance that has expired without renewal means the worker is not cleared to deliver supports — and documentation of an expired clearance is treated as a serious compliance failure.

Worker training records must be maintained and aligned to role. The Commission examines whether workers delivering specific supports — behaviour support, personal care, specialised equipment — have received training appropriate to those supports. Training completion records must be current. A worker trained two years ago with no refresher record in a high-risk support area presents a documentation gap that auditors will pursue.

Risk management documentation — risk assessments, risk registers, records of risk reviews — is required under Standard 2. Providers must be able to demonstrate that identified risks are documented, assessed, and actively managed, not simply listed. A risk register that has not been reviewed in twelve months will attract scrutiny.

Standard 3: The Support Environment

Standard 3 requires that the environments in which supports are delivered are safe, appropriate, and suited to participants' needs. The documentation obligations attach to both the physical environment and the competence of the workers operating within it.

Providers must maintain evidence that workers are competent and appropriately supervised. This goes beyond training records — it includes supervision records, performance records where relevant, and, in the shift note context, evidence that workers are applying their training in practice. A provider that records incidents involving poor practice without any corresponding supervision record raises a Standard 3 concern.

Risk assessments for support settings must be documented and current. Where supports are delivered in a participant's home, in the community, or in a residential facility, there should be documentation that the environment has been assessed for safety and that any identified risks have been addressed or mitigated. For high-risk support environments — involving complex medical needs, challenging behaviour, or specialised equipment — the risk assessment must be specific and detailed.

Equipment records are required where participants use equipment as part of their support — communication devices, mobility aids, therapeutic equipment. Maintenance records for equipment must be kept. A piece of equipment that is faulty or overdue for servicing, combined with an absence of maintenance documentation, represents both a safety concern and a Standard 3 documentation failure.

Health and safety incident records — separate from participant incident reports — are required to document workplace injuries, near misses, and environmental hazards. These records support the provider's broader occupational health and safety obligations and are examined in the context of Standard 3 compliance.

Standard 4: Support Provision Management

Standard 4 is where the shift note bears the greatest documentation weight. It requires that the provider plans, delivers, and monitors supports in a way that is responsive to participants' individual needs and aligned to their NDIS plan goals. The records that evidence Standard 4 compliance are primarily individual support plans and the progress records — shift notes — that document support delivery over time.

Individual support plans must be current, aligned to the participant's NDIS plan goals, and specific enough to guide the delivery of supports. A support plan that is a generic description of the participant's disability without reference to their current plan goals does not satisfy Standard 4. Auditors will compare the support plan to the NDIS plan and to the shift records to assess whether the plan is operational or aspirational.

Progress records — shift notes — are the evidentiary core of Standard 4 compliance. The Commission's expectations for progress records are well established through audit practice: records must be specific and include observable detail rather than generic statements; they must be contemporaneous, completed on the same shift or working day as the support delivered; and they must link the support delivered to the participant's goals. A shift note that says "good shift, participant was happy" provides no evidentiary value. A shift note that records specific activities, the participant's response, progress against a named goal, and any concerns or follow-up required is compliant evidence.

Monitoring and review records must document that the provider is actively assessing whether supports remain appropriate and effective. This includes records of support plan reviews, outcome monitoring, and any changes made to supports in response to changing participant needs or circumstances. Transition planning documentation is required where a participant is moving between service types, providers, or living arrangements — the transition process and the participant's involvement in planning it must be evidenced in the record.

Specialist assessment records — from allied health practitioners, behaviour support practitioners, and other specialists — must be retained and must be reflected in the participant's support plan. Where a specialist has provided a recommendation about how supports should be delivered, the records must show that the recommendation has been actioned.

The penalties that now attach to documentation failures

On 9 April 2026 the NDIS Amendment Act came into force, significantly expanding the Commission's civil penalty powers. The Amendment introduces a new concept of serious contravention — a contravention is serious if it involves a significant failure or forms part of a systematic pattern of conduct. A serious contravention now attracts civil penalties of up to 10,000 penalty units, currently $3,300,000.

Two further civil penalty provisions directly target documentation integrity. A failure to comply with an information-gathering request — that is, a failure to produce records the Commission has asked for, within the time specified — attracts a penalty of 60 penalty units, currently $19,800. Knowingly providing false or misleading information or documents to the Commission attracts 120 penalty units, currently $39,600.

The practical implication is direct. A provider that cannot quickly produce defensible shift note evidence when the Commission requests it is now exposed to a $19,800 penalty for the delay. If the records that are produced turn out to be vague, inconsistent with the incident report, or otherwise misleading — the second penalty applies. The documentation failure modes described throughout these pages are no longer merely audit risks; they are now quantified civil liability.