NDIS audit evidence: what counts and how it is built
NoteGate is NDIS, Aged Care and DVA documentation compliance software by AgenticX Australia.
NDIS audit evidence is the material a provider can show to an approved quality auditor to demonstrate how it delivers supports against the NDIS Practice Standards. For most providers a large part of it is participant records: shift notes, incident records, risk entries and corrective actions. NoteGate supports documentation compliance by checking those records before they are saved and keeping the history, so the evidence exists before the audit. It does not decide what an auditor will accept.
Key takeaways
- The NDIS Commission says audits are done by an approved quality auditor. A verification audit is a desktop review of documentary evidence. A certification audit has a Stage 1 desktop audit and a Stage 2 onsite audit.
- At Stage 2 the Commission says the auditor looks at how policies and procedures are implemented, which can include viewing records, interviewing staff and participants, and observing supports.
- Records support that work only if they are accurate, current and specific. The Practice Standards ask for information that is “identifiable, accurately recorded, current and confidential”.
- Software cannot decide what is sufficient. The auditor does.
What is NDIS audit evidence?
NDIS audit evidence is the documents, records and observable practice a provider can show an approved quality auditor to demonstrate that its supports meet the NDIS Practice Standards. It includes policies and procedures, but auditors also test whether those are followed, which is why participant records matter.
The NDIS Commission’s audit guidance distinguishes what the audit checks by the type of audit. The table sets out what the Commission states, so you can see where records come in.
What do NDIS auditors review?
| Audit | Who it applies to (Commission) | How it works (Commission) | Where records come in |
|---|---|---|---|
| Verification | Providers who deliver only lower risk or lower complexity supports | An approved quality auditor completes a desktop review of the required documentary evidence | Documents you supply for review |
| Certification, Stage 1 | Providers who deliver one or more higher risk or more complex supports | A desktop audit, usually off-site, where the auditor asks for information and evidence | Evidence requested by the auditor |
| Certification, Stage 2 | Same | An onsite audit in the 3 months after Stage 1. The auditor looks at how policies and procedures are implemented, which might include viewing records, interviewing staff and participants, and observations | Participant records viewed on site; incident and complaint records traced |
The Commission also notes that a non-conformity is not a failure. In its case study of a certification audit, the findings included a minor non-conformity relating to incomplete documentation, and the auditor traced a reported incident from the initial report through to the notification obligations. Those are the places where record quality shows up.
What makes a shift note audit ready?
A shift note is usable as evidence when it is accurate, current and specific to the participant: who was supported, what was done, how the participant responded and how it relates to their goals. No regulator publishes a single note template, so the test is whether the record shows what happened.
The distinction between what a source states and what is good practice matters, so the table keeps them apart.
| Point | Stated by | Status |
|---|---|---|
| Participant information is identifiable, accurately recorded, current and confidential | Practice Standards, core module (Information management) | Outcome in the standards, assessed by the auditor |
| The information management system records each participant’s information in an accurate and timely manner | Same | Indicator: what a provider should be able to demonstrate. “Timely” is not defined |
| Case notes outline the activities a participant has engaged in and how they relate to the specific support item and the participant’s goals | NDIS record keeping requirements | NDIA guidance on record keeping |
| Note the participant’s response, any concern, and follow-up for the next worker | NoteGate view | Good practice, not a stated legal requirement |
Which records commonly make up audit evidence?
- Participant records: support logs and case notes. See NDIS record keeping requirements and how to write NDIS shift notes.
- Incident records: the Commission says an incident management system is required, and the Rules set a 7 year minimum for incident records. See the reportable incidents guide and how long to keep records.
- Risk records: a documented risk management system. See NDIS risk register requirements.
- Restrictive practice records: where a provider implements regulated restrictive practices, per the Commission’s guidance.
- Corrective actions and continuous improvement: how issues found were fixed and reviewed.
How does NoteGate help build audit evidence?
NoteGate checks each shift note, incident and care plan before it is saved and keeps the validation history, so an auditor can see what was submitted, what was corrected and when. Validated records feed a risk register and corrective actions. An audit pack assembles them for a chosen period. Your team reviews the pack and decides what to submit.
What NoteGate does not do. It does not decide whether evidence is sufficient, predict an audit outcome or replace an approved quality auditor. Read the overview of NDIS compliance software for how the pieces fit together.
Frequently asked questions
What is NDIS audit evidence?
NDIS audit evidence is the documents, records and observable practice a provider can show an approved quality auditor to demonstrate that its supports meet the NDIS Practice Standards. It includes policies and procedures, and participant records such as shift notes, incident records and risk entries that show those policies are followed.
What records do NDIS providers need to maintain?
The NDIA says records include support logs, rosters, case notes, invoices and service agreements, and that they must be complete and accurate. Incident records and restrictive practice records have a stated minimum retention of 7 years in the NDIS Rules. See the record keeping guide for the sources and for what section 45B of the NDIS Act adds.
What makes a shift note audit ready?
An audit-ready shift note is accurate, current and specific to the participant. It records what was done, how the participant responded and how the support relates to their goals. No regulator publishes one required template, so the test is whether the note shows what happened.
Can NoteGate promise an audit result?
No. Only the approved quality auditor decides what is sufficient. NoteGate supports documentation compliance by checking records before they are saved and keeping the evidence trail, and it does not predict an audit outcome.
Sources
- Types of audits (NDIS Quality and Safeguards Commission, retrieved 25 September 2026)
- Core module: Provider governance and operational management (NDIS Quality and Safeguards Commission, retrieved 26 September 2026)
- What are the record keeping requirements? (NDIS (NDIA), retrieved 25 September 2026)
- Incident management and reportable incidents (NDIS Quality and Safeguards Commission, retrieved 19 September 2026)
- Behaviour support and restrictive practices (NDIS Quality and Safeguards Commission, retrieved 25 September 2026)
Related
See the evidence trail NoteGate builds
Book a 20-minute walkthrough to see validation history, the risk register and an audit pack.
Book a 20-minute walkthroughChoose a plan