Common Mistakes in an NDIS Money Handling Policy (and How to Fix Them)

Why Your Money Handling Policy Is a High-Risk Document

For Supported Independent Living (SIL) providers and other registered NDIS organisations, the money handling policy is one of the most scrutinised documents an approved quality auditor will review. Participants in SIL settings often rely on staff to assist with daily financial tasks — paying bills, shopping, withdrawing cash — which creates a significant power imbalance and corresponding duty of care.

The NDIS Practice Standards and accompanying Quality Indicators require providers to have clear, documented processes that protect participant financial autonomy and prevent financial abuse. Under the strengthened 2026 framework, auditors are applying sharper scrutiny to financial safeguarding systems, with non-conformances in this area capable of triggering conditions on registration or, in serious cases, referral to the NDIS Commission for investigation.

Below are the seven most common mistakes SIL providers make in their money handling policies — and the specific fixes that will satisfy auditor expectations.

Mistake 1: No Clear Scope Statement

Many policies begin with vague language such as "this policy covers money handling" without specifying exactly which transactions are in scope. Auditors expect to see explicit coverage of:

• Cash transactions (withdrawals, purchases, petty cash)
• EFTPOS or card-assisted payments made on behalf of participants
• Online banking or bill-payment assistance
• Management of participant funds held on-site (for example, a small weekly cash allowance)
• Reimbursements and receipting obligations

The fix: Add a dedicated "Scope" section early in the policy that lists every transaction type your staff assist with. If your organisation does not hold participant funds directly, state that explicitly — and describe how you support participants who self-manage or use a plan manager.

Mistake 2: Missing or Inadequate Consent Provisions

The NDIS Code of Conduct requires providers and workers to respect the rights of people with disability, including their right to make decisions about their own lives. A money handling policy that does not require documented participant consent before staff assist with financial transactions creates a compliance gap and a safeguarding risk.

The fix: Require a signed Participant Finance Support Agreement or equivalent prior to any ongoing financial assistance. The agreement should specify what types of transactions staff may assist with, under what circumstances, and how the participant (or their authorised representative) can withdraw consent at any time. Keep signed copies in the participant's file and reference this in the policy.

Mistake 3: No Dual-Authorisation or Counter-Signatory Requirement

Policies that allow a single staff member to both facilitate a transaction and record it in the register create the conditions for financial abuse — whether intentional or inadvertent. This is one of the most common non-conformances raised by auditors reviewing SIL house documentation.

The fix: Mandate a two-person rule for any transaction above a defined threshold (your organisation determines the threshold, but it should be low — many providers set it at $50). Require that the participant or their representative (where capacity allows), plus a second staff member, sign off on each transaction. Your policy should name the roles responsible for counter-signing, not just refer to "another staff member."

Mistake 4: Receipting Requirements Are Vague or Absent

It is not enough to state that "receipts should be kept." Auditors look for a policy that specifies the minimum information a receipt must capture, how quickly it must be lodged, where it is stored, and what happens if a receipt cannot be obtained (for example, a market stall with no EFTPOS).

The fix: State that receipts are required for all transactions without exception. Where a receipt cannot be obtained, require a statutory-style written record completed by the assisting staff member at the time, countersigned by a supervisor within a defined timeframe. Specify the retention period — the NDIS Commission expects records to be retained in line with relevant state and territory legislation, and many providers adopt a minimum of seven years as a conservative benchmark.

Mistake 5: Reconciliation Frequency Is Not Defined

A policy that says "transactions will be reconciled regularly" gives auditors nothing to assess against. Regularity is not a standard. If a discrepancy is discovered months after it occurred, the policy has failed its safeguarding purpose.

What Auditors Expect to See

The fix: Replace all vague frequency language with specific timeframes, named roles, and a sign-off requirement. Reference a corresponding register template in the policy so there is no ambiguity about the format to be used.

Mistake 6: No Conflict-of-Interest Controls

The NDIS Practice Standards require providers to manage conflicts of interest. In a money handling context, conflicts arise when staff have personal relationships with vendors, are related to participants, or stand to benefit from a participant's financial decisions. Many policies omit any reference to this risk entirely.

The fix: Include a section requiring staff to declare any conflict of interest before assisting a participant with a financial transaction. Specify that a conflicted staff member must be replaced for that transaction by a non-conflicted colleague, and that the declaration must be recorded. Reference your broader Conflicts of Interest policy and Code of Conduct obligations.

Mistake 7: The Policy Is Not Referenced in Incident Reporting Procedures

Financial abuse — including unexplained discrepancies, missing funds, or unauthorised transactions — is a reportable incident under the NDIS (Incident Management and Reportable Incidents) Rules. Yet many providers have their money handling policy and their incident management procedure sitting in completely separate silos, with no cross-reference between them.

When an auditor identifies a discrepancy in a participant's finances and asks staff "what do you do next?", the answer must flow naturally from both documents. If staff cannot demonstrate that pathway, the auditor will raise a non-conformance against the incident management standard as well as the financial safeguarding standard.

The fix: Add a clear escalation clause to your money handling policy that states: any discrepancy that cannot be resolved within a defined timeframe (for example, 24 hours) must be escalated to the manager and recorded as a potential incident in the incident management system. For discrepancies that meet the threshold for reportable incidents, the NDIS Commission must be notified within the required timeframe under the Incident Management Rules.

A Quick Self-Audit Checklist

Before your next certification or verification audit, run your money handling policy against this checklist:

1. Does the policy define its scope across all transaction types your organisation facilitates?
2. Is documented participant consent required before financial assistance begins?
3. Is there a dual-authorisation requirement with named roles and a clear dollar threshold?
4. Are receipting requirements specific, including a process for missing receipts?
5. Are reconciliation frequencies defined with specific timeframes and responsible roles?
6. Is there a conflict-of-interest declaration requirement and removal process?
7. Does the policy cross-reference the incident management procedure with a clear escalation pathway?
8. Has the policy been reviewed within the past 12 months and approved by a named accountable person?

Aligning with the 2026 Strengthened Practice Standards

The NDIS Commission's strengthened framework places greater emphasis on provider governance, transparency, and participant rights. Money handling sits at the intersection of multiple Practice Standards modules — including those relating to participant rights, provider governance, and incident management. Providers seeking registration or re-registration under the new framework should treat their money handling policy not as a standalone document but as one component of an integrated compliance system.

If you are building or overhauling your documentation suite ahead of a 2026 audit, the 74-document audit-ready SIL compliance kit available at ndiscompliant.com.au covers money handling, incident management, consent, restrictive practices, and the full range of Practice Standards requirements in one aligned package — which removes the risk of gaps between documents that auditors regularly exploit.

Getting the money handling policy right is not just a compliance exercise. It is a practical safeguard that protects participants from financial harm and protects your organisation from the reputational and regulatory consequences of getting it wrong.