NDIS Audit Non-Conformances: Types, Consequences and How to Respond

What Is an NDIS Non-Conformance?

In the context of an NDIS audit, a non-conformance (sometimes written as "non-conformity") is a formal finding by an Approved Quality Auditor that your organisation does not meet one or more requirements of the NDIS Practice Standards. It is the auditor's documented evidence that there is a gap between what the Practice Standards require and what your organisation actually demonstrates.

Non-conformances are not opinions or suggestions — they are evidence-based findings that must be supported by specific audit evidence. Under the NDIS Practice Standards Audit Methodology, the auditor must record:

• The specific Practice Standard outcome that is not met
• The evidence (or lack of evidence) that supports the finding
• The classification of the finding (minor or major)
• The expected corrective action response

Each non-conformance is recorded in the audit report that the Approved Quality Auditor submits to the NDIS Quality and Safeguards Commission. The Commission uses this report — alongside other information — to make its registration decision under Section 73E of the NDIS Act 2013.

How Auditors Grade Findings

NDIS Approved Quality Auditors use a structured methodology to assess and classify their findings. The grading process follows the principles established in the NDIS Practice Standards Audit Methodology and aligns with international auditing standards (ISO 17065 and ISO 19011).

The Assessment Process

For each Practice Standard outcome, the auditor collects evidence through multiple methods:

1. Document review: Examining your policies, procedures, registers, and records
2. Observation: Watching how supports are delivered in practice (during on-site visits)
3. Interviews: Speaking with management, staff, participants, and families
4. Record sampling: Reviewing a sample of participant files, incident reports, training records, and other operational documents

The auditor then evaluates the evidence against each quality indicator within the Practice Standard outcome. The classification depends on the nature, severity, and scope of any gaps identified.

Classification Criteria

The Judgement Element

It is important to understand that classification involves professional judgement by the auditor. Two auditors examining the same evidence might occasionally classify a finding differently. This is why it is critical to engage with your auditor during the draft report phase — if you believe a finding has been misclassified, you have the right to present your case.

Minor Non-Conformances in Detail

A minor non-conformance indicates that your organisation substantially meets the Practice Standard outcome but has an isolated gap, weakness, or inconsistency. The system exists and generally works, but there is room for improvement.

Common Examples of Minor Non-Conformances

Consequences of Minor Non-Conformances

• Registration can still proceed — the auditor can recommend certification
• You must develop a corrective action plan within the agreed timeframe
• You typically have up to 12 months to resolve the finding
• Resolution will be verified at your next audit (mid-term surveillance or renewal)
• Unresolved minor findings may be escalated to major at the next audit

Major Non-Conformances in Detail

A major non-conformance indicates a fundamental failure to meet the intent of a Practice Standard outcome. It represents a significant gap that may put participants at risk or demonstrates that a required system does not exist or is not functioning.

Common Examples of Major Non-Conformances

Consequences of Major Non-Conformances

• The auditor cannot recommend registration until the finding is resolved
• You must implement corrective actions within 90 days (typically)
• The auditor must verify resolution through evidence review (and possibly a follow-up visit)
• If not resolved, the NDIS Commission may refuse your registration application
• Additional audit fees may apply for follow-up verification
• The delay may cause you to miss critical registration deadlines

Root Cause Analysis Requirements

When you receive a non-conformance, your corrective action plan must include a root cause analysis — a structured examination of why the non-conformance occurred. Auditors expect you to look beyond the immediate symptom and identify the underlying systemic cause.

Common Root Cause Categories

• Knowledge gap: Staff did not know the requirement existed or did not understand what was expected
• Resource gap: Insufficient time, staff, or tools to implement the requirement
• Process gap: No documented procedure to guide implementation
• Oversight gap: No management review or monitoring to ensure compliance
• Communication gap: The requirement was documented but not communicated to relevant staff
• Transition gap: A change in staff, systems, or processes disrupted existing compliance

Root Cause Analysis Techniques

Two commonly used techniques for root cause analysis in NDIS compliance contexts are:

The 5 Whys

This technique involves asking "why" repeatedly until you reach the fundamental cause. For example:

1. Why were three staff missing NDIS Worker Screening Checks? — Because the checks were not obtained before they started work.
2. Why were checks not obtained before they started? — Because the recruitment process does not include a screening verification step.
3. Why is there no screening verification step? — Because the recruitment procedure was written before NDIS Worker Screening was mandatory.
4. Why was the procedure not updated? — Because there is no scheduled review cycle for HR procedures.
5. Why is there no review cycle? — Because the document control system does not include trigger-based reviews for regulatory changes.

Root cause: The document control and policy review system does not include mechanisms for updating procedures when regulatory requirements change.

Fishbone (Ishikawa) Diagram

This technique categorises potential causes into groups such as People, Process, Policy, Environment, Equipment, and Management. It is particularly useful for complex non-conformances with multiple contributing factors.

For detailed guidance on using these techniques in your corrective action plan, see our NDIS Corrective Action Plan guide.

How to Respond to Non-Conformance Findings

When your auditor issues a non-conformance, your response must be structured, evidence-based, and timely. Here is a step-by-step process.

Step 1: Understand the Finding

Before you respond, make sure you fully understand what the auditor is saying. Review the finding carefully and identify:

• Which specific Practice Standard outcome is not met
• What evidence the auditor relied on (or what evidence was missing)
• Whether the finding is classified as minor or major
• The expected corrective action timeframe

If anything is unclear, ask the auditor for clarification. This is not a sign of weakness — it demonstrates professionalism and a genuine commitment to addressing the issue.

Step 2: Conduct Root Cause Analysis

Use the 5 Whys technique or another structured method to identify why the non-conformance occurred. Document your analysis — the auditor will want to see it as part of your corrective action plan.

Step 3: Develop Your Corrective Action Plan

Your corrective action plan should include:

• A clear statement of the non-conformance finding
• Your root cause analysis
• Immediate corrective actions (fixing the specific problem)
• Preventive actions (systemic changes to prevent recurrence)
• Responsible person for each action
• Target completion dates for each action
• The evidence you will produce to demonstrate completion

Step 4: Implement and Gather Evidence

Execute your corrective action plan and collect evidence as you go. Evidence should be contemporaneous — created at the time the action was taken, not fabricated retroactively. Types of evidence include:

• Updated or newly created policy and procedure documents (with version control)
• Staff training records (attendance lists, training materials, competency assessments)
• Completed forms, registers, or records
• Minutes of meetings where changes were discussed
• Photographs (e.g., of updated noticeboards, safety equipment)
• Staff acknowledgement forms confirming they have read updated policies

Step 5: Submit Evidence for Verification

Submit your evidence package to the auditor within the required timeframe. Organise it clearly — label each piece of evidence against the specific corrective action it relates to. The auditor will review the evidence and determine whether the non-conformance has been adequately addressed.

Step 6: Verify Closure

Once the auditor is satisfied, the non-conformance will be recorded as "closed" in the audit report. For minor non-conformances, this may happen at the next scheduled audit. For major non-conformances, the auditor must verify closure before they can finalise their report and recommend registration.

Appealing or Challenging Non-Conformances

If you believe a non-conformance finding is incorrect, unfair, or based on incomplete information, you have several options.

During the Audit

The best time to address a disputed finding is during the audit itself. If the auditor raises a concern, you can immediately provide additional evidence or context. Many potential non-conformances are resolved at this stage when providers present evidence the auditor had not yet seen.

During Draft Report Review

Approved Quality Auditors must provide you with a draft audit report before it is finalised. You have the right to review the draft and respond to any findings. This is your formal opportunity to:

• Correct factual errors in the auditor's findings
• Provide additional evidence that was not available during the audit
• Challenge the classification (e.g., argue that a major should be a minor)
• Present context that affects the interpretation of the finding

The auditor must consider your response before finalising the report. They are not obligated to change their finding, but they must document your response.

After the Report Is Finalised

If you disagree with the final audit report:

• Contact the AQA's management: Most Approved Quality Auditors have an internal complaints and appeals process. You can escalate your concerns within the auditing organisation.
• Contact JAS-ANZ: As the accreditation body for AQAs, JAS-ANZ can investigate complaints about auditor conduct or methodology.
• Contact the NDIS Commission: If the audit report leads to an adverse registration decision, you can raise concerns directly with the Commission.
• Administrative Review Tribunal: If the NDIS Commission makes a reviewable decision (such as refusing registration or imposing conditions), you can apply to the Administrative Review Tribunal (ART) for a merits review.

Summary

NDIS audit non-conformances are not the end of the road — they are a structured mechanism for identifying and resolving compliance gaps. Understanding how they work empowers you to respond effectively and protect your registration.

The key takeaways are:

1. Minor non-conformances are manageable and do not prevent registration, but must be resolved before they escalate
2. Major non-conformances are serious and must be resolved within 90 days before the auditor can recommend registration
3. Root cause analysis is essential — auditors want to see systemic fixes, not quick patches
4. Prevention is far cheaper than remediation — complete documentation and evidence of implementation prevent most non-conformances
5. You have rights — you can challenge findings during the draft report phase and through formal channels

The most effective strategy is to invest in thorough preparation before your audit so that non-conformances do not arise in the first place. Our free NDIS Notes Rewriter helps you produce audit-ready documentation, and the SIL Rescue Kit provides the complete policy and procedure framework you need.