NDIS Desktop Audit vs On-Site Audit: What's the Difference and What to Expect

Verification Audit vs Certification Audit

Before diving into the desktop and on-site phases, it is important to understand the two fundamentally different types of NDIS audit — because this determines whether you face a desktop-only process or a two-phase assessment.

The NDIS Commission assigns one of two audit pathways depending on which registration groups you are applying for:

For a more detailed comparison, see our Verification vs Certification Audit guide.

Phase 1: The Desktop Audit

The desktop audit (sometimes called the "Stage 1" or "document review" phase) is the first phase of a certification audit. It occurs before the on-site visit and focuses on reviewing your documented management system — your policies, procedures, registers, and records.

Purpose of the Desktop Audit

The desktop audit answers one core question: does this organisation have the documented systems necessary to meet the NDIS Practice Standards? It is a readiness check — the auditor wants to confirm that the foundation exists before investing time in an on-site assessment.

What the Auditor Reviews

During the desktop phase, the auditor will typically request and review:

• All policies and procedures mapped to the relevant Practice Standard outcomes
• Your completed self-assessment against the NDIS Practice Standards
• Organisational chart and governance framework
• Key personnel suitability documentation
• Worker screening register
• Training register and training records
• Incident register and sample incident reports
• Complaints register
• Continuous improvement register
• Risk register
• Document control register
• Sample participant files (service agreements, consent forms, support plans)
• Insurance certificates

How the Desktop Phase Works

1. Document request: The auditor sends you a list of documents to submit, usually 2-4 weeks before the review
2. Document submission: You submit all requested documents electronically (email, file sharing platform, or the auditor's portal)
3. Auditor review: The auditor reviews all documents against the relevant Practice Standard outcomes (1-3 weeks)
4. Clarification requests: The auditor may request additional documents or clarifications
5. Desktop report: The auditor provides preliminary findings and confirms readiness for the on-site phase

Common Desktop Phase Outcomes

• Ready for on-site: Documentation is substantially complete. The auditor schedules the on-site visit.
• Minor gaps identified: Some documents need updating or additional information. The auditor schedules the on-site visit but notes areas for follow-up.
• Significant gaps: Major documentation is missing (e.g., no incident management policy, no worker screening register). The auditor may delay the on-site visit until these gaps are addressed.

Phase 2: The On-Site Audit

The on-site audit (sometimes called "Stage 2" or "field assessment") is where the auditor visits your service locations in person to verify that your documented systems are actually being implemented in practice.

Purpose of the On-Site Audit

The on-site audit answers a different question from the desktop phase: are the documented systems actually working in practice? Having a beautifully written policy means nothing if staff do not know about it, cannot describe it, and are not following it.

What Happens During the On-Site Visit

A typical on-site audit for a small SIL provider includes the following activities:

Opening Meeting (30 minutes)

The auditor meets with management to explain the audit process, confirm the scope, agree on the schedule for the day(s), and address any logistics.

Management Interviews (1-2 hours)

The auditor interviews the director, manager, and/or compliance officer about governance, oversight, risk management, quality systems, and organisational culture. They will ask about how the organisation monitors compliance, responds to incidents, and drives continuous improvement.

Staff Interviews (1-3 hours)

The auditor conducts one-on-one interviews with frontline support staff. Staff are asked about their understanding of key policies (incident reporting, complaints, safeguarding, privacy), their daily practices, and how they ensure participant choice and control. For more on what to expect, see our NDIS Audit Interview Questions guide.

Participant Interviews (1-2 hours)

With consent, the auditor speaks with participants (or their families/advocates) about their experience of the supports they receive. This is a critical verification method — participant voices provide direct evidence of whether person-centred approaches are genuinely embedded in service delivery.

Environment Inspection (1-2 hours per property)

For SIL providers, the auditor inspects the residential properties where supports are delivered. They check fire safety equipment, emergency evacuation plans, medication storage, general cleanliness, accessibility, and whether the environment feels like a home rather than an institution.

Record Sampling (1-2 hours)

The auditor samples operational records to verify that documented procedures are being followed. This includes reviewing completed incident reports, shift notes, medication administration records, supervision records, and participant files.

Closing Meeting (30 minutes)

The auditor summarises their preliminary findings, identifies any non-conformances, and explains the next steps in the audit process. This is an opportunity to ask questions and provide any additional context.

Duration and Costs Comparison

What Auditors Actually Do During On-Site Visits

Understanding the auditor's methodology during the on-site visit helps you prepare more effectively. Auditors use a technique called triangulation — they verify each Practice Standard outcome by collecting evidence from at least three different sources.

The Triangulation Method

For each outcome, the auditor cross-references:

1. Documents: What does the policy say should happen?
2. Observation/Records: What do the records show actually happened?
3. Interviews: What do staff and participants say happens in practice?

If all three sources align, the outcome is assessed as conforming. If there are inconsistencies — for example, the policy says incidents must be reviewed within 48 hours, but the incident register shows reviews taking 2-3 weeks, and staff say "we get to it when we can" — the auditor has evidence of a non-conformance.

This is precisely why it is not enough to simply have good documents. Your documents, your records, and your staff's understanding must all tell the same story. Writing compliant progress notes is a critical part of this — use our free NDIS Notes Rewriter to ensure your shift notes meet audit standards.

How to Prepare for the Desktop Phase

The desktop phase is primarily about documentation completeness and quality. Your goal is to present a complete, well-organised set of documents that demonstrates your management system covers every required Practice Standard outcome.

Desktop Phase Preparation Checklist

• Complete all policies and procedures before submitting — do not send drafts or partially completed documents
• Ensure every document has proper version control (document number, version, date, approved by, review date)
• Cross-reference each document to the specific Practice Standard outcome it addresses
• Populate all registers with real operational data — empty registers signal that systems are not functioning
• Prepare your self-assessment — complete the NDIS Practice Standards self-assessment tool honestly
• Organise documents logically (by Practice Standard outcome or by document type) so the auditor can find what they need
• Include a document index or cover sheet listing all submitted documents

How to Prepare for the On-Site Phase

The on-site phase is about evidence of implementation. The auditor already knows what your documents say — now they want to see whether those documents are being used in practice.

On-Site Phase Preparation Checklist

• Brief all staff on the audit process — explain what the auditor will ask and reassure them it is not a personal test
• Ensure all SIL properties are clean, safe, and meet environmental standards (fire safety, first aid, medication storage)
• Have printed copies of key documents available on-site (policies, emergency plans, quick reference guides)
• Ensure participant files are complete and accessible (with appropriate privacy protections)
• Confirm which participants are available and willing to be interviewed
• Prepare a private, comfortable space for the auditor to conduct interviews
• Have the compliance manager or designated person available to escort the auditor and answer questions throughout the visit
• Check that operational records (shift notes, incident reports, supervision records) are up to date

Summary

The NDIS certification audit is a two-phase process, and each phase tests different things. The desktop audit tests whether your systems exist on paper. The on-site audit tests whether they work in practice. Success requires preparation for both — and the best preparation starts months before the auditor's first document request.

For a comprehensive pre-audit checklist covering both phases, see our NDIS Audit Checklist 2026. And for the complete audit timeline from application to registration, read our NDIS Audit Timeline guide.