What Is an NDIS Mid-Term Audit?

Registered NDIS providers operating under a three-year registration cycle are subject to more than a single certification audit at renewal. Depending on their registration group risk rating, providers may be required to complete a mid-term audit — sometimes called a surveillance audit or mid-cycle audit — roughly halfway through their registration period. This audit is conducted by an approved quality auditor (AQA) appointed by the NDIS Quality and Safeguards Commission.

For Supported Independent Living (SIL) providers and other higher-risk registration groups, the mid-term audit is not optional. It functions as a formal check that the systems, policies, and workforce practices evidenced at certification are still in place — and that any corrective actions from the initial audit have been addressed.

In 2026, the stakes are higher than previous cycles. The NDIS Commission's strengthened Practice Standards, which took effect progressively from late 2024 and into 2025, introduced more specific outcome indicators and a greater emphasis on evidence of lived implementation rather than documented intent alone.

Who Must Complete a Mid-Term Audit in 2026?

Your obligation to complete a mid-term audit depends on your registration group risk rating assigned by the NDIS Commission. SIL providers universally fall into the higher-risk tier, which requires a certification audit at initial registration and a mid-term audit before renewal. Providers offering:

…are subject to the most comprehensive audit scope. If you are unsure of your audit type and timing, your registration certificate issued by the NDIS Commission specifies your next audit due date. You can also verify this through the myNDIS provider portal or by contacting your AQA directly.

What Approved Quality Auditors Check in 2026

Auditors assess evidence against the NDIS Practice Standards (the legislative instrument under the National Disability Insurance Scheme Act 2013) and the associated Quality Indicators. For SIL providers, the following modules receive the closest scrutiny:

1. Rights and Responsibilities

Auditors verify that each participant has access to information about their rights in a format they can understand, and that staff can demonstrate how they uphold participant choice and control in daily practice — not just in policy documents.

2. Governance and Operational Management

This module covers complaints management, incident management, and continuous improvement systems. Auditors will sample actual incident records, checking that notifications to the Commission were made within prescribed timeframes and that investigations were conducted and documented adequately. Under the strengthened framework, auditors look beyond whether a policy exists to whether it has produced measurable improvement outcomes.

3. Provision of Supports

Service agreements, support plans, and daily support notes are reviewed for evidence that supports are delivered as agreed and that changes in participant circumstances are responded to in a documented, timely way.

4. Support Provision Environment

For SIL specifically, this covers the physical environment of the home, safety planning, medication management, emergency and evacuation procedures, and infection control protocols. Auditors typically conduct site visits for SIL providers.

5. Safeguarding of Participants

This is the area receiving the most attention under the 2026 strengthened framework. Auditors examine:

6. Behaviour Support

Where a provider implements behaviour support plans authored by a registered behaviour support practitioner, auditors verify that the plans are current, authorised under the relevant state or territory's regulatory framework, and that all implementing staff have been trained on the individual plan.

Common Non-Conformances Found at Mid-Term Audits

Based on the NDIS Commission's published guidance and sector experience, the most frequently identified gaps at mid-term audits for SIL providers include:

  1. Stale or unsigned service agreements — agreements not reviewed when participant circumstances changed or support packages were re-planned.
  2. Incomplete worker screening records — workers whose clearances have lapsed or where the provider cannot demonstrate verification was conducted before the worker commenced in a risk-assessed role.
  3. Incident notifications not lodged within required timeframes — particularly for reportable incidents involving injury, unlawful physical contact, or unauthorised restrictive practices.
  4. Restrictive practice registers not maintained — practices being implemented without written authorisation or without a corresponding behaviour support plan in place.
  5. Complaints register gaps — complaints recorded verbally but not entered into the register, or no evidence of resolution and outcome communicated to the complainant.
  6. Support plans not reviewed after significant events — hospitalisation, change in living situation, or changes to a participant's NDIS plan without a corresponding update to the provider's support plan.
  7. Training records incomplete — mandatory training such as the NDIS Code of Conduct module, infection control, or medication administration not completed by all relevant staff or records not retained.

Step-by-Step: How to Prepare for Your 2026 Mid-Term Audit

  1. Confirm your audit due date and scope. Log in to the myNDIS provider portal or contact your AQA. Confirm whether you require a desktop audit, a site visit, or both. SIL providers almost always require a site visit component.
  2. Map the Practice Standards modules to your evidence. For each Quality Indicator in the relevant modules, identify where your evidence lives — which policy, which register, which staff training record.
  3. Run an internal mock audit. Appoint someone not responsible for daily compliance to ask the same questions an auditor would ask. Pull 10 participant files at random and check for complete, current documentation.
  4. Audit your worker screening register. Every person in a risk-assessed role must have a current clearance before they deliver supports. Export your register and flag anyone whose clearance expires within the next six months.
  5. Review your incident and restrictive practice records. Confirm all reportable incidents from the past 12 months were notified to the Commission within required timeframes. Confirm all restrictive practice authorisations are current and that behaviour support plans name the implementing provider.
  6. Update service agreements and support plans. Any agreement more than 12 months old without a review notation should be refreshed and re-signed with participants.
  7. Prepare staff. Workers may be interviewed by the auditor. Ensure all staff understand the Code of Conduct and can explain their reporting obligations without referencing a script.
  8. Organise your document library. Auditors typically request an evidence bundle in advance of the site visit. Prepare a master index so you can locate any document quickly during the audit day.

What Happens If You Have Non-Conformances

A mid-term audit resulting in minor non-conformances will typically generate a corrective action plan agreed between the provider and the AQA. The Commission is notified of the audit outcome. Where non-conformances are significant — particularly in safeguarding or restrictive practices — the Commission may impose conditions on registration, suspend registration, or in serious cases, commence revocation proceedings.

It is important to treat any corrective actions from your previous certification audit as high priority. Auditors will specifically check whether those actions have been closed at the mid-term audit. Unresolved corrective actions from a prior audit compound risk at renewal.

Preparing Your Document Library

A well-organised evidence library is the single biggest time-saver on audit day. Your library should contain, at minimum:

Document CategoryKey Items
GovernanceComplaints register, incident register, continuous improvement log, meeting minutes
WorkforceWorker screening register, training matrix, position descriptions, induction records
Participant recordsService agreements, support plans, risk assessments, consent forms
Restrictive practicesAuthorisation letters, behaviour support plans, monitoring records, reduction plans
EnvironmentSafety audit records, medication management logs, emergency plans
PoliciesAll policies referenced in the above, with version control and review dates

Providers who find assembling this evidence package time-consuming may benefit from a structured compliance kit. The 74-document SIL compliance kit at ndiscompliant.com.au is built around exactly the document categories auditors request, with policies, registers, and templates pre-mapped to the NDIS Practice Standards Quality Indicators.

Key Dates and Ongoing Obligations

The NDIS Commission publishes guidance on audit timelines through its website. Providers should not wait for a reminder from the Commission — it is the provider's responsibility to initiate the audit with an AQA in sufficient time before the due date. Leaving the audit booking too late can result in a registration lapse, which prevents lawful delivery of registered supports.

Staying audit-ready is a continuous obligation, not a pre-audit sprint. The goal of the strengthened 2026 framework is to see compliance embedded in daily operations so that an auditor could walk in on any given day and find the same standard of evidence.

Important: This article provides general guidance about NDIS compliance requirements. It is not legal or professional advice. Requirements may change as the NDIS Commission updates its policies and Practice Standards. Always verify current requirements with the NDIS Quality and Safeguards Commission or a registered NDIS consultant before making compliance decisions.