NDIS Stage 1 vs Stage 2 Audit: A Worked Example

Why the two-stage audit process exists

The NDIS Quality and Safeguards Commission requires registered providers delivering higher-risk supports — including Supported Independent Living (SIL) — to undergo a two-stage certification audit conducted by an approved quality auditor. The two-stage model exists because documents alone cannot confirm safe practice. Stage 1 establishes whether your organisation has built the right foundations on paper; Stage 2 tests whether those foundations are real in the day-to-day experience of participants and workers.

Under the NDIS Practice Standards (and the strengthened framework progressively taking effect from 2026), SIL providers must demonstrate conformance across the Core Module and the SIL-specific supplementary module. Non-conformances identified at either stage can delay or prevent registration renewal, require corrective action plans, and — in serious cases — trigger Commission compliance action.

Stage 1: the off-site document audit

Stage 1 is conducted remotely. Your approved quality auditor requests a document pack covering the NDIS Practice Standards that apply to your registration groups. They review that pack without visiting your premises, then prepare a preliminary report before Stage 2 begins.

What auditors assess at Stage 1

• Governance and operational management — constitution or company structure, insurance certificates, risk management framework, business continuity plan.
• Human resources policies — recruitment, screening (including NDIS Worker Screening Check records), induction, supervision frameworks, and performance management processes.
• Incident management system — your written policy, reportable incident categories, timelines for notifying the Commission, and records demonstrating previous incidents were properly managed.
• Complaints management — documented process, evidence that participants know how to complain, and sample records showing complaints were handled and closed.
• Restrictive practices (where applicable) — behaviour support policies, consent and authorisation records, and evidence that regulated restrictive practices are reported to the Commission.
• Participant rights documentation — service agreements, participant handbooks, easy-read materials confirming the Code of Conduct obligations are communicated.
• SIL-specific documentation — individual support plans, daily living and life skills frameworks, how home and living goals are identified and reviewed.

Common Stage 1 non-conformances

• Incident management policy does not list all NDIS reportable incident categories or does not specify the required notification timeframe to the Commission.
• Behaviour support policy references regulated restrictive practices but contains no mechanism for obtaining behaviour support practitioner approval prior to use.
• Worker screening records are present but not kept in a register that can demonstrate ongoing compliance (screening clearances must be current, not just obtained at hire).
• Complaints policy does not reference the NDIS Commission as an escalation pathway for unresolved complaints.
• Support plans lack a review cycle or do not connect participant goals to the specific supports being delivered.

Stage 2: the on-site audit

Stage 2 takes place at your operational sites — including SIL homes where participants live. Auditors are checking that Stage 1 documents translate into real practice. They do this through three primary methods: interviews with participants, interviews with staff and management, and direct observation of the environment and records.

What auditors assess at Stage 2

• Participant interviews — conducted privately, often with an advocate or support person if the participant chooses. Auditors explore whether participants understand their rights, feel safe, know how to raise concerns, and experience the supports described in their plan.
• Staff interviews — frontline workers are asked about induction, how they report incidents, what they do when something goes wrong, and how they support participant goals. Answers must match the policies submitted at Stage 1.
• Management interviews — the provider's leadership is assessed on governance, continuous improvement, how complaints data informs practice, and how restrictive practices are authorised and monitored.
• Record sampling — auditors review a sample of individual support plans, incident reports, complaint records, staff training logs, and restrictive practice authorisation documentation.
• Environmental observation — in SIL settings, auditors observe whether the physical environment supports participant safety, dignity, and choice, including appropriate accessibility and the absence of informal restrictions.

Common Stage 2 non-conformances

• Staff cannot describe the incident reporting process consistently with the written policy — a sign that training has not embedded the procedure.
• Participants are unaware of their rights or how to make a complaint, indicating that rights communication is formal (a form signed at intake) rather than ongoing and accessible.
• Support plans are generic across participants in the same household rather than genuinely individualised.
• Restrictive practices are in use that have not been authorised through the required behaviour support pathway or reported to the Commission.
• Mandatory training completions exist on paper but staff cannot demonstrate the relevant knowledge in conversation.

Worked example: SIL provider preparing for a combined audit

The following is a realistic illustration of how a small SIL provider might move through both stages. Names and details are fictional for illustrative purposes.

In this example, the provider achieved conditional certification. They were required to submit a corrective action plan addressing the incident reporting knowledge gap and the missing review date within a specified timeframe set by the auditor. The Commission was notified of the outcome through the auditor's certification report.

How to prepare: a practical step list

1. Map your registration groups to the applicable Practice Standards modules — identify every standard that applies to your services, not just the core module.
2. Conduct a pre-audit gap analysis — compare each policy against the standard it is meant to meet. Check for missing notification timelines, absent authorisation pathways, and unsigned agreements.
3. Build a document register — create a master list of every policy, procedure, form, and record the auditor will request, with the version date and owner noted.
4. Run practice staff interviews — ask your workers the questions auditors ask. Gaps in knowledge become training priorities, not audit findings.
5. Prepare participants — ensure every participant understands their rights and the complaints process in a way that is accessible to them, and that this is an ongoing conversation, not a one-off form.
6. Check restrictive practice records — if any regulated restrictive practices are in use, verify each one has current authorisation documentation and has been reported to the Commission.
7. Address Stage 1 findings before Stage 2 — if your auditor identifies non-conformances at Stage 1, resolve and re-submit before the on-site visit wherever the audit timeline permits.

Providers seeking a head start on document preparation can access the 74-document audit-ready SIL compliance kit at ndiscompliant.com.au, which is structured to the NDIS Practice Standards and designed to address the most common Stage 1 and Stage 2 non-conformances.

Key points to remember

• Stage 1 is about what you have written; Stage 2 is about what you actually do.
• Non-conformances at either stage require a corrective action plan — they do not automatically mean registration is refused, but they add time and cost.
• Under the strengthened Practice Standards framework, the Commission has placed increased emphasis on participant experience and worker knowledge, meaning Stage 2 carries greater weight than it once did.
• Approved quality auditors are independent — preparing honestly for your own gaps is always more efficient than discovering them on audit day.