SIL Audit Checklist — Stage 1 and Stage 2

Stage 1 — desk audit readiness

Stage 1 is the documentation audit. A Quality Auditor reviews the evidence pack you submit and is reading for live, signed-off, version-controlled artefacts — not generic templates. The eleven checks below are what an evidence pack should withstand on first read.

• Document register and version historyEvery artefact in the pack is named, owned, dated, version-numbered, and traceable. Drafts are clearly marked. The register cross-references the Quality Indicator each document satisfies.
• Approval signatures and review cyclesEvery policy and procedure carries a sign-off signature, a review cycle (annual or sooner), and the next-review date. A document with no sign-off reads as unowned.
• State-overlay correctnessEach document that interacts with state legislation — privacy, health records, restrictive practices, WHS, fire safety, residential tenancy — reflects the legislation that applies in the operating state. A federal-baseline document in a state-overlay slot is a non-conformance.
• Risk registers are populated, not blankOperational, participant, WHS, and cyber registers each contain real entries with risk descriptions, controls, owners, residual ratings, and review dates. Empty registers read as a forgery.
• Worker screening and training matrixNDIS Worker Screening Check status and expiry date for every worker. First aid, manual handling, medication, behaviour support, and NDIS Worker Orientation Module currency tracked per worker. Matrix consistent with individual training records.
• Incident and complaints registers with evidenceIncident register contains actual incidents (or, for newly-operating services, a documented zero-state baseline) with categorisation, response, and closure. The complaints register reflects the participant-facing complaint pathway.
• Reportable incidents historyFor operating services: every reportable incident lodged within the prescribed timeframes (twenty-four hours for deaths and serious injury, five days for the broader category), with the Commission reference number and the closure record.
• Restrictive practices register and authorisation evidenceEvery authorised restrictive practice in use, the state authorisation pathway used, the behaviour support plan it sits within, and the monthly reporting history.
• Participant case-file sampleA representative sample of participant case files — service agreement, plan, risk assessment, support plan, progress notes, incident links. Files are auditable end-to-end without external context.
• Business continuity and emergency plansBusiness continuity plan, disaster recovery plan, and site-specific emergency and evacuation plans. Drill evidence for each site.
• Information security baselineInformation security policy, MFA on administrative accounts, access reviews, encryption posture for participant records, Notifiable Data Breach response procedure. Aligns with the Trust Center disclosures you make publicly.

Stage 2 — on-site verification readiness

Stage 2 is the on-site audit. The Quality Auditor interviews workers, samples participant case files in person, inspects premises, and verifies that the artefacts seen in Stage 1 reflect how the service actually operates. The eleven checks below are what an on-site visit should withstand.

• Workers can describe the policy in their own wordsWorkers on shift the day of the visit can describe how incidents are reported, how a complaint is raised, what a restrictive practice is, and where to find the relevant procedure. Worker interviews are the primary verification mechanism — not the policy document itself.
• Code of Conduct attestation and induction evidenceEvery worker has signed the NDIS Code of Conduct attestation and completed induction. Records match HR files and the training matrix.
• Participant interviews are arranged with consentWhere the Quality Auditor wishes to speak with participants, the consent process is in place and a support person is available if requested. Participant communication accessibility (Easy English, AUSLAN, interpreter) is provisioned.
• Service environment matches the documentationPremises are clean, accessible, and consistent with the service delivery environment risk assessment. Fire safety equipment is in date. Visitor sign-in procedure is in use.
• Medication management is verifiable on the dayMedication is stored as the policy describes. The medication chart is current. Schedule 4 / 8 controls are observable. Errors and near-misses are recorded.
• Plan utilisation tracking is liveFor each participant, plan utilisation is tracked against the funded budget; under- and over-utilisation triggers are documented. Plan review cycles are documented.
• Restrictive practices in use match the registerAny restrictive practice observed during the visit is on the register, authorised, in the behaviour support plan, and inside the monthly reporting cadence. Unauthorised use observed on the day is a serious finding.
• Behaviour support plans align with practiceWhere behaviour support plans exist, the documented strategies are visibly in use. Worker training reflects the plan. Practitioner involvement is documented.
• Site-specific emergency procedures are testableWorkers on shift can describe the evacuation procedure. Site evacuation diagrams are posted. Last drill date is current.
• Records access for the audit is fastRecords requested by the Quality Auditor during the on-site visit are retrievable in minutes, not hours. A working records index is the difference between a smooth visit and a flagged finding.
• Senior staff are available across the visitThe nominated audit-day contact and at least one senior operational lead are present for opening, closing, and any interim discussions. Continuity of conversation reduces avoidable findings.

Frequently asked

How long should I allow between Stage 1 and Stage 2?

Four to eight weeks is typical. If Stage 1 returns major non-conformances they must be closed before Stage 2 — the closure process and timeline are set by the engaged Quality Auditor.

Can the same auditor conduct Stage 1 and Stage 2?

Yes, and that is the common practice. A JAS-ANZ-accredited Approved Quality Auditor conducts both stages under the same engagement.

What counts as a major non-conformance vs a minor one?

The categorisation is the Quality Auditor's call under JAS-ANZ-accredited certification practice and the NDIS Commission's framework. Broadly, a major non-conformance is one where the absence of a control creates a foreseeable risk to participants or to the Standards' core obligations. Minor non-conformances cluster — multiple minors in the same area can be escalated.

What if I fail Stage 2?

Audit Recovery may be undertaken before re-presenting. The Commission's process for re-audit and provider conditions is documented on the Commission website.

When is the mid-term audit?

Certification is typically valid for three years with a mid-term audit at the eighteen-month point. The mid-term confirms that the certified posture has been maintained, not introduced for the audit.

How do I choose a Quality Auditor?

From the JAS-ANZ-accredited list published by the NDIS Commission, using your own judgement. Compliance Care does not refer specific auditors. See our Impartiality Statement at /trust.