After an audit finds non-conformities, your job is to fix each one, prove it is fixed, and show it will not happen again. The auditor sets the deadline and the kind of evidence they need, so start by reading the report closely and working to their terms.
This checklist covers the steps in order: triage, root cause, a remediation plan with owners and dates, evidence of closure, and stopping repeats. It applies to NDIS providers audited against the NDIS Practice Standards and to aged care providers assessed against the Aged Care Quality Standards.
The audit remediation checklist
Work through these steps for every finding. Most providers keep them in a single register so progress is visible at a glance.
- Read the report in full. Note each finding, the standard it relates to, the rating the auditor gave it and any deadline set.
- Brief your leadership team. The board or governing body should see the findings early, and the briefing should be minuted.
- Triage by risk. Deal first with anything that affects the safety of participants or residents, then with findings that carry a short deadline.
- Find the root cause. Ask why the gap happened, and keep asking until you reach something you can change.
- Write the remediation plan. Give every action an owner, a due date and a clear description of what "done" looks like.
- Make the change. Update the procedure, train the staff affected and change the system or form that allowed the gap.
- Collect evidence of closure. File the records that show the change is working, sorted by finding.
- Submit to the auditor. Send the evidence in the format and by the date they asked for, and keep a copy of what you sent.
- Check it has held. Look again at the same area a few months later through your internal audit program.
Triage the findings before you act
The first instinct after a tough audit is to fix everything at once. That usually means the easy items get done and the serious ones wait. Triage stops that.
Sort findings by the risk they carry, not by how quick they are to fix. A missing incident notification or a lapsed worker screening check is more serious than an out-of-date policy header. The NDIS Quality and Safeguards Commission and the Aged Care Quality and Safety Commission both expect providers to act first on risks to the people they support.
- Put every finding in one remediation register, with its reference number from the audit report.
- Record the risk rating you give each one and the reason for it.
- Where a finding points to immediate risk, act now and record what you did. Do not wait for the full plan.
Find the root cause, not the symptom
A finding describes a symptom. If you only fix the symptom, the same finding tends to come back at the next audit, often in a different part of the organisation.
Take a finding that three staff files had no current first aid certificate. The symptom fix is to chase those three certificates. The root cause might be that nobody tracks expiry dates, or that rostering does not check training before a shift is offered. Fixing that stops the next lapse too.
A simple method works for most findings. Ask why the gap happened, write down the answer, then ask why again. Stop when you reach a process, a system or a responsibility you can change. Involve the staff who do the work, because they usually know where the process breaks.
| Finding | Symptom fix | Root cause fix |
|---|---|---|
| Care plans not reviewed on time | Review the overdue plans | Add review dates to a tracked schedule with a named owner |
| Incident not reported to the regulator | Lodge the notification | Retrain managers on reportable incidents and add a check to the incident form |
| Staff unaware of a new policy | Email the policy again | Brief staff at team meetings and record who attended |
Build a plan with owners and dates
The remediation plan is the document the auditor will read most closely. It should be short and specific. Vague actions such as "improve training" cannot be tested, so they rarely satisfy an auditor.
- Write each action so someone outside the organisation could check whether it was done.
- Name one owner per action. A role title works better than a team, because a team cannot be held to a date.
- Set a due date inside the auditor's deadline, with time left to gather evidence.
- Track progress at a regular meeting and minute any dates that move, with the reason.
Many of the gaps that lead to findings are the same ones covered in our article on common audit readiness mistakes. It is worth reading alongside your plan, since fixing one of them often closes several findings.
Collect evidence that each finding is closed
An auditor closes a finding when the evidence shows the change is in place and working. A revised policy on its own shows intent. Records of the policy being used show practice.
Good closure evidence usually combines three things: the updated document, proof that staff were told and trained, and records created under the new process. For a finding about incident reporting, that might be the revised procedure, a signed training attendance list and a sample of incidents logged and reviewed since the change.
- Keep one evidence folder per finding, named with the finding's reference number.
- Add a short cover note that says what changed, when, and which files prove it.
- Check every document has a date, a version number and an author before you submit it.
Stop the same findings coming back
Repeat findings are a warning sign for regulators, because they suggest the organisation fixed the paperwork but not the practice. The best defence is to test your own fixes before an auditor does.
- Add each closed finding to your internal audit calendar and check it again within the year.
- Record remediation work in your continuous improvement register, so the change and its result are on file.
- Report open and recently closed findings to the board until they are stable.
- Look for patterns. If several findings share a root cause, fix that cause once.
Our service delivery quality improvement checklist covers the monitoring side in more detail.
If you would like a second pair of eyes on your plan or evidence, our NDIS consultant services and aged care consultant services include audit remediation support. We quote a fixed fee after a free 15-minute call. Book a call.
Frequently asked questions
How long do we have to fix audit findings?
The auditor sets the timeframe for each finding, and it depends on the finding type and its risk. Check your audit report, and contact the auditor early if a date looks unrealistic.
What is the difference between a minor and a major non-conformity?
A major non-conformity is a serious or systemic failure to meet a standard, often one that puts people at risk. A minor one is a gap that does not undermine the system as a whole. Your auditor's report states which applies to each finding.
Is a new policy enough to close a finding?
Usually not. Auditors want to see the policy being used, through training records and new records created under it.
Who should own the remediation plan?
A senior person with authority to assign work and move resources, such as a quality manager or operations lead. The governing body should still receive regular progress reports.