The most common audit readiness mistake is treating compliance as paperwork. Auditors for the NDIS and aged care want proof that your policies are followed every day, and most findings come from the gap between what a document says and what staff actually do.
This article covers the seven mistakes we see most often, how each one shows up at audit, and what to put in place instead. It applies to NDIS providers audited against the NDIS Practice Standards and to aged care providers assessed against the Aged Care Quality Standards.
Why audit readiness needs more than paperwork
Both the NDIS Quality and Safeguards Commission and the Aged Care Quality and Safety Commission expect providers to show that their systems work in practice. A policy folder on its own proves very little. Auditors test it by reading your records, checking dates and signatures, and asking staff how they would handle a real situation.
Take infection control. If the procedure says hand hygiene is checked weekly but there are no check records and no training logs, the procedure does not count. You are not audit-ready, however good the document is.
- Review policies on a schedule and brief staff each time one changes.
- Keep the risk register current. Every risk needs an action, an owner and a date. An empty or stale register reads as weak governance.
- When you audit your own files, check for evidence of practice as well as missing documents. Look for signed incident reviews and training logs that match the roster.
Overlooking regular internal audits and reviews
Both sets of standards expect ongoing self-assessment. Providers who skip scheduled internal audits tend to arrive at the external audit with the same problems: file checks nobody recorded, incident trends nobody analysed, and corrective actions that were never closed.
Missing internal reviews also means missing the early warnings. A complaint that keeps coming back, or an incident type that is slowly increasing, only shows up if someone looks at the records on a regular cycle.
- Keep an audit calendar that says what is reviewed, how often and by whom.
- Log every finding in one place, such as a non-conformity register, and track each one until it is closed.
- Run a self-assessment against the standards that apply to you at least once a year.
- Record what changed as a result of each review. That record is your evidence of improvement.
If you want help setting this up, our NDIS consultant services include building an internal audit schedule that fits the size of your organisation.
Inconsistent or poorly understood policies
Auditors regularly find policies that staff have never read or cannot explain. A common example is a digital induction checklist that new staff complete after they have already started work, or never complete at all. The policy exists, but the practice does not match it.
The same thing happens when the risk management policy describes one process and the incident register shows another. Version control causes problems too: a policy library can look complete while holding outdated procedures, duplicate versions or gaps where a required policy should be.
- Train staff with short, scenario-based sessions. Ask them what they would do, not whether they have read the policy.
- Keep a policy review schedule with a version number, owner and review date on every document.
At audit, expect staff to be asked how they would apply a procedure in a real situation. Their answers are evidence, just like your documents.
Incomplete or disorganised provider records
Poor record keeping is one of the main reasons providers struggle at audit. If you cannot find a record quickly, or it has no author or date, you cannot use it as evidence. Care plans, incident records, the risk register and improvement activity all need a clear trail.
Typical problems are files spread across personal desktops, shared drives and paper folders, documents with no date or author, and progress notes with no record of who changed them. Incident logs saved on one laptop are a common example. When that person is away, the evidence is too.
- Use one records system, with required fields for author and date and a consistent file naming convention.
- Keep incident and improvement registers in a system that time-stamps each entry and records who made it.
A simple record keeping checklist: keep an index of where every record type lives, back up and restrict access, spot-check a sample of records each month, and train staff on how to document. Good records also make it much easier to hand tasks to other people, which is the next mistake.
Unclear roles and responsibilities in compliance
When nobody is named as responsible for compliance tasks, they slip. Without a documented audit lead, evidence collection and self-assessment sign-offs fall between people. The NDIS Practice Standards expect clear responsibility for governance, risk and incident management, and aged care governing bodies carry similar duties.
If no one owns the incident register, incidents may not be reported or investigated on time. If no one reviews the quality register, a worsening trend can go unnoticed for months.
- Assign compliance duties to roles rather than to named people, so they survive staff changes.
- Set a sign-off process for the incident and quality registers, and hold a regular compliance meeting with minutes.
No evidence of continuous improvement
Both regulators expect you to show continuous improvement, and many providers find this the hardest part to evidence. Improvements often happen but are never written down, so the auditor has nothing to look at.
Evidence can be simple: feedback and complaints logged with the action taken, minutes from quality meetings, and procedures updated with a note of what changed and why. Providers working towards ISO 9001 will recognise the same idea, since that standard also asks for records of improvement and follow-up. Our ISO compliance support covers this if you are going down that path.
- Keep a continuous improvement register that records the issue, the action and the result.
- Make improvement a standing item at quality and governance meetings, and keep dated minutes.
- When a process changes, update the procedure and keep a record of the change.
Out-of-date staff training and competency records
Auditors check that every worker has completed induction, mandatory training and any refresher training their role needs, and that the records show it. Initial qualifications are not enough on their own. Expired or missing training is one of the most common findings for both NDIS and aged care providers.
Refreshers are where records usually fall behind, for example annual infection control, manual handling, or the NDIS Code of Conduct. If you cannot show that a worker is current, you cannot show that they are suitable for the work they are rostered to do.
- Keep one training register that lists every worker, every required course and its expiry date.
- Set reminders well before training expires, and do not roster workers for tasks where their training has lapsed.
Leaving it too late to get outside help
Internal teams get used to their own systems, so gaps become hard to see. An outside review looks at your evidence the way an auditor will. A good one maps your evidence to each standard, finds the gaps and runs mock audit interviews, so staff have practised answering questions before the day.
- Set up an audit evidence folder for each standard, with a short index of what is in it.
- Close any gaps in the risk register, the policy change history and the feedback register before the audit is booked.
Our aged care consultant services and NDIS consultant services both include a pre-audit review. We quote a fixed fee after a free 15-minute call, so you know the cost up front. Book a call.
Frequently asked questions
What is the most common reason providers fail an audit?
Evidence that does not match practice. The policy says one thing, and the records or staff answers show another.
How often should we run internal audits?
Set a calendar that covers every standard that applies to you over the year, with higher-risk areas such as incidents and medication reviewed more often. Record each review and what changed as a result.
What records do auditors look at first?
Usually the incident register, the risk register, complaints and feedback, training records and a sample of participant or resident files. Make sure each one is current and easy to find.
Can we prepare for an audit without a consultant?
Yes, if you have time and someone who knows the standards well. A consultant is most useful for an independent review of your evidence and for mock interviews before the audit.