The most common compliance mistake new providers make is building their systems after they start delivering services instead of before. Policies get downloaded, workers start before their checks are filed, and registers only appear when an audit is booked. By then the gaps are already in the records.
This article covers the six setup mistakes we see most often in a new NDIS or aged care provider's first year, and what to put in place instead. If you are already preparing for an audit, our post on common audit readiness mistakes covers internal audits, records and training from that angle.
Using template policies that do not match your services
Most new providers start with a purchased or downloaded policy pack. That is a reasonable starting point, but a template describes a generic provider. It does not know who you support, where you deliver services, or who in your organisation makes which decision.
Take an incident management policy. The template may say incidents go to the "quality manager" when you have no such role. It may describe an escalation path for residential care when you only deliver community supports. The document looks complete, but nobody can follow it, and staff will quietly do something else.
Version control is the other early trap. Policies get edited in email attachments and saved in several folders, so staff end up using different versions. Keep one controlled library that frontline staff can read but only the policy owner can change.
- Rewrite each core policy so the roles, services and steps match how you actually operate. Start with incidents, complaints, risk and governance.
- Put a version number, an owner and a review date on every policy from the first day.
- Walk one real scenario through each procedure with the people who will use it. If they get stuck, the procedure needs changing.
Rushing onboarding and worker screening
New providers are often under pressure to accept work quickly, so workers start before their paperwork is finished. Both the NDIS Quality and Safeguards Commission and the Aged Care Quality and Safety Commission expect providers to confirm that workers are suitable and competent before they work with participants or residents.
The usual gaps are a screening clearance or police check that was never sighted, a signed induction checklist that does not exist, and no record of which policies the worker has read. A short verbal briefing on the first shift leaves nothing an auditor can check.
- Build an onboarding checklist that must be complete before a worker is rostered, with a supervisor sign-off.
- Record screening, qualifications and mandatory training in one worker register, with expiry dates.
- Keep a signed policy acknowledgement for each worker, and repeat it when a key policy changes.
Starting without registers
A register is simply a list you keep up to date: what happened, who owns it and when it will be closed. Many new providers plan to set them up "once things settle down". The first months are when you most need them, because every early incident, complaint and risk is evidence of how your systems work.
The registers to open on day one are the risk register, the incident register, the complaints and feedback register, the continuous improvement register and the worker register. Keep them in one shared location with controlled access, not on someone's laptop.
- For each risk, record the likelihood, the consequence, the action, the owner and a review date.
- Link improvement actions back to the incident, complaint or risk that prompted them.
- Review every register at a set meeting each month, and keep the minutes.
Weak incident and complaints processes
New providers tend to record serious incidents and ignore minor ones. The same happens with complaints: a formal letter gets logged, but a verbal comment from a family member does not. Small events are where patterns first show, so leaving them out means missing the early warning.
Registered NDIS providers must notify reportable incidents to the NDIS Commission within set timeframes. Aged care providers have their own serious incident reporting obligations. Staff need to know what counts as reportable, who decides, and who submits the notification, before the first incident happens.
- Map each process from the first report to closure, with a named role at each step.
- Record every incident and complaint, including minor and verbal ones, with the follow-up action and the date it closed.
- Look for trends at every monthly meeting, instead of waiting for something serious to happen.
Leaving nobody accountable for compliance
In a small new organisation, compliance is often described as "everyone's job". In practice that means nobody owns it. Policy reviews slip, registers go stale and nobody notices until an auditor asks who signed off the last risk review.
Governance does not need a large board to work. It needs clear owner or director responsibilities, written delegations, and meetings where risk, incidents and complaints are reviewed and minuted. Regulators in both sectors expect the people who run the organisation to show they are overseeing quality and safety.
- Name a compliance lead, even if it is the owner, and write down their duties.
- Draw a simple organisation chart and a responsibilities register that shows who owns each policy and register.
- Set a governance calendar with a standing agenda: risks, incidents, complaints, policy reviews and improvement actions.
Growing faster than your systems
Early growth is good news, but it tests every system you have. A new site, a new service type or a jump in worker numbers can outpace the processes that worked when there were five staff. Onboarding gets skipped, registers fall behind and policies stop matching what happens on the ground.
Before you add a service or location, check that your policies cover it, that your registers can take the extra volume, and that someone has time to run the new onboarding. Our business growth strategy work looks at compliance capacity alongside the commercial plan, and our post on scaling NDIS services safely compares the main approaches.
- Update your policies and risk register before the new service starts, not after the first incident.
- Check that the worker register and onboarding checklist cover any new roles or qualifications.
- Give the compliance lead time in their week to absorb the extra work, or share it out in writing.
If you are setting up, or you are in your first year and want a second opinion, our NDIS consultant services and aged care consultant services include a setup review of your policies, registers and governance. We quote a fixed fee after a free 15-minute call. Book a call.
Frequently asked questions
Can we use a template policy pack when we start?
Yes, as a starting point. Rewrite each policy so the roles, services and steps match how your organisation actually works before you rely on it.
Which registers does a new provider need first?
The risk, incident, complaints and feedback, continuous improvement and worker registers. Open them before you deliver your first service, and review them monthly.
Who should be responsible for compliance in a small provider?
One named person, usually the owner or a senior manager, with written duties. Other staff contribute, but one person is accountable for keeping policies and registers current.
When should a new provider get outside help?
Before you start delivering services, or before you add a new service type or site. It is cheaper to set systems up properly than to fix gaps an auditor has already found.