To fix an NDIS audit non-conformity, find the root cause, change the process behind it, and give the auditor evidence that the change works in practice. Findings come back when providers fix the document the auditor mentioned instead of the system that produced the gap.
This article is for NDIS providers who have received audit findings against the NDIS Practice Standards. It covers how to triage findings, trace each one to its cause, write a corrective action plan, build closure evidence and stop the same findings appearing at your next audit. For a broader checklist that also covers aged care, see our audit remediation support checklist.
What is an NDIS audit non-conformity?
A non-conformity is an audit finding that your organisation does not fully meet a Practice Standard or a related requirement. Auditors grade findings by how serious they are, usually as major or minor non-conformities, and may also note opportunities for improvement.
The grading matters, because it affects how quickly you must act and what happens to your registration. The auditor and the NDIS Quality and Safeguards Commission set the definitions and close-out timeframes, and these can change. Read your audit report closely, confirm the timeframe for each finding with your auditor, and check the Commission's current guidance rather than relying on a rule of thumb.
Triage your findings first
Before anyone starts rewriting policies, sort the findings. A short triage meeting in the first week saves time later.
- List every finding with its Practice Standard, the auditor's words and its grade.
- Mark the close-out date for each one, as your auditor has confirmed it.
- Flag any finding that involves a risk to participants' safety or rights. Deal with that risk straight away, before the paperwork.
- Group findings that share a cause. Three findings about participant files may be one problem with how files are set up.
- If a finding is unclear, ask the auditor what they saw before you act on it.
The result is a short, ordered list. Serious findings and the earliest deadlines come first.
Find the root cause
A finding describes a symptom. The root cause is the reason the symptom happened, and it is usually a gap in a process, a role or a habit. If you fix only the symptom, the finding returns.
Ask "why" until you reach something you can change. Take a missing incident report. The worker did not know the process. The induction skips incident management. Nobody owns the induction content. The fix belongs at that last step: give someone ownership and update the induction.
- Talk to the staff involved. They can usually tell you why the process broke down.
- Check whether the gap is isolated or widespread by sampling other files, workers or sites.
- Look at incident, complaint and internal audit records for earlier signs of the same issue.
- Write the root cause down in one or two plain sentences. If you cannot, keep asking why.
Write a corrective action plan with owners and dates
A corrective action plan turns each finding into specific work. Auditors expect to see one, and it is also the tool that keeps actions moving after the audit. Record the following for every finding.
| Field | What to write |
|---|---|
| Finding | The Practice Standard and the auditor's words |
| Grade | Major, minor or opportunity for improvement |
| Root cause | The underlying reason, not the symptom |
| Action | What will change, in practical terms |
| Owner | One named person responsible |
| Due date | Within the timeframe your auditor has set |
| Evidence | What will show the fix is working |
| Monitoring | How and when you will check it has held |
| Status | Open, in progress or closed, with the date |
Keep actions small and concrete. "Improve incident management" cannot be closed. "Add incident reporting to induction, train current staff and check ten incident records next month" can.
Build evidence of closure
A new policy shows that a change exists. It does not show that the change is working. Auditors look for both, so plan your evidence when you write the action, not the week before it is due.
- The updated policy or procedure, with a version number and approval date.
- Records that staff were trained or briefed, such as attendance lists, sign-offs or toolbox talk notes.
- Samples of records completed under the new process, dated after the change.
- An internal check showing the fix was applied to every file, worker or site affected, beyond the one example the auditor found.
- Governance records, such as meeting minutes, showing management reviewed the finding and the fix.
Label each piece of evidence with the finding it relates to, and keep it in one folder. Send it to the auditor in the format and by the date they ask for.
Why findings come back and how to stop repeats
A finding that appears at two audits in a row suggests your systems are not working. Auditors notice this, and a repeat finding can be treated more seriously the second time. The usual reasons are predictable.
- Fixing the document, not the practice. The policy is rewritten, but staff keep working the old way.
- Fixing the single example. One incomplete file is corrected while the others stay the same.
- No owner. The action sits in a plan with nobody responsible once the auditor leaves.
- No monitoring. Nothing checks whether the change held, so practice slowly drifts back.
To stop repeats, build the fix into how you run the organisation.
- Review the corrective action plan at every management meeting until every item is closed.
- Add each finding and its fix to your continuous improvement register.
- Run short internal audits of higher-risk areas, such as incidents, restrictive practices, participant files and worker screening, on a set schedule.
- Build new processes into induction so new staff learn the current way of working.
- Hold a mock audit before your next scheduled audit.
Many of the gaps that cause findings in the first place are covered in common audit readiness mistakes providers must avoid. If a major finding is at risk of missing its deadline, talk to your auditor early and explain what is done and what remains.
If you want help closing findings, our NDIS consultant services include root cause reviews, corrective action plans and closure evidence. We quote a fixed fee after a free 15-minute call, so you know the cost before work starts. Book a call.
Frequently asked questions
How long do we have to close a non-conformity?
It depends on the grade of the finding. Your auditor and the NDIS Quality and Safeguards Commission set the timeframes, so confirm each one with your auditor and check the Commission's current guidance.
Is updating a policy enough to close a finding?
Usually not. Auditors look for evidence that the change works in practice, such as training records and records completed under the new process.
Can a minor non-conformity become more serious?
It can. A finding that is not fixed, or that recurs at a later audit, may be treated more seriously, so close minors properly and monitor them.
What is a root cause?
It is the underlying reason a gap happened, such as a missing process, an unclear role or a gap in training. Fixing it is what stops the finding returning.