Every NDIS and aged care provider needs the same compliance essentials: current policies that staff actually follow, a small set of working registers, screened and trained workers, clear incident and complaint handling, and a regular review cycle that proves it all works.
This article explains who regulates you, which documents and registers to keep, the obligations that apply every day, and a simple weekly to yearly routine for running compliance. It is written for owners and managers of small and mid-sized providers who want a plain-English starting point.
Who regulates NDIS and aged care providers
Registered NDIS providers are regulated by the NDIS Quality and Safeguards Commission. It registers providers, sets the NDIS Practice Standards and the NDIS Code of Conduct, oversees worker screening, receives reportable incidents and handles complaints about providers.
Aged care providers are regulated by the Aged Care Quality and Safety Commission. It assesses providers against the Aged Care Quality Standards, monitors their performance and deals with complaints. Aged care policy and funding sit with the federal health department, which is where changes to aged care law are announced.
Other laws apply to both sectors. The Privacy Act and the Australian Privacy Principles govern personal information. Work health and safety laws in your state or territory cover your workers. Some providers also choose ISO 9001 certification as a quality framework that sits alongside the sector standards.
The documents and registers every provider needs
Regulators look for the same core records in both sectors. A policy manual sets out what you do. Registers show that you did it. Most audit findings trace back to a register that is missing, stale or kept by one person on one laptop.
| Register | What it records | Suggested review |
|---|---|---|
| Risk register | Each risk, its rating, the control, an owner and a due date | Monthly by management, quarterly by the board |
| Incident register | What happened, who was notified, the investigation and the outcome | Weekly, with a monthly trend check |
| Complaints and feedback register | The concern, the response, timeframes and what changed | Monthly |
| Training and screening register | Every worker, their screening status, required courses and expiry dates | Monthly |
| Continuous improvement register | The issue, the action taken and the result | At each quality meeting |
| Policy register | Each policy, its version, owner and next review date | Quarterly |
Keep all of these in one system, with an author and a date on every entry. Map each register to the standards that apply to you, so you can show an auditor where the evidence for each standard lives.
Obligations that apply every day
Some obligations cannot wait for the next review. These are the ones regulators treat most seriously, because they protect the people you support.
- Incident reporting. Staff need to know what counts as a reportable incident, who they tell, and how fast. Your incident procedure should name the person who notifies the regulator.
- Complaints. Participants, residents and families must be able to complain easily and without fear. Acknowledge each complaint, record it and tell the person what you did.
- Worker screening and training. Nobody should deliver supports until their screening checks and induction are complete and recorded.
- Privacy and consent. Store personal information securely, limit access by role, and record consent before sharing information.
- Risk management. When something changes, such as a new service or a participant with new needs, assess the risk and update the register.
If you are setting these up for the first time, our article on common compliance mistakes new providers make covers the gaps we see most often in the first year.
How to run compliance day to day
Compliance works best as a routine with fixed dates and named owners. A small provider can run the whole cycle with a compliance lead, a manager and a short monthly meeting.
- Weekly: the compliance lead reviews new incidents and complaints and checks that each has an owner and a next step.
- Monthly: management meets to review the risk register, incident trends, training expiries and open improvement actions. Minutes record decisions and dates.
- Quarterly: review the policies due in the policy register, brief staff on any changes, and report key risks to the board or owner.
- Yearly: run a self-assessment against every standard that applies to you, and file sample checks of participant or resident records.
Each step leaves a record: a dated register entry, a set of minutes, a signed briefing sheet. Those records are what an auditor will ask for. Our NDIS consultant services and aged care consultant services can set up this cycle for you and hand it over to your team.
Common problems and how to fix them
The same few problems come up across NDIS and aged care providers of every size. Each has a simple fix.
- Outdated policies. A policy library can look complete while holding old versions. Put a version number, owner and review date on every policy, and archive old versions rather than deleting them.
- Staff who cannot explain the policy. Reading a document is not the same as understanding it. Use short, scenario-based training and ask staff what they would do.
- Scattered records. Files split across desktops, shared drives and paper folders cannot be found at audit. Choose one system and a consistent naming convention.
- No owner. Tasks with no named owner slip. Assign each register and review to a role, so it survives staff changes.
- Improvements nobody wrote down. Changes often happen but leave no trace. Log each one in the continuous improvement register with the result.
Providers working towards ISO 9001 will find the same disciplines in that standard. Our ISO compliance support covers building one quality system that meets both. For a closer look at how these gaps show up on audit day, read common audit readiness mistakes providers must avoid.
Staying audit-ready all year
Audit readiness is the result of the routine above, kept up over time. If the registers are current and the meetings are minuted, preparing for an audit is mostly a matter of gathering what you already have.
- Keep an evidence folder for each standard, with a short index of what is in it and where.
- Close open corrective actions before the audit is booked, and record how each was closed.
- Run a mock interview with a few staff so they have practised explaining how they work.
If you would like an outside view of where your systems stand, book a free 15-minute call. We quote a fixed fee after the call, so you know the cost up front. Contact us to arrange a time.
Frequently asked questions
Who regulates NDIS providers?
The NDIS Quality and Safeguards Commission regulates registered NDIS providers. It sets the NDIS Practice Standards and the Code of Conduct and receives reportable incidents.
Who regulates aged care providers?
The Aged Care Quality and Safety Commission. It assesses providers against the Aged Care Quality Standards and handles complaints about aged care services.
What records do regulators look at first?
Usually the incident, risk, complaints and training registers, plus a sample of participant or resident files. Each one should be current, dated and easy to find.
How often should policies be reviewed?
On a fixed cycle, commonly every one to two years for each policy, and straight away when the law or your services change. Record every review in the policy register.
Does a small provider need a compliance officer?
It needs a named person responsible for compliance, but that can be part of a manager's role. What matters is that every register and review has an owner and a date.