NDIS Audit Non-Conformities: How to Build a Corrective Action Plan That Holds Up

You have received your NDIS audit findings. The team is already busy, the response deadline is approaching, and the first proposed actions are to update a policy and run another training session.

Before committing to that work, check whether it will address the reason for the finding occurred. A useful NDIS corrective action plan connects the finding to a practical change, a responsible person and evidence that the change is working. That is what gives your team a clear response to deliver and your auditor something meaningful to assess.

This guide is for providers responding to formal audit non-conformities. It focuses on the response after the audit, rather than on pre-audit readiness checks.

Start with the finding, the risk and the actual deadline (NDIS Audit Non-Conformities: How to Build a Corrective Action Plan That Holds Up)

Keep the auditor’s original finding and rating intact. Record the relevant Practice Standard, the evidence the auditor relied on, the affected service or site, and the date of written notification. Clarify any factual uncertainty with your approved quality auditor before building the response.

The current auditor scheme guidelines require a registered NDIS provider to present a corrective action plan within seven calendar days of written notification of a non-conformity. That is a deadline for the plan, not a statement that every finding must be closed within seven days. Annex C sets out different review and closure requirements according to the finding and audit circumstances. [1]

Ask your auditor to confirm the dates and evidence requirements that apply to your findings, including any registration conditions. Put plan submission, implementation, effectiveness review and auditor follow-up into your work schedule separately. Do not rely on a generic “30-day” or “90-day” rule.

If the finding reveals a current risk to a participant, address that risk immediately through your organisation’s safeguarding processes. An audit action plan does not replace a registered provider’s separate obligation to notify the Commission of reportable incidents. [5]

Separate the immediate correction from the cause

A correction deals with the problem you can see. Corrective action changes the system that allowed it to happen. Both may be needed.

For example, completing an overdue complaints review addresses one outstanding case. It does not explain why the case was missed or prevent the next one from being overlooked. The cause might involve unclear responsibility, an absent manager with no delegate, inaccessible records or a reporting process that never identifies overdue work.

Investigate before deciding. Review the sequence of events, speak with the people doing the work and check whether the same weakness exists elsewhere. “Staff need reminding” is not a useful conclusion unless you have established that knowledge, rather than workload, system design or accountability, caused the problem.

Build a plan your team can actually deliver

Use the auditor’s required format where one is provided. Within it, make the following clear for each finding:

• Finding and scope: what was identified, which requirement applies and where the issue may extend beyond the original sample.

• Immediate action: what has been done to manage current risk or correct the specific problem.

• Cause: the explanation supported by your investigation, including contributing factors.

• System change: what will be different in practice, not just which document will be edited.

• Accountability: one named action owner, the resources they need, a due date and a person to escalate delays to.

• Implementation evidence: the records that will show the change has been introduced.

• Effectiveness check: what will be tested, by whom and when, and what result will show the action worked.

• Follow-up status: what is ready for auditor review and what remains open.

These are practical planning fields, not a claim that the Commission mandates this particular template. Keep the response proportionate to the finding, service complexity and risk.

Example: an overdue complaints review

The following example is hypothetical and is not an account of a DHD client.

An auditor identifies three complaints recorded as closed without evidence that the agreed actions were completed or the outcomes communicated. The provider’s first response is to circulate the complaints policy again.

A more useful response would work through the actual failure:

• Correction: review the three cases, confirm outstanding actions and communicate appropriately with the people involved. Record what happened and when.

• Cause: establish whether responsibility for checking completion was unclear, then check other recent cases for the same weakness. Do not assume the sample defines the full extent of the problem.

• Corrective action: if that cause is confirmed, assign a closure reviewer and backup, define the evidence needed before closure, and add overdue actions to the manager’s existing review process.

• Implementation evidence: retain the approved process change, role briefing, updated case records and the first management review of outstanding actions.

• Effectiveness: at a planned follow-up, sample cases handled after the change. Check that actions were completed, communication was recorded and exceptions were escalated. Record the sample and result, including any remaining gaps.

Choose the review period and sample to suit your service and risk. If there have been no new complaints, say so. A walkthrough can test whether people understand the process, but it cannot be presented as evidence of successful handling of real cases that never occurred.

Give the auditor a clear evidence trail

For each finding, prepare a short evidence index that identifies the action, the relevant record, its date or version, and what it demonstrates. Separate revised procedures from records of their use and from your later effectiveness review.

A training attendance sheet shows who attended. Depending on the finding, you may also need a competency check, observation or subsequent work records to demonstrate the required change. DHD’s audit evidence guide explains how to keep that trail traceable.

Retain original records and make later corrections transparently. Do not backdate documents or create records suggesting that suggest an activity happened when it did not. Limit personal information to what is necessary and use an agreed secure sharing method. The applicable Core module includes requirements for accurate, confidential information and appropriate access, transfer and storage controls. [3]

Keep internal completion separate from auditor closure

Your team may finish an action before the auditor has assessed it. Use clear status labels such as “implemented”, “effectiveness review due” and “submitted for auditor review”. Keep the auditor’s written outcome alongside the finding.

Commission guidance requires approved quality auditors to review open non-conformities and assess whether the actions have been implemented and the relevant requirements are met. Closure reporting differs between verification and certification pathways. A consultant’s review or a completed internal checklist is not the auditor’s closure decision. [2]

Keep the improvement in routine management review after the finding is resolved. For providers to whom the Core module applies, quality management includes proportionate internal auditing and continuous improvement informed by outcomes, risk information and participant and worker feedback. [3]

When to bring in corrective-action support

Independent support is useful when the cause remains unclear, findings affect several sites, the same issue keeps returning, or your team is struggling to turn completed activities into convincing evidence. Seek help early enough to investigate and implement the response, rather than only asking for a document check just before submission.

DHD provides NDIS non-conformity and corrective-action support, including root-cause analysis, action planning, implementation evidence, and follow-up review. The work can be scoped around the findings and the capability your team needs. [6]

Have audit findings to work through? Book a free discovery consultation to discuss the findings, your response dates, and where support would help. For the initial enquiry, describe the issue without sending identifiable participant records.

DHD provides independent consultancy, not certification audits. Your approved quality auditor assesses the audit evidence, and the NDIS Commission makes the registration decision. No consultant can guarantee closure or registration. [4] [6]

General provider guidance, current at 20 October 2026. Confirm the requirements for your registration scope and findings with your approved quality auditor. Obtain specific legal advice where needed.