NDIS Certification vs Verification: Which Path Is Right for You?

The right audit pathway depends on the NDIS registration groups you apply for. Under the NDIS Quality and Safeguards Commission, providers delivering lower risk supports generally require a verification audit, while providers delivering higher risk or more complex supports require a certification audit.

You do not choose between certification and verification yourself. The NDIS Commission determines the required audit based on your registration groups, your organisation type, and the supports you plan to deliver. Understanding the difference early can help you prepare the right evidence, meet the relevant NDIS Practice Standards, and avoid delays during the registration process.

What is the difference between NDIS certification and verification?

The main difference is the level of audit required.

A verification audit is designed for providers delivering lower risk, lower complexity supports. It is primarily a desktop review of documentary evidence completed by an Approved Quality Auditor.

A certification audit is required for providers delivering higher risk or more complex supports. It consists of two stages: a desktop review (Stage 1) followed by an onsite audit (Stage 2), where the auditor assesses how your systems and processes work in practice.

According to the NDIS Commission, every registered provider must undergo an independent quality audit against the relevant NDIS Practice Standards before registration can be approved.

How do you know whether you need certification or verification?

The audit type depends on the registration groups included in your application.

After you submit your application, the NDIS Commission issues an Initial Scope of Audit. This document outlines:

• your registration groups (also called classes of support)
• the relevant NDIS Practice Standards
• whether you need a verification or certification audit.

You provide this document to your Approved Quality Auditor before your audit begins.

Registration requirements are designed to be proportionate. This means the evidence expected from an individual sole trader or small partnership delivering lower risk supports is different from the evidence expected from a larger organisation delivering more complex services.

Many sole traders and partnerships delivering eligible lower risk supports complete a verification audit. However, organisation type alone does not determine the audit pathway. The registration groups included in your application are also considered.

What are NDIS registration groups, and why do they matter?

Registration groups (also called classes of support) identify the NDIS supports your business is approved to deliver.

They also determine which type of audit you must complete.

Every registration group is assigned either a verification audit or a certification audit. Your Initial Scope of Audit confirms the registration groups included in your application and the audit pathway you must follow.

Importantly, if your application includes a registration group that requires certification, your application will require a certification audit.

Choose only the registration groups that match the supports your business genuinely plans to provide. Applying for unnecessary registration groups can increase your compliance obligations.

What is an NDIS verification audit?

A verification audit is a desktop assessment for providers delivering eligible lower risk supports.

The audit is completed by an Approved Quality Auditor, who reviews documentary evidence to confirm that your business meets the relevant verification requirements under the NDIS Practice Standards.

Providers completing verification are assessed against the Verification Module of the NDIS Practice Standards.

The Verification Module covers four outcomes:

• Human resource management
• Risk management
• Incident management
• Complaints management

Depending on your registration groups, the auditor may also review documents such as:

• business policies
• insurance documents
• worker qualifications
• professional registrations, where applicable
• complaints procedures
• incident management processes
• risk management documentation.

The exact evidence required depends on your registration groups and professional obligations.

What is an NDIS certification audit?

A certification audit is a more detailed assessment for providers delivering higher risk or more complex supports.

Certification audits consist of two stages.

Stage 1: Desktop audit

The auditor reviews your policies, procedures and supporting documentation.

This stage is completed before the onsite assessment.

Stage 2: Onsite audit

The auditor assesses how your organisation applies those systems in practice.

Depending on your registration groups, this may include:

• reviewing participant records
• reviewing worker records
• interviewing staff
• interviewing participants
• interviewing family members or carers, where appropriate
• observing service delivery
• visiting service locations
• reviewing governance and operational processes.

Stage 2 should occur within three months after Stage 1 is completed.

What does a certification audit assess?

Certification audits assess providers against the Core Module of the NDIS Practice Standards.

The Core Module includes areas such as:

• rights and responsibilities
• governance and operational management
• provision of supports
• the support provision environment
• support planning
• service agreements with participants
• quality management
• feedback and complaints management
• incident management
• risk management
• human resource management
• information management
• continuity of supports

Depending on the registration groups selected, providers must also meet one or more relevant Supplementary Modules.

Your Initial Scope of Audit identifies which modules apply to your organisation.

What does an Approved Quality Auditor look for?

The audit is not only about having written policies.

The auditor looks for evidence that your organisation follows the relevant NDIS Practice Standards in everyday practice.

Depending on your audit scope, the auditor may review:

• governance and operational systems
• participant rights and safety
• quality management processes
• worker recruitment, qualifications and training
• worker records
• participant records
• support planning and service agreements
• complaints management
• incident management
• risk management
• information management and record keeping
• evidence that policies and procedures are implemented consistently.

For certification audits, auditors also gather evidence through interviews, observations and onsite assessments.

Does certification mean your business is at higher risk?

No.

Certification relates to the level of risk associated with the supports you intend to deliver, not whether your organisation is unsafe.

Some NDIS supports involve more complex service delivery or higher risks for participants. These registration groups require a certification audit to demonstrate compliance with the relevant NDIS Practice Standards.

Is a verification audit easier than certification?

Verification is often described as a desktop audit because the auditor reviews documentary evidence off site.

Certification is more detailed because it combines a desktop review with an onsite assessment of how your organisation delivers supports.

Both audit types require preparation. Providers should focus on preparing evidence that matches their registration groups rather than trying to fit into a different audit pathway.

What happens after the audit?

Once the audit is complete, the Approved Quality Auditor prepares an audit report and submits it to the NDIS Commission.

According to the NDIS Commission:

• verification audit reports are submitted within up to 14 days after the audit is completed
• certification audit reports are submitted within up to 28 days after the audit is completed.

The report includes compliance ratings against the relevant NDIS Practice Standards.

If non-conformities are identified, they must be addressed in line with the NDIS Commission's requirements before registration can progress.

Can your audit type change later?

Yes.

If you apply to add new registration groups or change the supports your organisation provides, you may require another audit.

According to the NDIS Commission, registered providers may need an out of cycle audit when changing their registration during the registration period.

Providers completing certification are also generally required to complete a mid-term audit during their registration period, unless an exemption applies.

How should you prepare for your audit?

Preparation starts well before the audit begins.

A practical checklist includes:

1. Confirm your registration groups.
2. Review your Initial Scope of Audit.
3. Read the relevant NDIS Practice Standards.
4. Identify the modules that apply to your registration groups.
5. Gather the required policies and supporting documents.
6. Organise worker and participant records.
7. Make sure your documented processes match how your organisation actually operates.
8. Engage an Approved Quality Auditor.
9. Prepare staff and participants if an onsite audit is required.

Being organised helps the audit process run more smoothly and demonstrates your organisation's readiness for registration.

Which pathway is right for your business?

The correct pathway is the one assigned to your registration groups by the NDIS Commission.

Providers delivering eligible lower risk supports generally complete a verification audit.

Providers delivering higher risk or more complex supports complete a certification audit.

Rather than focusing on which audit is easier, focus on understanding your registration groups, preparing the required evidence, and meeting the relevant NDIS Practice Standards. Choosing the correct registration groups from the beginning can help reduce delays and make the registration process more straightforward.

Need help with your NDIS registration?

Getting ready for an NDIS verification or certification audit can feel overwhelming, especially if it's your first time applying.

Provider+ helps providers understand their registration requirements, prepare the right documents, and get ready for their quality audit. Whether you're applying for registration or adding new registration groups, our team is here to support you through the process.