NDIS Certification vs Verification Audit: Which Do You Need?

One of the most common questions from providers starting the registration process is: "Do I need a verification audit or a certification audit?"

It's a reasonable question, because the answer determines everything from how much you'll spend to how much of your time the audit will consume. Get it wrong and you'll either overprepare for something simpler than you expected, or find yourself scrambling when an auditor wants to visit your sites and interview your participants.

The short answer is that it depends on the supports you're registering to deliver. But that's not particularly helpful without understanding how the NDIS Commission categorises those supports and why they've set up two different pathways in the first place.

This guide breaks down both audit types, explains which registration groups fall into each category, and gives you a realistic picture of what each process actually involves.

The Core Difference

At its heart, the distinction comes down to risk. The NDIS Commission has categorised all 36 registration groups based on how much potential there is for things to go wrong if a provider doesn't meet quality standards.

Verification audits are for lower-risk supports. They're desktop reviews where an auditor assesses your documentation without ever visiting your premises. Think of it as a document-based assessment of your policies and procedures.

Certification audits are for higher-risk supports. They involve a two-stage process including on-site visits, staff interviews, and conversations with participants. The auditor doesn't just want to see that you have good policies on paper — they want evidence that those policies actually translate into practice.

Here's the key rule that catches a lot of providers out: if your registration includes even one high-risk support category, you'll need a certification audit for your entire organisation. You can't do a verification audit for some supports and certification for others. The highest-risk registration group determines your pathway.

Side-by-Side Comparison

Before we get into the detail of each pathway, here's a quick overview of the key differences.

Which Registration Groups Require Which Audit?

The NDIS Commission maintains a list of 36 registration groups, split roughly evenly between verification and certification pathways. Here are some of the most common ones in each category.

Notice that personal care supports appear in both columns. That's because there's a distinction between standard assistance with daily personal activities and high intensity daily personal activities. The latter involves things like complex bowel care, ventilator management, tracheostomy care, and subcutaneous injections — supports that require specific clinical competencies.

What Happens in a Verification Audit

Verification is the lighter-touch option. The auditor reviews your documentation remotely to assess whether you meet the verification module of the NDIS Practice Standards.

The process typically works like this: you engage an approved quality auditor, submit your documentation through their portal, and then wait while they review everything. They'll come back with questions if anything is unclear or missing, you'll provide additional evidence, and then they'll write their report.

What auditors assess

The verification module covers four outcome areas that all registered providers need to demonstrate.

Rights and responsibilities covers how you uphold participant rights, handle complaints and feedback, and maintain privacy and confidentiality. Auditors want to see that you've actually communicated rights to participants, not just written a policy about them.

Governance and operational management looks at how you run your business. They'll check your organisational structure, risk management approach, conflict of interest policies, and general governance arrangements.

Provision of supports focuses on your service delivery. Your service agreements should reflect participant needs and preferences. Your processes for transitioning participants in and out of your services should be clear and documented.

Support provision environment covers safety aspects — your work health and safety policies, incident management procedures, and how you handle emergencies.

What you'll need to submit

Every auditor's document request list varies slightly, but expect to provide policies covering participant rights, complaints handling, privacy, risk management, incident management, and work health and safety. You'll also need evidence of implementation — things like training records, incident registers, and de-identified examples of participant files.

For plan management providers specifically, you'll need to submit worker screening clearances, qualifications, and professional memberships for all staff delivering those services.

Timeline and cost

Verification audits typically take 2-4 weeks from submission to report, assuming you respond promptly to any clarification questions. The auditor submits their report to the NDIS Commission within 14 days of completing the audit.

Costs vary between auditors, so it's worth getting at least two quotes. The Commission doesn't set audit prices — approved quality auditors do. Some auditors offer fixed-price packages while others charge based on the scope of your registration.

What Happens in a Certification Audit

Certification is a more involved process with two distinct stages. The first is a desktop review similar to verification. The second involves auditors coming to your sites, interviewing your staff, and speaking with participants.

Stage 1: Desktop review

This stage is conducted remotely. The auditor reviews your documentation to determine your readiness for the on-site component. They're checking that your policies and procedures exist, make sense, and align with the NDIS Practice Standards.

If significant gaps are identified at Stage 1, you may need to address them before progressing to Stage 2. It's far better to resolve issues at this point than to have auditors discover them during site visits.

Stage 2: On-site audit

This is where certification audits diverge significantly from verification. Stage 2 must be conducted within three months of Stage 1, and it involves auditors physically visiting your operations.

During site visits, auditors will interview staff to assess whether they understand and follow your policies. They'll review participant records on-site. They'll observe your operations and physical environment. And they'll speak directly with participants about their experience of your services.

The participant involvement component uses an "opt-out" approach. This means participants are automatically included in the audit sample unless they specifically choose not to participate. The auditor will contact a selection of your participants and ask about their experience receiving supports from your organisation.

Standards assessed

Certification audits assess you against the Core Module of the NDIS Practice Standards, plus any supplementary modules relevant to the supports you deliver.

The supplementary modules cover specific high-risk areas. If you're delivering high intensity daily personal activities, you'll be assessed against that module. Behaviour support providers are assessed against the specialist behaviour support module. Early childhood providers have their own module, as do SDA providers and specialised support coordinators.

Timeline and cost

The full certification process typically takes 4-8 weeks. Stage 1 and Stage 2 must be completed within three months of each other. The auditor submits their report to the NDIS Commission within 28 days of completing Stage 2.

Costs are significantly higher than verification and vary widely based on your organisation's size, the number of sites you operate, and the complexity of your registration groups. A small provider delivering a single certification-level support might pay $3,000-$5,000. A larger organisation with multiple sites and complex supports could pay $15,000 or more.

The Mid-Term Audit (Certification Only)

There's one more thing certification providers need to know about: the mid-term audit.

If you've completed a certification audit, you're required to undergo a mid-term audit 18 months into your three-year registration period. This is a mandatory checkpoint to confirm you're still meeting the NDIS Practice Standards and haven't let things slip since your initial certification.

The mid-term audit reviews your governance and operational management standards, any standards where you had corrective actions required in your last full audit, and any additional modules you've added to your registration since then.

Most mid-term audits are conducted on-site, though some providers may qualify for a remote audit depending on their circumstances. The auditor will interview staff and participants, review records, and assess whether your day-to-day practice still matches your documented policies.

What happens if you don't complete it

This isn't optional. Failing to complete your mid-term audit when due is a breach of your registration conditions. The NDIS Commission can suspend, revoke, or cancel your registration if you don't meet this requirement.

Mark the date in your calendar now. Calculate 18 months from your registration approval date and start preparing at least a month beforehand.

What If You Have Both Types of Supports?

As mentioned earlier, it's worth emphasising because it trips people up: if your registration includes any certification-level supports, you do the certification pathway for everything.

You can't cherry-pick. A provider delivering both plan management (verification) and community participation (certification) undergoes certification. The full suite of NDIS Practice Standards will be assessed, including the core module and relevant supplementary modules.

This matters for business planning. If you're currently a verification-level provider considering expansion into higher-risk supports, understand that you're not just adding a service line — you're changing your entire compliance regime.

The NDIS Practice Standards Structure

To make sense of what you're being assessed against, it helps to understand how the NDIS Practice Standards are organised.

The Verification Module is a streamlined set of requirements for lower-risk providers. It covers the essentials: rights and responsibilities, governance and operational management, provision of supports, and the support provision environment.

The Core Module is more comprehensive and applies to all certification-level providers. It covers the same four areas as the verification module but goes into significantly more depth. There are more indicators within each outcome, and auditors expect more robust evidence of implementation.

Supplementary Modules layer on top of the core module for specific high-risk supports. These include modules for high intensity daily personal activities, specialist behaviour support, early childhood supports, specialised support coordination, and specialist disability accommodation. If you're registered for any of these, you'll be assessed against both the core module and the relevant supplementary module.

Making the Decision

If you're setting up a new NDIS provider business, the audit pathway question should influence your registration decisions.

Some providers deliberately start with verification-level supports to get established before expanding into higher-risk areas. This approach lets you build your compliance systems, refine your operations, and generate revenue before taking on the more intensive certification requirements.

Others jump straight into certification because that's where the demand is in their market. Personal care, community participation, and daily living support are bread-and-butter services for many disability providers, and they all require certification.

There's no universally right answer. It depends on your background, your team's capabilities, your local market, and how quickly you need to be operational.

Key Takeaways

The fundamental question is this: are any of your registration groups classified as higher-risk? If yes, you need certification. If all your groups are lower-risk, you need verification.

Verification is simpler and cheaper — a desktop review of your documentation, typically costing $900-$1,500, with no site visits or mid-term audit requirements.

Certification is more intensive — a two-stage audit with on-site visits, participant interviews, and a mid-term audit at 18 months. Costs range from $3,000 for smaller providers to $15,000+ for larger or more complex organisations.

If your registration includes both verification and certification supports, you do the certification pathway for everything.

Whichever pathway applies to you, the preparation advice is similar: make sure your policies are actually implemented, not just written. Document everything. Build compliance into your everyday operations rather than treating it as a three-yearly scramble.

Still not sure which pathway applies to your situation? Get in touch — the My Care CRM team is happy to help you work through it.