After the audit, who actually decides

Every provider comes out of the closing meeting wanting one word. Did we pass.

The scheme does not have that word. What it has is a rating against every applicable standard and every indicator under it, a report that goes through two reviews before it leaves the auditor, and a regulator who makes the actual decision and is not in the room. The closing meeting tells you what the auditor found. It does not tell you what happens next, and what happens next is where providers, and most of what is written for them, get it wrong.

The rating is per indicator, and it has four points

An approved quality auditor does not pass or fail a provider. They rate. Every standard in scope, and every quality indicator under it, gets one of four scores.

• 3, conformity with elements of best practice. The provider clearly demonstrates innovative, responsive practice and continuous improvement against that indicator.
• 2, conformity. The outcome is met, proportionate to the size and scale of the provider. This is the rating almost every real report is a wall of, and it is the one to aim for.
• 1, minor non-conformity. A gap that does not put participants at immediate risk. It takes longer to fix, and registration can continue while it is fixed.
• 0, major non-conformity. A serious gap. The provider has three months to close it, and registration does not progress until it is closed and re-audited.

A 3 is rare, and chasing it is a mistake. A report full of 2s is a good audit. A provider who spends the preparation window trying to demonstrate best practice in one area while a register sits empty in another has read the scale backwards.

The sequence, from closing meeting to decision

1. The closing meeting. The auditors present their findings and ratings, and explain any non-conformity. This is the end of the audit, not the outcome. Nothing said here is a decision, because the person who decides has not seen it yet.
2. The corrective action plan. For any 0 or 1, the auditor asks for a corrective action plan: what you will do, who owns it, by when, and what evidence will show it is done. A major non-conformity has three months. Unresolved ratings become open non-conformities and are followed up within set timeframes, by desktop or on site.
3. The draft report, for factual accuracy. The provider sees the draft and may correct facts: a wrong document title, a wrong date, an interview attributed to the wrong person. This is not a negotiation of the findings. Where the provider and auditor disagree, the disagreement is recorded in the report rather than resolved by it.
4. The technical review. A reviewer independent of the audit team checks that the report is accurate, complete and properly documents any disagreement. Only then does it leave the auditor.
5. Submission to the Commission. The report is submitted within about 28 days for a certification or mid-term audit, and about 14 days for a verification audit. Until this point the Commission has not seen it.
6. The decision. The Commission decides whether to register the provider, may request more information first, and may impose conditions on the registration. The auditor recommended; the Commission decides. Where a registration group has no current participants, the auditor's recommendation for that group is provisional certification rather than certification.
7. The cycle. Certification registration runs for up to three years, with a mid-term audit reported at around eighteen months, focused on governance and operational management plus any earlier problem areas. Verification registration runs up to five years with a renewal audit at expiry.

What the vendor versions get wrong

Search the question and the answers come back in the same four shapes. Each is wrong in a way that costs a provider something.

"Pass the audit"

Nobody passes. You are rated, indicator by indicator, and the ratings are what the Commission reads. A provider told they "passed" at a closing meeting can still receive conditions, or a request for more information, from a regulator who was never told anyone passed anything.

"The auditor certifies you"

The auditor recommends. The Commission registers. Approved quality auditors are accredited and monitored by JAS-ANZ on the Commission's behalf under the international conformity-assessment standard, ISO/IEC 17065, and the scheme is built so that the body doing the assessing is not the body making the decision. A vendor or auditor who tells you they can get you certified is describing a power nobody in the scheme holds.

"A non-conformity means you failed"

A minor non-conformity is a 1, and registration can continue while it is closed. It is a finding to be fixed on a plan, with an owner and a date. Treating it as a failure produces panic where a corrective action plan is what is needed. Treating a major non-conformity as a minor one produces the opposite problem, because that one does stop the clock.

"Provisional means you did not quite make it"

Provisional certification is what a registration group receives when there are no participants yet to observe being supported. It is not a lower grade. It is the auditor saying the system is there and the practice has not started, and the full check happens when there is practice to check.

Reading the report

A certification report has a fixed shape, and knowing it saves a day of reading.

Near the front sits the recommendation: which registration groups are recommended for certification and which for provisional certification. Then the summary rating table, every standard and every sub-outcome with its score. Then the part that matters: per-outcome findings, one block per indicator, each with the outcome statement, the rating, the evidence sighted, and a non-conformity block that reads N/A where there is none.

In one real report we have read, the evidence sighted against a single outcome, person-centred supports, ran to eleven documents, each named with its version number and date, plus staff interviews and the welcome packs reviewed. That is what a 2 looks like from the auditor's side: not one policy, but a fan of named, versioned artefacts that all say the same thing, and interviews in which people describe doing it.

The thirty days after

The temptation after a closing meeting is to wait for the letter. The better use of the time is short.

• Write the corrective action plan properly. Owner, date, and the evidence that will prove closure, for every 0 and 1. A plan that says "review policy" with no owner is a plan the auditor will follow up.
• Put every finding in the continuous improvement register. Not in an email thread. The register is what the mid-term audit opens, and a finding that appears there with a closure date and evidence is a finding that helps you next time.
• Correct facts in the draft, and only facts. Argue a rating and you get the disagreement recorded. Correct a wrong version number and you get a cleaner report.
• Start the mid-term file now. Division 2, governance and operational management, is what the mid-term concentrates on, and it is the division that decays fastest: minutes, delegations, the risk register, the conflict of interest register. Eighteen months is not long.

What we do not know

The rating scale, the corrective action plan, the factual-accuracy and technical reviews, the submission timeframes and the Commission's power to impose conditions are read from the scheme's own instruments and the Commission's published process. The three-year registration term and the eighteen-month mid-term are reported consistently by every approved quality auditor we have checked, but we have not read the mid-term basis from the Rules themselves, so that line is corroborated rather than verified, and we say so.

If the audit is still ahead of you, the two pieces to read next are what NDIS auditors actually look for and the documents a certification audit actually asks for.

Grade. `V` for the rating scale, the review sequence, the submission timeframes and the Commission's decision powers, against the NDIS (Approved Quality Auditors Scheme) Guidelines 2018, the Commission's published audit process and a real certification audit report. `C` for the three-year term and the eighteen-month mid-term, which are consistently reported by approved quality auditors and not yet read by us from the Provider Registration and Practice Standards Rules.

Imagery. Generated for this piece in the site's documentary grade. Nobody pictured is a customer, a participant or a worker at any provider.