What a CPG certification audit actually asks you for

Most guidance about certification audits describes how it feels. This describes what is asked for, in the order it is asked, taken from the auditor's own guide.

Harmony Care went through CPG provisional certification on 18 and 19 August 2026. Everything below is the general shape, with what caught them noted where it is useful.

Two stages, and they want different things

Stage 1 is about your templates. The main focus is your template documentation and your policies and procedures. Not evidence that you followed them yet, the documents themselves, and whether they match the current version of the applicable Practice Standards. Check the Specialist Modules on your scope of registration: if a module is in scope, its standards apply.

Stage 2 is about whether any of it happened. It is conducted on site, though parts may be remote, and it has four parts in this order:

1. The opening meeting. You can forward the link to anyone in your organisation who wants to join.
2. Interviews with staff and participants, or their representative.
3. File and document reviews, participant files and staff files, plus further business documentation.
4. The closing meeting.

If stage 1 raised findings, stage 2 also reviews whether you closed them.

The sampling plan is the thing people leave too late

Before stage 2, depending on how many participants you have, you must complete a participant sampling plan so the auditor can select the sample. The guide asks for it at least a week before your audit.

Two things follow from that, and both bite.

The sample is chosen by the auditor from your plan, not offered by you. And participant inclusion is opt-out: participants are in unless they decline, which means the consent conversation has to have already happened. That is not a form you can produce on the morning.

The business documentation they expect to open

This is the list, and it is longer than most providers expect. Have every one of these findable.

• Company registration showing owners and officers
• A business risk register or risk management plan, with strategies identified
• Delegation of authority register
• Meeting minutes: leadership, team and care team
• Conflict of interest register and form, including support coordination or plan management against other supports
• How PPE is obtained and provided to staff and participants
• Professional indemnity, public liability and accident insurance, including workers compensation
• Evidence of internal audits completed, and the schedule showing when they run
• Incident register
• Complaint register
• Business continuity plan
• A populated business emergency and disaster management plan, with its policies
• Infection control plan
• Medication management procedure, templates and staff competency training plans
• Waste management plan
• If you deliver registration group 0107, how you manage risk for participants living alone

Note the word populated. An emergency plan with the template's placeholder names still in it is not a plan.

Worker screening has specific, checkable steps

This is where preparation most often turns out to be thinner than people believed, because it decays quietly as staff join and leave.

What a risk-assessed role is

A key personnel role, or a role whose normal duties include direct delivery of specified supports to a person with disability, or one requiring more than incidental contact. You have to have formally identified and labelled which of your roles these are, and keep the record.

What that record must contain

Job title, position description, date of birth, NDIS check number, expiry date, any allegations of misconduct, and any interim bar or suspension.

The database step people miss

Log in to the NDIS worker screening database to obtain your employer ID. Then link every staff member in a risk-assessed role to their check. In the NDIS portal, select your account name, choose worker screening as the role, then the screened workers audit report on the left. Both registered and unregistered providers can apply for access.

You also need to state, in policy, whether you allow staff to work before a clearance has fully come through, and if you do, what supervision applies.

Templates only, no participant details

For the participant-facing set, they want your templates, tailored to your organisation and to the registration groups you are applying for. Not filled-in files.

Intake, privacy, service agreements for each relevant type including SIL and SIL in SDA, schedule of supports with description, volume and costs, support plan, transition plans, personal emergency plan, money and property consent, medication records, and where Module 2 or 2a applies, behaviour logs, behaviour support plans and restrictive practice protocols.

Service agreements need the practical clauses in them: cancellation terms, how a participant contacts the NDIS Commission to complain, and the National Disability Abuse and Neglect Hotline.

On the day

Be reachable. The guide is explicit that you should be available throughout, monitoring email and taking calls, because additional documentation gets requested case by case as the audit runs.

Documents go in a shared folder, or you give the auditor access to your client management system. Do not email them.

What actually caught one provider

Harmony Care's pre-audit review turned up more than a dozen items. Most were cosmetic. Six were not, and they are the ones worth checking against your own set.

Workforce evidence, current at the date of the audit rather than at some point in the past. Insurance certificates matching the entity name exactly. The registers themselves, which is what gets opened first and prepared last. One required log that did not exist at all rather than being out of date. A financial threshold sitting below its threshold. And an ABN wrong in a document header, therefore wrong in every document generated from that template.

That last one is the transferable lesson. A templating system multiplies whatever you put into it, including a typo nobody read twice.

The honest part

Preparation makes evidence findable. It does not make an audit go away, and nobody can prepare on your behalf: the certificates still have to be found, the screening records still chased, the account still topped up, on top of the week you were already working.

The auditor recommends. The Commission decides. Anyone telling you otherwise is selling something.

Source. CPG, Guide for Your NDIS Certification Audit, Iss1 Rev3 (`V`). Requirements are summarised in our words, not reproduced; if you are preparing for an audit, get the current issue from your own auditor, because it is revised. The worked example is Harmony Care's pre-audit review of August 2026 (`C`), and no audit outcome is stated here because that is the Commission's to give, not ours to report.

Imagery. Harmony Care's own photography and illustration. Nothing stock, nothing generated.