Two days in August, inside a provisional certification audit

Most writing about NDIS audits is written before one, by someone who has not sat in it. This is written from inside the preparation for a real one, for a named provider, with their own people in the pictures.

Harmony Care support people in their own homes: cooking, gardening, getting out, the ordinary business of a week. In August 2026 they went into CPG provisional certification, conducted remotely over 18 and 19 August.

Everything below is about what that asked of them.

What the work actually looks like

It matters to say this first, because compliance writing has a way of turning a provider into a filing problem.

Harmony Care's week is someone repotting a plant with an older man who wants his garden back. It is two friends in a lounge room with a record player on. It is a kitchen bench and someone learning to cook the thing they like. None of that is what an audit examines directly, and all of it is what the audit is ultimately about.

The gap between those two things is the whole problem. An auditor cannot watch a year of good support. They can only read what was written down while it happened.

The situation

Harmony Care had documents. That was never the problem, and it rarely is.

What they had was a folder structure grown by accretion, in which nobody could answer the only question an auditor asks: show me the record, and show me what it hangs off. Policies existed. Whether a given policy was the current one, whether the register behind it was live, and whether either could be produced inside a minute, were open questions.

That is the ordinary condition of a provider approaching certification. It is not negligence. It is what happens when documents get produced to satisfy a requirement rather than to run an organisation.

What we actually did

Three things, in this order. None of them was writing a policy.

1. Mapped the folder, then mapped the gaps. Every document that existed, against every obligation that needed one. The output was not a report saying "you look good". It was a list of what was missing, published as one page their team could work from.
2. Rebuilt the document system so a document knows what it answers to. A locked letterhead, consistent IDs, and each policy, procedure, register and form carrying the standard it evidences. That is the difference between a folder and a chain.
3. Built the evidence chain as a walkthrough. One page tracing an auditor's likely question back through the document that answers it to the record that proves it. Not a dashboard. A path a human can follow while somebody is on a call asking.

The gaps that were real

The gap map found more than a dozen items. Most were cosmetic. Six were not, and they are worth naming because other providers will have them too.

Workforce evidence

Not the policy about screening. The evidence that screening happened, for each person, current at the date of the audit. The most common thing an auditor finds thin, because it decays continuously and silently as people join and leave.

Insurances

Current certificates, matching the entity name exactly, in date on the day. An expired certificate is a finding. A certificate in a former trading name is a slower, more annoying finding.

Registers

The running records themselves, which is what auditors open first and providers prepare last. If you read one other piece here, read what NDIS auditors actually look for.

A missing module log

One required log did not exist. Not out of date, not thin: absent. The kind of gap a folder review finds and a self-assessment never does, because a self-assessment asks whether you comply and a folder review asks whether the file is there.

An amount that had not been topped up

A financial obligation with a threshold, sitting below the threshold. Quiet, dated, entirely checkable.

An ABN in a document header

Wrong in the template, therefore wrong in every document generated from it. One character, propagated everywhere, and exactly the sort of thing that makes an auditor wonder what else was generated without being read.

That last one is the useful lesson. A templating system multiplies whatever you put in it, including mistakes.

What did not work

Two things, honestly.

The folder permissions cost real time. Of eight folders in the shared drive, only one was writable by us. Everything else had to be read, catalogued and handed back as a list rather than fixed directly. That is the correct security posture, and it is also friction, and we did not anticipate how much.

A gap map is not a fix. Publishing a list of what is missing feels like progress and is not. Harmony Care's own team still had to find the certificates, chase the screening records and top up the account, on top of the week they were already working. The tooling made it visible and legible. It did not do it.

What this does not claim

This piece deliberately stops short of an outcome.

The audit ran on 18 and 19 August. Rise prepared the evidence; the auditor recommends and the Commission decides, and neither of those is ours to report. When the outcome is confirmed and Harmony Care are happy for it to be stated, it will be added here with the date it was confirmed.

We would rather publish a case study with a missing ending than one with an invented one. A vendor claiming credit for a certification decision it does not control is exactly the kind of confident text nobody can trace.

Status. Published without a confirmed outcome. The result is not stated here because the Commission decides it and Rise does not. This piece will be updated with the outcome and the date it was confirmed.

Imagery. All Harmony Care's own photography and illustration. Nothing stock, nothing generated for this piece.

Grade. `C`. Drawn from work Rise performed and can evidence internally. The six gaps are as recorded in the pre-audit review of August 2026. No figure here is a measured before-and-after, because none was measured, and inventing one would fail the first test a reader applies.