Who is checking? A family's guide to a provider's audit

Most of what is written about NDIS audits is written for providers. This is for the other side of the table: the parent, the sibling, the partner who is about to trust an organisation with someone they love, and wants to know who is checking on it.

The short answer is: an independent audit team, on a cycle, against published standards, and you can be part of it.

What an audit is, from where you sit

The NDIS Quality and Safeguards Commission does not audit providers itself. It approves auditors, and a provider engages one to be assessed. The audit team does not work for the provider and does not work for the Commission. They look at the provider's paperwork, its files, its procedures and its records. They talk to staff and managers. They talk to participants. They may ask to talk to family members.

They then report to the Commission on how the provider is doing, and the Commission decides on registration. A registered provider is audited on a cycle, with a mid-term check between full audits, so this is not a one-off.

The audit is not a test the participant sits. It is a test the provider sits, and the participant is one of the witnesses.

You can take part, and you do not have to

The provider must tell participants when an audit is coming and find out whether they want to be involved. Usually that is a consent form or a line in the service agreement. The audit team invites a mix of participants to talk. If your person is not invited and wants to be, tell the provider.

If they take part, they choose how: face to face, by phone or online. They can let the auditor see their file, or not. They can have a support person with them, a friend, a family member, an interpreter or an advocate, but not someone who works for the provider. The conversation usually takes about twenty minutes, in a private place they know, and what they say is confidential. They can stop at any time and they do not have to answer anything they do not understand.

The Commission publishes the kinds of questions an auditor asks. They are questions about the person's own experience:

1. How often do you talk about your support needs with your provider?
2. Are you happy with the supports provided?
3. How does your provider consider your needs and preferences?
4. What do you do if you are unhappy about your support?
5. Do you feel you are treated with respect?
6. Do you know what would happen if there was an emergency?

If you have ever wondered what "person-centred" is supposed to mean in practice, it is this. The auditor is checking whether the person can answer those questions for themselves, and whether the answers match what the provider wrote down.

What you can check without asking anyone

The provider is registered, and for what. The Commission keeps a public register of registered providers. A registration is not a blanket. It lists the classes of support the provider is registered for, and a provider delivering a support it is not registered for is a problem before anything else is. If your person's plan says supported independent living, the provider's registration has to say it too.

Whether the Commission has taken action against them. The Commission publishes a compliance and enforcement register listing the actions it has taken against providers and workers. It is a long list and most providers are not on it. Yours should not be either.

What the audit found. A provider is not obliged to publish its audit report, but you can ask. The most useful part of any report is the list of non-conformities, the things the auditor found did not meet the standard, and what the provider agreed to do about them by when. A provider that hands you that list without flinching is telling you something about itself.

What the audit does not do

It does not sit in the house every day. It samples: a number of participants chosen by the auditor, not by the provider, and a number of records for each. It looks at what the provider wrote down and whether that matches what people say happened. Between audits, the safeguard is the provider's own system for noticing when something goes wrong and doing something about it, and the Commission's complaints process, which you can use directly at any time.

So the question to ask a provider is not only "are you registered". It is "when something goes wrong on a Tuesday, what happens, who finds out, and how would I know". A good provider can answer that in a sentence, because they have a register where the Tuesday gets written down.

Why we are telling you this

Rise builds the system providers run their compliance on. Everything we ask a provider to keep, the policy, the procedure, the form filled in at the time and the register it feeds, exists so that the answer to your question is on paper before you ask it. The audit is the moment someone who has never met your daughter checks that on her behalf. We would rather you knew how.

Everything above is drawn from the NDIS Commission's participant fact sheets on audits and from the Provider Registration and Practice Standards Rules 2018. It is general information, not advice about a particular provider.