Compliance Documentation Checklist

Essential documentation requirements for NDIS audits and maintaining compliance standards. This checklist is designed to help you walk into NDIS audits with confidence and maintain strong governance, safety and quality every day, not just at audit time.

Diversity Sync'd supports this work by keeping rostering, shift notes, incident reports and staff screening records in one system, so much of your evidence is organised, consistent and easy to find when regulators ask for it.

• Current organisational chart (including reporting lines and key roles)
• Constitution or governing rules (if applicable)
• Board/management meeting minutes (especially where risk, quality and incidents are discussed)
• Strategic plan and/or business plan
• Risk management framework and risk register

Policies and Procedures

Current versions of all policies and procedures, including:

• Governance and decision-making
• Code of conduct
• Conflict of interest
• Privacy and confidentiality
• Complaints and feedback
• Incident management
• Safeguarding and child safety (if applicable)

Documentation Management

• Document control register (version control, review dates, approval history)
• Evidence of continuous improvement (CI register, improvement logs, action plans and outcomes)

• Participant intake and registration forms
• Eligibility and referral documentation (where relevant)
• Signed service agreements (including schedule of supports and pricing)

Consent Forms

• General consent
• Consent to share information
• Consent for photos/media (if applicable)

Support Planning

• Participant risk assessments and risk management plans
• Participant support plans / care plans / behaviour support plans
• Participant goals and progress review records
• Communication plans (for people with communication support needs)
• Participant rights and responsibilities information (and evidence it was provided/explained)
• Evidence of participant involvement in decision-making (case notes, meeting records)
• Records of advocacy referrals or advocacy involvement (if applicable)

• Position descriptions for all roles (with responsibilities and required qualifications)
• Employment contracts and engagement documents
• NDIS Worker Screening, Blue Card/Working With Children Check, police checks (as applicable)
• Records of visa status and work rights (for workers on visas)

Qualification and Training Certificates

• Mandatory training (e.g. induction, NDIS Code of Conduct, incident reporting)
• Role-specific training (e.g. medication, restrictive practices, safe transfers)

Ongoing HR Documentation

• Induction records and onboarding checklists
• Supervision, coaching and performance review documents
• Rosters and timesheets linked to participants and services delivered
• Records of disciplinary actions (if any) and outcomes
• Workforce planning or staffing models (showing safe staffing levels)

• Incident management policy and procedure (aligned with NDIS and any state-based requirements)
• Staff training records for incident and reportable incident processes
• Incident report templates and examples (completed)
• Incident register (including type, severity, and date of incident)
• Evidence of reportable incidents being notified to the NDIS Commission (and state bodies if required)
• Investigations or root cause analysis (where applicable)
• Corrective and preventative action plans, with outcomes and sign-off
• Trends analysis reports (e.g. monthly or quarterly incident summaries)
• Evidence that incident learnings are fed back into policies, training and practice

• Shift notes / progress notes for each support delivered
• Attendance records (who attended, who provided support, where and when)
• Evidence that supports delivered align with service agreements and participant goals
• Support plans or care plans with regular review history
• Visit or contact logs (including phone/video contacts)
• Behaviour data and behaviour support plan implementation records (where applicable)

Restrictive Practices Documentation

• Authorisations
• Behaviour support practitioner plans
• Monitoring and reduction strategies

• Communication with families, guardians, plan managers or coordinators of support (where appropriate)
• Records showing culturally safe and person-centred practice (notes, meeting outcomes, feedback)

• The NDIS pricing arrangements in force when each support was delivered
• Invoices issued to participants, plan managers or the NDIA
• NDIS claims and remittance advice records
• Funding utilisation reports by participant (current and historic)
• Evidence of participant approval for any additional or changed charges
• Statements provided to participants or their representatives
• Reconciliation records (matching claims, payments and services delivered)
• Procedures for handling overpayments, refunds and disputed invoices
• Segregation of duties documentation (who approves, who claims, who reconciles)

• Work Health and Safety (WHS) policy and procedures
• Hazard and risk register (including environmental and client-related risks)
• Incident and injury records (for staff and participants)
• Emergency and evacuation plans for all sites and community-based services
• Fire and emergency drill records
• Equipment maintenance records (hoists, vehicles, medical devices, etc.)
• Manual handling and infection prevention and control training records
• Vaccination records where applicable (e.g. flu, COVID-19 if required by policy)
• Safe medication management policy and associated records (if providing medication support)

• Internal audit schedule and completed internal audit reports
• Quality improvement or continuous improvement (CI) register
• Corrective action plans and documented outcomes
• Participant feedback and satisfaction surveys
• Complaints register (including outcomes and learnings)
• Staff feedback mechanisms and survey results
• Evidence that feedback and audit findings are discussed in meetings (minutes, action lists)
• Evidence of policy updates driven by feedback, incidents or audit results

• Privacy and confidentiality policy (aligned with Australian Privacy Principles and NDIS requirements)
• Data retention and disposal policy
• Records of data breaches or potential breaches and responses
• Access control procedures (who can access what information and how this is controlled)
• Cybersecurity measures documentation (MFA, backups, encryption, etc.)
• Staff training records on privacy, confidentiality and cyber safety
• Participant consent regarding data sharing and communication preferences

• Contracts and service level agreements (SLAs) with third-party providers
• Due diligence records for contractors and key partners
• Evidence that third-party services align with NDIS quality and safeguarding expectations
• Records of monitoring or reviewing third-party performance
• Insurance certificates of currency (public liability, professional indemnity, etc.)