What evidence does an auditor or the regulator ask for under NDIS Practice Standards Module 6 3.1 to Module 6 3.5?

Documented risk management procedure covering work health and safety; Risk register with ratings, controls and review dates; Hazard or WHS incident reports and the actions taken; Current certificates of currency for professional indemnity, public liability and accident or workers compensation insurance; Insurance renewal register; Policy schedules showing cover matches the registration groups; Emergency and disaster management plan; Records of plan testing or review; Participant and worker communication plan for emergencies; Participant risk assessments rating reliance on the service and the i

Rules / NDIS Practice Standards and Quality Indicators

Practice StandardsNDIS Practice Standards and Quality Indicatorsndis-practice-standards--module-6-risk-management

Requirement

Module 6: Risk management

The Module 6 (verification) outcome risk management: every quality indicator the NDIS Practice Standards set for it (Module 6 3.1 to Module 6 3.5), what an auditor asks to see under each, the common gaps, and a free worksheet to fill in.

Clause

NDIS Practice Standards Module 6 3.1 to Module 6 3.5

Regulator

NDIS Quality and Safeguards Commission

Edition held

Rules Schedules 1 to 8, Compilation No. 6 (F2026C00527) and Quality Indicators Guidelines Compilation No. 3 (F2026C00528), in force 1 July 2026

Checked current

6 October 2026, Federal Register: both compilations are the latest version on 6 October 2026

Who it applies to

Registered NDIS providers for the supports assessed by verification, such as therapeutic supports by occupational therapists, physiotherapists, psychologists and speech pathologists. A practice also registered for a certification-assessed support keeps these obligations for its therapeutic supports: one certification audit assesses them (certification satisfies a verification requirement, Rules s 23), and the Core outcome named on this page covers the same ground.

Every clause in the standards library

NDIS Practice Standards and Quality Indicators on the standards library

Under review, not in force

The NDIS Commission's review of the Practice Standards (a proposed quality framework and changes to the standards and how they are assessed) is still being considered; nothing from it is in force.

When the practice is also audited by certification

The obligations on this page stay for the practice's therapeutic supports. One certification audit assesses them (certification satisfies a verification requirement, Rules s 23), and Core module: Risk management covers the same ground, so one set of evidence can serve both. Core module: Risk management.

Module 6 3.1Risk management (verification): documented WHS risk management systemsource

Requirement, our statement of the clause

The provider has a documented risk management system that effectively manages work health and safety risks and is proportionate to its size and scale and the scope and complexity of its supports.

Evidence that typically shows this

Documented risk management procedure covering work health and safety
Risk register with ratings, controls and review dates
Hazard or WHS incident reports and the actions taken

The NDIS Commission's verification documentation list names the work health and safety policies and procedures (its list).

Common gap to check

Risk register not reviewed since registration
Procedure copied from a template that does not match the services

Module 6 3.2Risk management (verification): appropriate insurance in placesource

Requirement, our statement of the clause

The provider holds appropriate insurance, including professional indemnity, public liability and accident insurance, at levels that match the supports it is registered to deliver and kept current.

Evidence that typically shows this

Current certificates of currency for professional indemnity, public liability and accident or workers compensation insurance
Insurance renewal register
Policy schedules showing cover matches the registration groups

The NDIS Commission's verification documentation list names certificates of currency for personal accident or workers compensation, public liability and professional indemnity insurance (its list).

Common gap to check

A certificate of currency expired at audit
Professional indemnity missing for a sole practitioner

Module 6 3.3Risk management (verification): emergency and disaster planning includedsource

Requirement, our statement of the clause

The provider's risk management system includes planning for emergencies and disasters, covering how participants will be kept safe and critical supports continued if an emergency or disaster disrupts services.

Evidence that typically shows this

Emergency and disaster management plan
Records of plan testing or review
Participant and worker communication plan for emergencies

Common gap to check

No emergency plan for supports delivered in participants' homes
Plan never reviewed or tested

Module 6 3.4Risk management (verification): regular risk assessments of reliance on servicessource

Requirement, our statement of the clause

Risk assessments are done regularly and consider how far participants rely on the provider's services for daily living and how disruption of those services would affect their health and safety.

Evidence that typically shows this

Participant risk assessments rating reliance on the service and the impact of disruption
List of participants prioritised for continuity if services stop
Risk assessment review dates in participant files

Common gap to check

Risk assessments do not address disruption of services
Assessments done once and never repeated

Module 6 3.5Risk management (verification): infection prevention precautions in all settingssource

Requirement, our statement of the clause

Standard infection prevention and control precautions are put in place in every setting where the provider delivers supports, including participants' homes, the community and the provider's own premises.

Evidence that typically shows this

Infection prevention and control procedure covering home, community and clinic settings
Hand hygiene and cleaning checklists
Outbreak management records where an outbreak occurred

Common gap to check

Infection control procedure covers only the clinic
No supplies for hand hygiene during home visits

Worksheet: what your practice holds, and where

Ref	Held (yes, partly, no, not applicable)	Where it is kept	Owner	Last reviewed	Next review
Module 6 3.1
Module 6 3.2
Module 6 3.3
Module 6 3.4
Module 6 3.5

Download the worksheet (CSV)Print the worksheet (A4)

Completing this worksheet records what your practice holds and where. It does not make a practice compliant or ready for audit, and it is not legal advice.

Related requirements

NDIS Practice Standards and Quality Indicators

Module 6 4.1Module 6: Complaints management
Module 6 5.1Module 6: Incident management
Module 6 6.1 to Module 6 6.5Module 6: Human resource management
Every page of this instrument

The same topic in other instruments (risk and insurance)

National Law s 129Practise only with appropriate professional indemnity insurance
Ahpra shared Code of conduct 7.1Risk management
Ahpra shared Code of conduct 8.4Insurance
Psychology Board Code of conduct 7.1Risk management
OT Board standards I-1 to I-7Occupational Therapy Board: Professional indemnity insurance
Physiotherapy Board standards I-1 to I-6Physiotherapy Board: Professional indemnity insurance
Psychology Board standards I-1 to I-7Psychology Board: Professional indemnity insurance

See every requirement for your practice See the specimen practice