Allied Health NDIS Audit Checklist: worksheet
NDIS Practice Standards and Quality Indicators. Edition held: Rules Schedules 1 to 8, Compilation No. 6 (F2026C00527) and Quality Indicators Guidelines Compilation No. 3 (F2026C00528), in force 1 July 2026; checked current on 6 October 2026 (Federal Register: both compilations are the latest version on 6 October 2026).
Under review, not in force: The NDIS Commission's review of the Practice Standards (a proposed quality framework and changes to the standards and how they are assessed) is still being considered; nothing from it is in force.
Standards library: https://compliance.theartofservice.com/frameworks/australia-ndis-practice-standards-and-quality-indicators. Page: https://allied-health-ndis-audit-checklist.theartofservice.com/rules/ndis-practice-standards/core-risk-management/
| Ref | Requirement (our statement of the clause) | Evidence an auditor or the regulator asks for | Common gap to check | Held (yes, partly, no, not applicable) | Where it is kept | Owner | Last reviewed | Next review |
|---|---|---|---|---|---|---|---|---|
| Core 10.1 | Risks to the organisation, including risks to participants, financial and work health and safety risks, and risks from providing supports, are identified, analysed, prioritised and treated. Source: https://www.legislation.gov.au/F2018L00631/latest/text | Risk register rating likelihood and consequence with treatments and owners; Participant risk assessments linked to the organisational register; Work health and safety hazard register | Register lists risks but no treatments or owners; Participant-level risks not considered at organisational level | ☐ yes ☐ partly ☐ no ☐ n/a | ||||
| Core 10.2 | A documented risk management system is in place that effectively manages identified risks and is relevant and proportionate to the provider's size and scale and the scope and complexity of its supports. Source: https://www.legislation.gov.au/F2018L00631/latest/text | Risk management policy and framework document; Records of periodic risk register review and sign-off; Risk reports to the governing body | Generic purchased template not adapted to the provider's supports; No evidence the system has been reviewed | ☐ yes ☐ partly ☐ no ☐ n/a | ||||
| Core 10.3 | The risk management system covers each of: incident management; complaints management and resolution; financial management; governance and operational management; human resource management; information management; work health and safety; and emergency and disaster management. Source: https://www.legislation.gov.au/F2018L00631/latest/text | Risk register or framework mapped to all eight areas; Policies for each area cross-referenced from the risk framework; Most recent review of each area's risks | Emergency and disaster or information management risks missing from the register; Financial management risks not assessed in a small provider | ☐ yes ☐ partly ☐ no ☐ n/a | ||||
| Core 10.4 | Where relevant to its supports, the provider's risk management system includes measures to prevent and control infection and outbreaks. Source: https://www.legislation.gov.au/F2018L00631/latest/text | Infection prevention and control policy and outbreak management plan; PPE stock and supply records; Records of outbreak response or exercises | Outbreak plan written during a past pandemic and never updated; No PPE stock plan for home-based supports | ☐ yes ☐ partly ☐ no ☐ n/a | ||||
| Core 10.5 | Supports and services are actually delivered in line with the risk management system, so the controls written in it are followed in practice. Source: https://www.legislation.gov.au/F2018L00631/latest/text | Spot check or supervision records verifying risk controls on shift; Participant files showing risk plan actions carried out; Internal audit findings on risk controls | Risk controls on paper not followed by casual or agency workers; Participant risk plans not available to workers on shift | ☐ yes ☐ partly ☐ no ☐ n/a | ||||
| Core 10.6 | The provider holds appropriate insurance, including professional indemnity, public liability and accident insurance, for the supports it delivers. Source: https://www.legislation.gov.au/F2018L00631/latest/text | Current certificates of currency for professional indemnity, public liability and accident or workers compensation cover; Insurance schedule showing the covered activities match registered supports; Renewal tracking records | Policy lapsed or excludes some registered supports; Sole traders relying on a subcontractor's insurance | ☐ yes ☐ partly ☐ no ☐ n/a |
Completing this worksheet records what your practice holds and where. It does not make a practice compliant or ready for audit, and it is not legal advice.