NDIS compliance software for Australian providers

Built around how the NDIS Commission actually assesses you

Registered providers are audited against the NDIS Practice Standards, and the NDIS Quality and Safeguards Commission oversees worker screening, reportable incidents and the Code of Conduct. Complys is structured the same way, so the work you do maps onto what an auditor and the Commission look for.

Registered providers, unregistered providers, and the audit you face

The NDIS Quality and Safeguards Commission regulates providers nationally. The NDIS Code of Conduct applies to every provider and worker, registered or not. On top of that, registered providers must meet the NDIS Practice Standards and are assessed by an approved quality auditor through one of two pathways. A verification audit is a lighter, largely desk-based assessment for lower-risk supports. A certification audit applies to higher-risk or more complex supports, for example specialist behaviour support, supported independent living or specialist disability accommodation, and is assessed against the Core Module plus the supplementary modules relevant to what you deliver, usually including an on-site audit and interviews. Which pathway applies depends on the registration groups you hold. Complys keeps the evidence organised for either pathway; it does not certify you or decide your pathway for you.¹

The NDIS Practice Standards, module by module

The Practice Standards are organised as a Core Module in four parts, rights and responsibilities; provider governance and operational management; provision of supports; and the support-provision environment, plus supplementary modules that apply according to the supports you deliver, such as High Intensity Daily Personal Activities, Specialist Behaviour Support, Implementing Behaviour Support Plans, Early Childhood Supports, Specialised Support Coordination and Specialist Disability Accommodation. You are only audited against the modules that apply to your registration, so the work should be scoped the same way. Complys records your readiness against the Core Module and the supplementary modules relevant to you, rather than a generic checklist.

Reportable incidents: what must be notified

Registered providers must run an incident management system and notify the Commission of reportable incidents that happen, or are alleged to have happened, in connection with the supports they provide. These include the death of a person with disability, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, sexual misconduct(including grooming), and the use of a restrictive practice that was not authorised or not used in line with a behaviour support plan. The categories above are generally notified to the Commission within 24 hours, with a fuller written report following within five business days. The unauthorised use of a restrictive practiceis generally reported within five business days, but within 24 hours where it resulted in harm. Confirm the current categories, timeframes and forms with the Commission, as the detail varies by circumstance. Complys helps you recognise when a notification may be needed and keeps a clean record of what was identified, investigated and when, but you make the notification to the Commission.² Incident reporting →

Regulated restrictive practices

The NDIS regulates five kinds of restrictive practice: seclusion, and chemical, mechanical, physical and environmental restraint. Using a regulated restrictive practice requires authorisation, and the authorisation rules genuinely differ by state and territory, together with a behaviour support plan developed by an NDIS behaviour support practitioner. Using one without proper authorisation is itself a reportable incident. Complys keeps records of the practices in use, their authorisation and the associated behaviour-support plans and reporting, organised and ready to produce, with the clear caveat that what counts as valid authorisation depends on your jurisdiction.

Worker screening, orientation and the Code of Conduct

Workers in risk-assessed roles need an NDIS Worker Screening Check clearance, a nationally recognised clearance renewed on a set cycle, and new workers are expected to complete the NDIS Worker Orientation Module (“Quality, Safety and You”). The Code of Conduct sets the standards of behaviour expected of everyone delivering supports. Complys tracks clearances, orientation, Code-of-Conduct acknowledgements, references and qualifications per worker with renewal reminders, so your workforce-suitability evidence stays current instead of surfacing as a gap at audit. Induction & training tracking →

The worker records the Verification Module expects

Workforce evidence is where the Practice Standards get concrete. The Verification Module refers to keeping records of a worker’s identity, Right to Work, pre-employment checks, qualifications and experience, orientation and continuing professional development, the evidence that the people delivering supports are who they say they are, are entitled to work, and are suitable and competent. Complys keeps those records per worker, current and ready to produce, with expiry reminders. To be clear about the boundary: Complys holds and organises that evidence, it does not perform identity verification or Right to Work checks itself. This is also where NDIS workforce compliance meets Complys’s wider worker-compliance tools.¹

Where NDIS compliance software helps, and where it doesn’t

Software will not run your service or make your notifications, and it cannot certify you. What it does well is remove the pre-audit scramble: keeping evidence against the right modules, worker screening and training, incident and restrictive-practice records, and safe-environment certificates current and in one place, with a readiness view you can trust on an ordinary day. If you also deliver aged care, see Aged Care Quality Standards software; for your wider duties, Complys also covers WHS compliance and contractor management.

¹ Plain-English summary, not legal advice; confirm the requirements for your registration and jurisdiction. Sources: NDIS Practice Standards and reportable incidents (NDIS Quality and Safeguards Commission). ² Notification categories and timeframes are set by the NDIS (Incident Management and Reportable Incidents) Rules; confirm current detail with the Commission. Reviewed September 2026.

NDIS compliance software, FAQs