Post-audit dirty laundry

During the recent DSC Quality and Safeguarding conference, NDIS Commissioner Tracy Mackey posed a question to providers: “What is stopping you from getting registered?”

If you are a provider registering for the first time, preparing for a mid-term audit, or deliberating the pros and cons of registration renewal, you might have questions about the process. I can provide answers based on our recent NDIS registration audit experience. Of course, your experience will differ based on your circumstances.

Are you curious to know how much the audit cost, how much work it entailed, and what happened when the auditor picked up our mistakes? I am here to spill the tea, dish the dirt, and air the dirty laundry from our recent NDIS registration renewal audit.

Quick facts

• I am the sole owner and director of a small support coordination organisation based in Newcastle, NSW, with 8 casual staff.
• We provide level 2 and level 3 support coordination to around 80 participants with the following funding split: NDIA-managed (80%), plan-managed (10%), self-managed (10%).
• We don’t have a dedicated quality department, so getting ready for audit rested almost entirely – if reluctantly – with me.

Registration groups and pathways

The services we provide correspond with two registration groups:

• 0106 Assistance in Coordinating or Managing Life Stages, Transitions and Supports (Level 2 Support Coordination)
• 0132 Specialised Support Coordination (Level 3 Specialist Support Coordination)

Support coordination is considered higher risk and/or high complexity, so we followed the certification audit pathway. Providers of lower-risk and less complex supports and services can complete a verification audit. If you are not sure which auditing modules you will need to meet, use this tool to decide.

Registration process

The NDIS Commission website outlines the 5 steps to becoming a registered provider:

In reality, registration is a 10-step cycle that repeats every three years:

The benefits of being a registered NDIS provider

Providers who have successfully completed registration can use the title Registered NDIS provider. Registered providers can

• support participants with NDIA-managed funding
• use the NDIS Provider Portal to make service bookings, submit payment requests, receive requests for service, and access shared participant plan information. Note: a new and improved NDIS portal, PACE, is being trialled in Tasmania with enhanced access for unregistered providers: find out more here
• be found (or lost) among the 4,000 pages of the NDIS provider finder
• accompany the “I/we heart the NDIS” and “I/we support the NDIS” logo with the tagline ‘Registered NDIS provider’

Some supports can only be provided by a registered provider, such as Specialist Positive Behaviour Support (0110) and Specialist Disability Accommodation (0131).

The cost of being a Registered NDIS provider

One possible barrier to registration is the cost of audit. Providers pay to engage an external approved quality auditor, and auditors quote based on the Initial Scope of Audit (ISoA) generated by the online self-assessment:

• quotes for our Stages 1 & 2 combined ranged from $6,000 (minimum) to $12,000 (maximum)
• one quote included a mid-term audit for an additional $6,000, for a total of $18,000 for the 3-year audit cycle
• auditors also charge for travel and accommodation to complete the Stage 2 site audit, but we chose a local audit and avoided this extra expense

Note: the cost of engaging an external auditor increases for larger organisations with multiple outlets who employ more staff and support a greater number of participants.

Hidden costs of registration

The quotes above don’t capture the hidden costs of registration: namely, the hundreds of unbillable hours devoted to

• creating, reviewing, and updating policies, procedures, and documentation
• creating and maintaining registers, records, risk assessments, and support plans
• training staff in current (and new) policies, procedures, and practice standards
• rostering staff to be available for interview during the Stage 2 site audit

Beware: Practice standard change

I optimistically joked with the auditor that “we passed our last mid-term audit so surely we will get through this one”. The auditor did not find that funny and reminded me that the NDIS Practice Standards were recently updated, so passing a previous audit was no indication of the likelihood of passing the current audit. With those new standards in mind, here are some of the changes we made to prepare:

• Policies and procedures were updated to outline emergency and disaster management responsibilities and a new register to note emergency preparedness testing, staff training in emergency, and disaster management protocols
• Service agreement amended to include a clause about how supports would continue in times of emergency and disasters and then further amended to insert an exclusion clause noting that we don’t prepare meals and or handle money for participants
• Support plan template updated to expand section related to risk assessments and mitigation strategies, emergency contingency plans, and evidence of collaboration with participants and nominees

Response to minor non-conformities

Receiving non-conformities at the Stage 1 audit triggered all the predictable emotions, including shock, disappointment, and fear. Here are the details of our non-conformities and the steps we took resolve them prior to the Stage 2 audit:

Practice Standard: Human Resource Management

Outcome: Each participant’s support needs are met by workers who are competent in relation to their role, hold relevant qualification and have relevant expertise and experience to provide person-centred support

Quality Indicator: Records of worker pre-employment checks, qualifications and experience are maintained

Result: Minor non-conformity (1)

Reason for non-conformity: out-of-date documents from 100-point ID check and expired Working with Children Clearance (WWCC)

Response:

• collect and record updated 100-point ID information
• update WWCC check
• invest in new Compliance Management System to track expiry dates

The non-conformity finding made clear that our previous system of maintaining staff records was too static. We invested in a compliance management system that flags when documentation expires. Given the modest outlay of $400, my only regret is that we didn’t do it sooner. However, the new system carried hidden costs in the form of hours spent furiously populating the data on 40 new registers a month away from our Stage 2 audit.

Please note this was the feedback I got from MY auditor. It was their interpretation of the requirements but I have since received feedback that 100 points of ID may not necessarily be required to comply with the standards so do your own research!

Practice Standard: Violence, Abuse, Neglect, Exploitation or Discrimination

Outcome: Each participant accesses supports free from violence, abuse, neglect, exploitation or discrimination

Quality Indicator: Each participant is provided with information about the use of an advocate (including an independent advocate) and access to an advocate is facilitated where allegations of violence, abuse, neglect, exploitation or discrimination have been made

Result: Major non-conformity (0)

Reason for non-conformity: Abuse prevention policy does not contain information about the use of an advocate, including an independent advocate. Reportable Incident Summary in Participant Welcome Pack also does not include advocacy for allegations of abuse

Response:

• Update Abuse Prevention Policy and Procedure to include reference to advocacy
• Update Participant Welcome Pack to include reference to advocacy
• Train staff in updated policies, procedures and documentation and record in the minutes of the team meeting
• Revisit previous staff training abuse prevention and how to respond if detected, including referring to an advocate

The lesson we learned from receiving this major non-conformity was just how carefully you need to read the Practice Standards and Quality Indicators and incorporate them into policies and procedures.

We care deeply about abuse prevention. Our team has completed training in recognising and responding to violence, abuse, neglect, exploitation, and discrimination. Our case notes show that we refer participants for disability advocacy, which is located just one floor above our office. However, our Abuse Prevention Policy and Participant Welcome pack didn’t explicitly outline when and how we refer to advocacy, so we needed to update them in order to meet the practice standards. Lesson learned!

Tip: Remember the registration renewal window

The window for registration renewal opens in the 6 months prior to the 3-year anniversary of registration. As there are only 19 approved quality auditing firms to audit all the providers in Australia, they may not have capacity to meeting your audit timeframe if you leave registration renewal to the last minute. Diarise your key registration dates, start the online self-assessment, seek an ISoA, and start contacting auditors as soon as your registration renewal window opens.

To be or not to be: That is the question

Support coordinators do not need to be registered providers, and there is no pricing differential between registered and unregistered providers. Our decision to renew registration followed a period of considerable deliberation, and we were tempted to de-register. So why did we renew? I put it down to a combination of several factors:

• mistaken optimism
• an inability to accurately estimate the time and cost involved
• an unwillingness to make our participants submit a Change of Situation to have their NDIA-managed support coordination budget switched to plan or self-managed just because we were not registered

Now that we are on the other side, registration renewal has provided

• a deeply satisfying feeling of smugness
• documentary evidence that we are doing things right
• the ability to continue to support our participants with NDIA-managed support coordination budgets
• permission to keep using the “I/we heart the NDIS” logo, even though I would officially like to update our relationship status to “It’s complicated”.

Will we do it again? I can’t answer that right now – ask me in February 2024 when the pain has worn off and our mid-term audit is due.