Running an NDIS business in Australia means dealing with a lot of paperwork. The National Disability Insurance Scheme sets strict documentation requirements, and getting them wrong can cost you your registration, trigger a compliance audit, or leave a participant without the support they need. This guide covers every major NDIS business document Australian providers are expected to maintain, why each one matters, and what it needs to include.
Why documentation matters for NDIS providers
The NDIS Quality and Safeguards Commission audits registered providers against the NDIS Practice Standards. Documentation sits at the centre of almost every standard. Auditors don't take your word for how you deliver supports. They review records. A provider that delivers excellent services but keeps poor records looks identical to a provider that doesn't deliver at all, from a compliance standpoint.
Unregistered providers face fewer formal auditing requirements, but they still need solid documentation to protect themselves legally and to build trust with participants and plan managers. Good records also matter when something goes wrong. An incident report filed the same day an event occurred carries far more weight than a retrospective account written weeks later.
If you're still in the early stages of setting up, the 4-step guide to start a disability support business covers the compliance foundations before you reach the documentation stage.
Registration documents
Before you can deliver funded supports as a registered provider, the NDIS Commission requires a completed registration application. That application includes several supporting documents.
- Proof of business structure: Your ABN, your business name registration, and details of your legal entity type (sole trader, company, partnership, or trust).
- Key personnel declarations: Every person listed as a key personnel member must complete a declaration confirming they have no relevant criminal history and no prior findings against them under the NDIS Act.
- Evidence of qualifications: For certain support categories, registered providers must show that staff hold relevant qualifications. This varies by registration group.
- Worker Screening checks: NDIS Worker Screening Checks are mandatory for workers in risk-assessed roles. Keep copies of clearance records on file and track expiry dates.
Once registered, you'll also receive a certificate of registration. Store it. You'll need to produce it if a participant or plan manager asks for it, and you'll need to update it whenever your registration groups or conditions change.
Service agreements
A service agreement is the contract between your business and each NDIS participant you support. It isn't strictly required under NDIS rules, but the NDIS Commission strongly recommends one, and plan managers will often ask to see it before processing claims.
A well-drafted service agreement should specify the supports to be delivered, the price for each support (referencing the current NDIS Pricing Arrangements and Price Limits), the schedule of delivery, cancellation terms, and how either party can end the agreement. It should be written in plain language. A participant who can't understand their own service agreement can't meaningfully consent to it.
Review your service agreements whenever the NDIS price guide is updated. Claiming above the current price limit, even accidentally, is a billing breach.
Support delivery records
Every support you deliver needs to be recorded. Case notes, shift notes, and progress notes all serve this purpose. The format varies by provider, but the content should cover what support was delivered, when, for how long, who delivered it, and any relevant observations about the participant's wellbeing or progress toward their goals.
These records do three things. They form the basis of your invoicing (you can only claim for supports actually delivered). They demonstrate that supports align with the participant's NDIS plan. They create a chronological record that protects both the participant and your business if a dispute arises.
Don't wait until the end of the week to write up notes. Details get lost. The standard practice in most disability support organisations is to complete notes within 24 hours of each shift.
Incident management documents
The NDIS Commission requires registered providers to have an incident management system. That system must capture, assess, and respond to incidents, and it must produce records of each step.
An incident report needs to include the date, time, and location of the incident; a factual description of what happened; the names of anyone involved; immediate actions taken; and follow-up actions planned. For reportable incidents (a defined category under the NDIS Act that includes serious injury, abuse, neglect, and unexpected death), you must notify the NDIS Commission within specific timeframes. Serious incidents require notification within 24 hours. Others allow up to 5 days.
Keep a register of all incidents, not just reportable ones. Patterns in your register tell you where your systems need improvement, and an auditor will look at the register as evidence of your oversight culture.
Complaints management records
Every registered provider must have a complaints management and resolution system. When a participant, family member, or advocate raises a complaint, you need a record of it. That record must show the date the complaint was received, the nature of the complaint, how it was investigated, and what outcome was reached.
Complaints records don't just protect you during audits. They're also a feedback mechanism. A provider that receives 3 complaints about the same support worker in 6 months and does nothing about it is taking on real risk, both for participants and for its own registration.
Policies and procedures
The NDIS Practice Standards require registered providers to have documented policies and procedures across a range of areas. These aren't just documents you file and forget. They're the operational manuals your staff follow, and auditors will ask staff whether they know what the policies say.
Core policies every registered provider needs include:
- A safeguarding and abuse prevention policy
- A privacy and confidentiality policy (meeting obligations under the Privacy Act 1988)
- A risk management policy
- A medication management policy (if you deliver supports involving medication)
- An emergency and disaster management plan
Policies should be reviewed at least annually and updated whenever your services, staff, or relevant legislation changes. Date your versions. An undated policy document is a compliance liability.
Financial and billing records
NDIS providers claim payment through the myplace provider portal. Every claim you submit should be supported by a corresponding support delivery record. The NDIS Commission and the NDIA both have powers to audit billing, and fraudulent or incorrect claiming is treated seriously.
Keep invoices, payment records, and support notes together and matched to each participant and each service booking. Australian tax law also requires you to keep business financial records for at least 5 years. For NDIS-related records, many providers keep them for 7 years given the potential for delayed complaints or disputes.
If you're managing the financial side of your business for the first time, the 4 small business accounting tips for Australian business owners covers the core habits that keep your records audit-ready.
Staff and workforce records
Your workforce documentation is a distinct category from your participant records, but it feeds directly into your compliance position. You need to maintain records of each worker's employment or contractor status, their role, their qualifications, their Worker Screening clearance number and expiry date, and their completion of mandatory training (including NDIS orientation, abuse prevention, and any role-specific training).
If a worker's screening clearance lapses and they continue working in a risk-assessed role, your business is in breach of the NDIS Act. Set calendar reminders 3 months before each clearance expires.
Privacy and consent documentation
NDIS providers handle sensitive personal information. The Privacy Act 1988 applies, and the NDIS Practice Standards add requirements on top of it. Every participant should be given a privacy notice explaining what information you collect, how you use it, and who you share it with.
Consent forms are separate from privacy notices. You need documented consent before sharing a participant's information with third parties, before taking photographs or video of a participant, and before making certain decisions on a participant's behalf. Keep signed consent forms on each participant's file.
Keeping your document systems current
The NDIS is not a set-and-forget scheme. Price limits change, Practice Standards get updated, and the Commission issues new guidance regularly. Your documents need to keep pace. Build a review schedule into your business calendar: service agreements when the price guide is updated (usually annually), policies at least once a year, staff records continuously as things change.
A document management system, even a simple shared folder structure with clear naming conventions and version dates, is worth setting up properly from day one. Retrieving a specific incident report or a signed service agreement quickly during an audit is far less stressful when your filing is consistent.
The administrative load of running an NDIS business is real. But every document in this guide exists for a reason: to protect participants, to protect your staff, and to protect your business.