Almost every disability provider has a policy manual. Far fewer have one their workers have read, understood and could follow at 9pm when a participant has a fall or a family member raises a complaint. When policies sit in a folder and practice happens somewhere else, the gap shows up in incidents, audit findings and uncomfortable conversations with participants.
Good policies do the opposite. They give workers clear steps, protect participants and make audits far less stressful, because your records simply show what your team already does. At Angels Compliance and Training Services, we help NDIS and DVA providers across Australia build policy systems that match how they really operate. This guide explains what auditors expect, the core policies most providers need, and how to turn a template into documents your team will actually use.
What Auditors Expect From Your Policies
Registered providers are audited against the NDIS Practice Standards. The core module, which applies to every registered provider, is organised into four divisions: rights and responsibilities, governance and operational management, provision of supports, and the support provision environment. Within them sit outcomes such as risk management, incident management, feedback and complaints management, human resource management, continuity of supports and emergency and disaster management.
Supplementary modules apply on top of the core module, depending on what you deliver. They cover high intensity daily personal activities, specialist behaviour support, implementing behaviour support plans, early childhood supports, specialised support coordination, specialist disability accommodation and assistance with supported independent living.
The Practice Standards rarely say “you must have a policy with this title”. Instead, they describe outcomes and quality indicators, and auditors look for evidence that your systems achieve them. That is why your NDIS policy and procedures need to do three things at once: reflect the standards that apply to your registration groups, describe how your organisation genuinely works, and be backed by records that show the procedures being followed.
Auditors test all three. They read your documents, sample your records and interview workers and participants. A policy that promises monthly incident reviews only counts as evidence if your incident register shows those reviews happening.
Eight Core Policies Most Providers Need
Your exact policy set depends on your registration groups, but most registered providers need clear, practical documents covering these eight areas.
- Participant rights, privacy and dignity. This policy explains how you support choice and control, respect each participant’s values and beliefs, protect privacy and prevent violence, abuse, neglect, exploitation and discrimination. It should also explain how participants can access advocates.
- Incident management. Set out how workers respond to an incident, make people safe, record what happened and escalate it. Include which incidents must be reported to the NDIS Commission, who is responsible for reporting and how incidents are reviewed to prevent them happening again.
- Feedback and complaints management. Describe how participants, families and workers can raise concerns, how complaints are acknowledged, investigated and resolved, and how participants are told they can contact the NDIS Commission if they are not satisfied.
- Risk management. Risk management is one of the policies and procedures NDIS auditors look at early, because it shapes everything else. It should explain how risks to participants, workers and the organisation are identified, recorded in a risk register, controlled and reviewed.
- Human resource management. Cover recruitment, NDIS Worker Screening Checks, induction, training, supervision and performance. It should show how you make sure every worker is competent for the supports they deliver.
- Continuity of supports and emergency management. Explain how supports continue when a worker is sick, a roster falls through or an emergency such as a flood, bushfire or outbreak disrupts services. Include how participants with high support needs are prioritised and contacted.
- Information management. Describe how participant records are created, stored, shared and disposed of, who can access them and how consent is obtained. Progress notes, incident reports and service agreements all fall under this policy.
- Medication, mealtime and infection control. Where relevant to your supports, the Practice Standards include specific outcomes for managing medication, mealtime management and a safe environment, including infection prevention and control. These procedures need to match each participant’s plans from their treating professionals.
Templates Are a Starting Point, Not a Finish Line
Writing a full policy suite from a blank page takes a long time, and most providers don’t need to. Well-structured templates mapped to the Practice Standards give you a sound framework, consistent formatting and the right headings in the right places. They also help new providers avoid missing an outcome entirely, and they keep documents consistent as your organisation grows, because every new policy follows the same structure.
The risk comes when a template is treated as finished. Generic documents often describe roles you don’t have, systems you don’t use or services you don’t deliver. Auditors notice quickly, particularly when workers describe a different process in interviews. The NDIS Commission has also warned that applications containing the same or similar information to others can undermine the audit and suitability assessment process, so your documents need to describe your organisation and nobody else’s.
The providers who get the most from templates treat them like a well-built house frame. The structure is sound, but the rooms still need to be fitted out for the people who will live and work there.
Six Steps to Turn a Template Into a Working Policy
Whether you start from templates or rewrite existing documents, these steps help you build policies that hold up in practice and at audit.
- Map your scope first. List the supports you deliver and the registration groups they fall under, then confirm which supplementary modules apply. This tells you which policies you need and stops you writing documents for services you don’t offer.
- Make the language your own. Replace generic wording with your real job titles, reporting lines, software, locations and service types. If your policy says the “Quality Manager” reviews incidents, make sure that role exists and that person knows it is their job.
- Test every procedure against a real scenario. Even well-written NDIS policy templates can describe a process your team would never follow at 2am. Walk through a realistic situation, such as a medication error on a weekend shift, and check whether the steps make sense to the person who would actually be there.
- Build the forms and registers each policy relies on. Most policies depend on supporting tools, such as incident forms, a complaints register, a risk register and a training matrix. Make sure each one exists, is easy to use and is actually being filled in. Ask a worker to complete each form during training so you can spot confusing fields early.
- Train your team and record it. Introduce new or updated policies in team meetings or supervision, explain what changed and why, and keep a record that workers have read and understood them. Short scenario-based discussions work far better than asking staff to sign off on a long document.
- Set a review cycle and control versions. Give each policy an owner, a version number and a review date, and update it after incidents, complaints, audit findings or changes from the NDIS Commission. Remove old versions so nobody follows an outdated procedure by mistake.
How Angels Compliance and Training Services Can Help
Angels Compliance and Training Services is a compliance consultancy based in Gosnells, Western Australia, supporting NDIS and DVA providers across Australia. Our policy and procedure packages are editable Word and PDF documents, aligned with the NDIS Practice Standards and customised with your organisation’s name, logo, ABN and contact details.
Packages are organised to match the Practice Standards: a core module covering areas such as participant rights, incident management and feedback, plus modules for high intensity supports, behaviour support and restrictive practices, early childhood supports, specialist support coordination, specialist disability accommodation and supported independent living. Optional add-ons include staff training templates, a risk register and incident forms, and we provide updates when the NDIS Commission makes major changes.
Final Thoughts
Policies only protect participants when they are followed. Start with the Practice Standards that apply to your scope, use templates to save time without letting them speak for you, test each procedure against real situations and keep your documents alive through training and regular review. When your policies describe what your team genuinely does, audits become a chance to show good practice rather than a test of how well you can explain the gaps.
This article is general information for NDIS providers and is not legal or financial advice. NDIS rules and Practice Standards can change, and your obligations depend on your registration groups and circumstances. Always check current guidance from the NDIS Quality and Safeguards Commission before relying on anything described here.