Starting an NDIS business is exciting, until you hit the registration audit. Between the NDIS Practice Standards, worker screening requirements, and a document list that seems to grow every time you look at it, it’s easy to feel like you need a compliance consultant just to figure out where to start.
The good news is that a large chunk of the document preparation work — the policies, registers, and templates every provider needs — can be drafted with the help of an AI tool like Claude. Not as a replacement for proper compliance advice, but as a way to get from a blank page to a strong first draft in an afternoon instead of a month. Below is a plain-English walkthrough of what the audit actually involves, and at the end, a ready-to-use prompt you can copy straight into Claude to generate your own document set.
Verification or certification: which audit are you actually facing?
The NDIS Quality and Safeguards Commission runs two different audit pathways, and which one applies to you depends on the supports you plan to deliver.
- Verification audits are the lighter-touch option: a document review with no site visit, generally used for lower-risk supports such as therapeutic supports and standard support coordination.
- Certification audits are more involved: a two-stage process that includes an on-site visit, staff interviews, and direct observation of how you actually deliver supports. This pathway typically applies to higher-risk service types such as personal care, supported independent living (SIL), specialist behaviour support, and early childhood supports.
If you’re not sure which pathway applies to your services, that’s normal at this stage — it’s worth confirming against the current NDIS Commission registration group list before you apply, since the specifics do get updated from time to time.
What the Practice Standards actually ask for
Regardless of pathway, every provider is assessed against the NDIS Practice Standards Core Module, organised into a handful of outcome groups:
- Rights and responsibilities — person-centred supports, respect for individual values and beliefs, privacy and dignity, dignity of risk, and safeguarding against violence, abuse, neglect, exploitation, and discrimination.
- Governance and operational management — clear organisational structure, risk management, quality and continuous improvement, information management, financial management, and human resources (including worker screening).
- Support provision — assessment and planning, the support plan itself, how supports are actually delivered, managing transitions, worker knowledge and skills, and medication management where relevant.
If you’re registering for SIL, there’s an additional module covering the support environment — the physical and household environment participants live in, their health and wellbeing, and how transitions in and out of a home are managed. Other supplementary modules apply if you’re delivering behaviour support, early childhood supports, or a handful of other specialist services.
The single most common reason providers fail an audit isn’t a missing policy — it’s a policy that exists on paper but isn’t actually being followed. Auditors are looking for three things together: a documented system, records showing it’s been implemented, and evidence that it’s producing a decent outcome for participants. A beautifully written incident management policy with no completed incident register behind it won’t get you through.
The document set you’ll actually need
Stripped back to essentials, most new providers need to produce:
- A core policy suite: governance, risk management, quality and continuous improvement, privacy and information management, financial management, human resources, incident management, complaints management, a Code of Conduct, and safeguarding.
- Registers and records: incident register, complaints register, risk register, continuous improvement register, worker screening register, and a training/induction record.
- Participant-facing documents: a service agreement, an intake or referral form, a support plan template, consent forms, and a service exit or transition plan.
- Anything specific to your registration group: for example, a medication management policy and health plan template if you’re delivering SIL, or a behaviour support plan template if you’re registering for specialist behaviour support.
That’s a genuinely long list for someone setting up a business for the first time, which is exactly the kind of drafting work an AI assistant is well suited to help with.
Using Claude to draft the first version
Rather than asking Claude for a generic template one document at a time, it works better to give it one detailed prompt that interviews you about your business first — your structure, the supports you’re registering for, your likely audit pathway — and then generates the whole suite of documents tailored to what you told it, finishing with a self-assessment checklist mapped against the actual Practice Standards outcomes.
Here’s that prompt. Copy everything inside the box below into a new Claude conversation (Claude.ai, Claude Code, or Cowork all work — Cowork and Claude Code can generate real Word and Excel files rather than just text):
You are helping me prepare the full set of documents my new NDIS provider business needs to pass its NDIS Quality and Safeguards Commission registration audit. I am not an NDIS compliance expert, so guide me — don't just ask me to specify things I won't know.
Work through this in phases. At the end of each phase, show me what you've produced before moving to the next one, and let me correct anything.
PHASE 0 — Business profile
Ask me, one group of questions at a time (don't dump all of these on me at once):
1. Business name, ABN/ACN, business structure (sole trader, company, partnership, not-for-profit), state/territory, and whether I'm brand new or already trading informally.
2. Which NDIS supports/services I plan to deliver (e.g. support coordination, therapy supports, SIL/supported independent living, personal care, community participation, plan management, early childhood supports, behaviour support). If I'm not sure how these map to official "NDIS registration groups," ask me to describe what I'll actually be doing day to day and work out the likely registration group(s) with me.
3. Roughly how many staff/contractors I expect to have in the first year, and whether I'll deliver services personally or manage a team.
4. Whether I already know if I'll go through the "verification" or "certification" audit pathway. If I don't know, tell me — based on the registration groups from question 2 — which pathway is likely, and flag that this should be confirmed against the current NDIS Commission registration group list before I apply, since the specifics do change.
PHASE 1 — Compliance map
Based on Phase 0, give me a short plain-English rundown of:
- Which audit pathway applies (verification = document review only; certification = document review + on-site audit + interviews)
- Which NDIS Practice Standards modules apply to me (Core Module always applies; flag any supplementary modules — e.g. SIL, Specialist Behaviour Support, Early Childhood Supports — that apply to my specific services)
- A one-paragraph explanation of what "evidence" actually means for an NDIS audit (a policy on paper is not enough — auditors want to see the policy, records showing it's been followed, and an outcome for participants)
PHASE 2 — Core governance policy suite
Generate complete, ready-to-use draft policies (not just headings/outlines) covering the NDIS Practice Standards Core Module, tailored to my business details from Phase 0:
- Governance & Operational Management Policy (org structure, roles, conflicts of interest)
- Risk Management Policy + a starter Risk Register populated with likely risks for my service type
- Quality Management & Continuous Improvement Policy
- Information Management / Privacy & Confidentiality Policy
- Financial Management Policy (incl. NDIS claiming/billing controls)
- Human Resources Policy suite (recruitment, worker screening, induction, supervision, performance management)
- Incident Management Policy (incl. reportable incidents to the Commission)
- Complaints Management Policy
- Code of Conduct (aligned to the NDIS Code of Conduct)
- Safeguarding Policy (violence, abuse, neglect, exploitation, discrimination)
- Human and Legal Rights / Person-Centred Supports Policy
- Privacy consent and dignity of risk / supported decision-making policy
For each, briefly note which Practice Standard outcome it's evidencing.
PHASE 3 — Registers, forms, and records
Generate templates (as fillable tables/forms) for:
- Incident register
- Complaints register
- Risk register (if not already covered)
- Continuous improvement register
- Worker screening check register
- Policy/document control register (version numbers, review dates)
- Training and induction record
- Feedback form (participant/family facing)
- Incident report form
PHASE 4 — Participant-facing documents
Generate:
- Service Agreement template (plain-language, NDIS-compliant terms)
- Intake/referral form
- Support plan template (person-centred, goal-based)
- Consent form (information sharing, photos/media if relevant)
- Service exit / transition plan template
PHASE 5 — Supplementary module documents (only if relevant to me)
If my services from Phase 0 trigger any supplementary Practice Standards modules, generate the extra documents those modules specifically require — for example:
- SIL: household/tenancy agreement inputs, medication management policy, health and wellbeing plan template
- Behaviour support: behaviour support plan template, restrictive practice authorisation and reporting process
- Early childhood: family-centred practice policy, transition to school planning template
Tell me clearly if none of the supplementary modules apply to me.
PHASE 6 — Self-assessment and audit-readiness checklist
Produce a checklist mapping every Practice Standards outcome relevant to me against: (a) the document that evidences it, (b) whether I have it yet, (c) what "in practice" evidence I'll still need to collect once I'm operating (e.g. completed shift notes, signed plans) that a document alone can't provide.
PHASE 7 — Wrap-up
Give me a short list of things Claude cannot do for me and that I need a qualified person for: engaging an NDIS-approved auditor/quality auditor, final legal review of the Service Agreement and policies, confirming my exact registration group codes and audit pathway on the NDIS Commission Applications Portal, and setting up my PRODA account.
Throughout: if you have file-creation ability in this environment (Cowork/Claude Code), please build each document as an actual file (Word doc for policies, spreadsheet for registers/checklists) rather than just pasting text, and organize them into a logical folder structure I can hand straight to my auditor. If you're in plain Claude.ai chat without file tools, give me complete copy-pasteable text for each document instead.Drafting the documents is step one. Actually using them is what gets you through the audit.
Remember the point made earlier: the most common reason providers fail an audit isn’t a missing policy, it’s a policy that exists on paper but was never actually followed. Claude can get you a strong first draft of every policy, register, and template in an afternoon — but a folder of Word documents sitting on someone’s desktop doesn’t generate the “in practice” evidence an auditor is actually looking for. That only happens when the documents are live: being version-controlled as they’re updated, being filled in as registers rather than left blank, and being signed by the people they’re meant to apply to.
This is exactly the gap IndyForms is built to close. IndyForms has Claude built directly into the platform, so you can run the same kind of generation described above — forms, registers, and (soon) policies — without ever leaving it, and what comes out is already living inside the system that will keep it audit-ready, not a Word document you have to remember to import somewhere. From there, IndyForms keeps every policy under proper version control so you can always show an auditor which version was in force on a given date, turns your registers (incidents, complaints, worker screening, continuous improvement) into digital forms that staff actually fill in as things happen rather than backfilling before an audit, and handles the signatures — service agreements, consent forms, induction sign-offs — natively, so there’s a verifiable record that a real person actually agreed to or acknowledged each document.
It’s also worth knowing that IndyForms keeps all data hosted in Australia and doesn’t use your data to train any underlying model. For an NDIS provider, that matters in a very concrete way: participant records, incident details, and behaviour support information are sensitive, and it means your team can safely use the built-in Claude to draft reports, summarise case notes, or generate documents from that private data without it leaving the country or being absorbed into a model somewhere else. The result is that “audit-ready” stops being a scramble you do once a year and becomes the ongoing, unremarkable state of your business.
What this does — and doesn’t — replace
Run through the prompt above and you’ll come out the other end with a complete first draft of your governance framework, registers, and participant-facing paperwork, organised against the actual Practice Standards outcomes an auditor will be checking. That’s a genuinely useful head start.
What it doesn’t replace is the human judgement your registration still depends on: engaging an NDIS-approved quality auditor, having a solicitor or compliance consultant give your service agreement and policies a final look, confirming your exact registration group codes and audit pathway through the NDIS Commission’s Applications Portal, and actually running your business in a way that generates the “in practice” evidence — completed shift notes, signed plans, a real incident register — that no amount of drafting can substitute for. Treat the AI-generated documents as the scaffolding, and IndyForms as the system that keeps the building standing.
This post reflects the NDIS registration process and Practice Standards structure as published by the NDIS Quality and Safeguards Commission at the time of writing. Registration group definitions and audit pathway mappings are updated periodically, so always confirm current requirements directly with the Commission before submitting your application.