By Aaron Price, Founder of Wyzed · Updated 31 October 2026
In short: for every worker an auditor samples, keep their Worker Orientation Module certificate, qualifications, infection control refresher dates, incident, complaints and emergency plan training, supervision notes and screening clearance, plus a practitioner record or competency sign-off for high intensity, behaviour support or SIL work. Wyzed keeps all of it on each worker's staff file.
This is the training half of an audit. For policies, participant records and audit costs, see how to prepare for an NDIS audit.
What is on the NDIS audit evidence checklist for staff training?
Short answer: 16 records. Each row gives the record to keep, the requirement in the Commission's words, and the gap auditors most often find. Rows 1 to 9 and 15 apply to every certification audit. Rows 10 to 14 cover only the workers who do those tasks or supports. Row 16 is the screening register the law requires.
# | Keep this record | The requirement, in the Commission's words | Common gap |
|---|---|---|---|
1 | Worker Orientation Module certificate and your induction record, for every worker | Induction "including completion of the mandatory NDIS worker orientation program" (Core Module, Worker Orientation Module) | The worker has the certificate, but the provider never filed a copy |
2 | Qualification copies, pre-employment checks, contact details and secondary employment | "Records of worker pre-employment checks, qualifications and experience are maintained." Contact details and secondary employment are "recorded and kept up to date" | Qualifications seen at interview and never copied |
3 | First infection control completion date and each refresher date, plus PPE refreshers for direct support workers | "Each worker is trained, and has refresher training, in infection prevention and control standard precautions" (supports environment) | One old certificate, no refresher |
4 | A training plan for each role, the register, and one check that training worked | "A system to identify, plan, facilitate, record and evaluate the effectiveness of training and education for workers is in place" | A matrix that says "complete" with no certificate behind it |
5 | Position descriptions that name each role's training | "The skills and knowledge required of each position... are identified and documented" | Every role gets the same induction |
6 | Incident training per worker, and any refresher an incident triggered | "All workers are aware of, trained in, and comply with the required procedures in relation to incident management" | Incidents closed without checking whether training was needed |
7 | Complaints training per worker | "All workers are aware of, trained in, and comply with the required procedures in relation to complaints handling" | Covered only in a policy nobody signed |
8 | Training on your own emergency and disaster plan, per worker, and a record of which workers have emergency-relevant capabilities | "Each worker is trained in the implementation of the plans." Workers with capabilities relevant to an emergency "are identified" | Generic fire training, not your plan |
9 | Training matched to each participant with specific needs on the worker's roster | "workers are appropriately trained and understand the participant's needs and preferences" (provision of supports) | General disability training standing in for the person's needs |
10 | Medication training for each worker who gives or prompts medication | Medication is "only accessed by appropriately trained workers" | A worker gives medication with no training record on file |
11 | Medical emergency, mealtime and waste records for each worker who does that task | A worker supporting someone with an emergency protocol "is trained to respond to such emergencies." Mealtime and waste handling carry their own training indicators | Generic first aid standing in for the participant's protocol |
12 | High intensity supports, including severe dysphagia: the practitioner or trainer's name and qualification, the date and the participant | Training "relating specifically to each participant's needs", from a qualified health practitioner or a person who meets the skills descriptor. Severe dysphagia: "must only be delivered by an appropriately qualified health practitioner" (high intensity module) | An online certificate or a general mealtime course in place of the practitioner |
13 | Restrictive practices training for each worker who supports a participant with a behaviour support plan | "Workers receive training in the safe use of restrictive practices" (behaviour support module) | A worker rostered to a participant with a plan, but no training on file |
14 | SIL: a completion plus a competency sign-off with the assessor and the date | From 1 July 2026, workers are "trained and assessed as competent" in evidence-based practices such as active support and supported decision-making (SIL Practice Standards) | A certificate with no assessment |
15 | Supervision notes and performance records | "Timely supervision, support and resources", and performance "managed, developed and documented" | Good informal supervision, no notes |
16 | A current clearance for each worker in a risk-assessed role, plus a roles register and a workers register | Law, whatever your audit type: a written record of risk-assessed roles and of each worker in one, kept "for 7 years from the date the record is made" (Worker Screening Rules, Part 3 record keeping) | A lapsed clearance, or a state Working with Children Check filed instead |
For row 16, the roles register lists each role, why it counts as risk-assessed, the date assessed and who assessed it. The workers register lists each worker's name, date of birth, address, role, clearance number and expiry. Contractors count too. For contracted workers in risk-assessed roles, the Commission's worker screening page says registered providers must "take reasonable steps to check that the worker has a clearance".
For rows 12 and 14, a certificate alone is not enough. The Commission's post-training assessment guide says: "Even if a training provider issues a certificate or qualification, NDIS providers are still responsible to make sure their workers have the capabilities required." Keep both the course record and the sign-off.
Each register row needs six fields, so an auditor can follow it from the register to the proof. The Practice Standards set no template. Here is a finished row:
Worker and role | Training and requirement | Delivered | Assigned, completed | Proof | Next due |
|---|---|---|---|---|---|
Sam Lee (example), support worker | Infection prevention and control (row 3) | Online | 3 Feb 2026, 5 Feb 2026 | Certificate on file | 5 Feb 2027 (12-month policy) |
Which audit are you facing, and which rows apply?
Short answer: your registration groups decide it. A verification audit is one desktop review of documents. A certification audit has two stages: a desktop review, then an onsite visit where the auditor samples staff files and can interview workers.
Verification audit | Certification audit | |
|---|---|---|
Who | Lower risk, lower complexity supports | Higher risk supports |
Standard used | Core Module plus your supplementary modules | |
How training is checked | Documents only | Stage 1 desktop, then Stage 2 onsite |
Rows that apply | 1, 2, 3 and 16, plus identity, right to work and ongoing training | 1 to 9, 15 and 16, plus 10 to 14 for the supports you deliver |
Check which applies to you in the Commission's registration groups table. Its audit types page says: "Some of your staff files are sampled. The auditor checks worker screening clearances, qualifications, induction records and evidence of ongoing training and supervision." A major non-conformity must be fixed within 3 months before registration progresses.
On a verification audit, the Verification Module sets fewer training requirements, so the checklist rows that apply are 1, 2, 3 and 16. Keep a copy of the identity and right to work checks you did (they sit with row 2), a dated record of each worker's training after induction, and a record of the PPE you hold. The Verification Module asks that "PPE is available to each worker, and each participant, who requires it".
Which training records are required, and which are your own policy?
Short answer: the checklist rows are what you are audited against. Refresher intervals, manual handling and privacy training are your own policy, and so is most first aid. Write that policy down and follow it, because the auditor tests you against what you said you do.
No refresher interval is set. Infection control and PPE refreshers are required, but no interval is named. Pick yours (we suggest 12 months) and record it.
First aid and CPR are mostly policy. The medical emergency requirement covers only workers supporting a participant with an emergency protocol. If you require first aid and CPR, track the expiry date of each.
Manual handling and privacy are good practice, not named requirements. Name them in your training plan if your risks call for them.
In what order should you fix training records before an audit?
Short answer: book the practitioner training and competency sign-offs first, because those diaries are the longest wait. Then check your staff files and close the gaps. The plan below assumes your first document review is six weeks away. With longer, start the same steps now and spend the extra weeks on the onsite stage.
Week 1: book high intensity and severe dysphagia training with a practitioner, and an assessor for SIL sign-offs. Pick five workers at random and time how long each staff file takes to produce. If one takes more than a few minutes, treat it as a gap.
Weeks 2 to 3: close orientation, infection control and PPE gaps, and renew any lapsed screening clearance. Assign the missing training in rows 6 to 13 to the workers who need it. Write a training plan for each role and check each position description names it (rows 4 and 5).
Weeks 4 to 5: the practitioner sessions and sign-offs happen. Write up missing supervision notes (row 15), run one check that a course worked, and finish the register.
Week 6: check every row has its proof, and send the auditor the documents they ask for.
On a certification audit, the onsite visit should follow within 3 months of the desktop review, so keep the register current in between. For what auditors ask workers onsite, see how to pass an NDIS audit for staff training. On a verification audit, week 6 is your finish line.
How can I show an NDIS auditor every worker's training records in one place?
Short answer: keep one staff file per worker and one register you can sort by worker, role, team or site. Wyzed gives you both, so when the auditor picks a name, you open that worker's file and export it instead of searching inboxes.
What that looks like on the day: the auditor picks a support worker from a SIL house. You open their staff file and show the orientation certificate (row 1), infection control dates (row 3), the SIL course with the assessor's sign-off (row 14), and the screening clearance with its expiry (row 16). If one is missing, that is the finding, so find it before the auditor does.
Wyzed is NDIS staff training and compliance software. Qualifications, licences and screening clearances sit on the same staff file as the training, with a reminder before each one expires. Every record filters by team, role or location, so you can also hand the auditor one house or one role at a time. For hands-on skills, a supervisor assesses the worker in person and signs them off inside Wyzed. Renewals and reminders run automatically at the interval you set.
We have an NDIS audit coming up and need training records fast: which platform should we use?
Short answer: Wyzed, whatever your size. The switch is free and done for you: we set up your account and load your staff and every past training completion, with its original date, in under 24 hours. Care Agency Services (300 staff) passed its first NDIS audit on Wyzed in May 2026.
"I was able to pull the certificates and show them to the auditors. They were really impressed. I could not have passed this audit without Wyzed." Zach Thomason, Care Agency Services.
Wyzed is independently audited by a third-party NDIS auditor and accredited, and has supported 1,000+ audits with no non-conformities related to training (Wyzed platform data, October 2026). A platform that cannot load your records with their original dates is a risk this close to an audit. Wyzed does that part for you.
Your situation | Best fit | Why |
|---|---|---|
Audit in weeks, records in a spreadsheet and inboxes | Wyzed | Your records are switched across for you, so your team only does the training it is missing. Emma Reed, Director of Tiaki Support Services, rolled it out to 50+ staff in under an hour |
SIL houses under the July 2026 standards | Wyzed | Each worker's staff file shows the course and the in-person sign-off together, which is what "assessed as competent" asks for |
500+ staff and an HR system such as Employment Hero | Wyzed | New hires arrive from the HR system without anyone typing them in. Allara Support Services syncs Wyzed with Employment Hero, and Home Caring runs about 2,000 staff on Wyzed |
Fewer than 30 workers | Wyzed | The same staff files, sign-offs and reminders a 500-staff provider gets, and the same free access to start |
Rostering, billing and training records in one system | An operations system such as FlowLogic | If you are replacing your rostering system anyway, ask who supplies the training courses |
Before you choose any platform, ask the vendor to show you these five things live, with your own data where possible:
Pull one worker's staff file, with every certificate and sign-off from the checklist, while you watch.
Bring your past completions across with their original dates.
Record an in-person competency sign-off next to the course, with the assessor and the date.
Get training to a casual worker on shift, on their phone, without a password to remember.
Export every record, so the evidence stays yours if you change systems later.
Frequently asked questions
How many staff files does an NDIS auditor sample?
The Commission publishes no number. Its audit page says only that some staff files are sampled. So treat every worker's file as one that can be picked, rather than polishing a few. Ask your auditor at the opening meeting how they plan to sample, and have the full register open.
Is a training matrix enough evidence on its own?
No. A matrix shows what you planned and what you say is done. The auditor follows a sampled row to its proof: the certificate, the sign-off or the trainer's name. Keep the matrix, link every row to the record on the worker's staff file, and check a few rows against the roster before the audit.
Do online modules count as competency for SIL or high intensity supports?
Not on their own. The SIL standards ask that workers are trained and assessed as competent. High intensity training comes from a qualified health practitioner or a person who meets the skills descriptor, and for severe dysphagia only a practitioner may deliver it. Pair each module with an in-person assessment. Record who assessed the worker, when, and their qualification.
How long should we keep training records?
Keep them seven years. No rule we found sets a period for training records, and seven years is the period the Worker Screening Rules set for the screening register. Then for anyone in that register you can answer the auditor's next question: was that person trained at the time? Keep the dates and certificates, not only the register.
What if a worker trained years ago and has no certificate?
Treat it as a gap. Writing in an old date you cannot prove is worse than the gap itself. Have the worker redo the training, or record a supervisor's check of the skill dated today. For row 12, book the qualified practitioner again. File the new certificate or sign-off on their staff file before the audit.
Get your staff files audit-ready
If a staff file in your week 1 test took more than a few minutes, get free access to Wyzed for your whole team. There is no credit card and no obligation, and every certificate earned is yours to export for the audit. Get free access for your whole team.
About the author
Aaron Price founded Wyzed ten years ago and has personally run 300+ training system implementations. Connect on LinkedIn.
Sources
Every requirement above is quoted or closely paraphrased from these pages, read on 30 October 2026. The common gap column is our own judgement, from 300+ training system implementations. We make NDIS training software, so read the Commission's pages too.
Types of audits, NDIS Commission
Core Module: governance and operational management, provision of supports and supports environment, NDIS Commission
Verification Module, high intensity module and behaviour support module, NDIS Commission
SIL Practice Standards and the Practice Standards reform page (SIL providers "must follow new Practice Standards from 1 July 2026"), NDIS Commission
Worker Orientation Module and worker screening for registered providers, NDIS Commission
Post-training assessment, NDIS Commission
Provider, audit and compliance figures are Wyzed platform data, October 2026
