NDIS plan management provider: documentation checklist (2026)

Why documentation matters more in 2026

The NDIS Quality and Safeguards Commission's strengthened Practice Standards, progressively coming into force throughout 2025–2026, raise the bar for registered providers across all registration groups — including plan management (Registration Group 0100). Approved quality auditors now look beyond the existence of a policy and assess whether your documents are current, implemented, and traceable to real participant outcomes.

For plan management providers specifically, the financial-intermediary role creates an additional documentation layer: every invoice processed, every budget query handled, and every participant financial statement issued must be supported by a clear paper trail. Gaps in this trail are among the most common non-conformances found during certification and verification audits.

The documentation checklist

Work through each category below. For each item, confirm you hold a current, dated version that has been reviewed by an appropriate authority in your organisation and that staff can locate it on demand.

1. Registration and governance documents

• Current NDIS provider registration certificate (confirming Registration Group 0100 — Plan Management)
• Certificate of incorporation or relevant legal entity documentation
• Constitution, trust deed, or equivalent governance instrument
• Board or management committee meeting minutes for the most recent 12-month period
• Organisational chart showing accountability lines for plan management operations
• Key personnel declarations (including NDIS Commission notification of changes)
• Public liability and professional indemnity insurance certificates (current)

2. Practice Standards — plan management specific module

The NDIS Practice Standards include a specific module for plan management providers. Your evidence folder must demonstrate conformance with each outcome, including:

• Policy describing how participant financial goals are understood and actioned
• Documented process for receiving, checking, and paying invoices on behalf of participants
• Process for issuing participant statements of expenditure at agreed intervals
• Evidence of how participants are supported to understand their NDIS budget
• Records showing how plan management services are tailored to individual participant needs and preferences
• Conflict-of-interest policy and registers (particularly important where the organisation also delivers other NDIS supports)

3. Financial record-keeping

Financial accuracy is the core deliverable of plan management. Auditors will sample actual participant financial records and cross-reference them against your documented processes.

• Participant budget ledgers — one per participant, updated in real time or within a defined and documented timeframe
• Invoice processing log, including date received, date approved, and date submitted to NDIA for payment
• Evidence of invoice verification steps (checking provider registration, NDIS line item, reasonable and necessary alignment)
• Participant financial statements — archived for a minimum period consistent with your document retention policy and applicable law
• Written agreements (service agreements) with each participant describing the plan management service, fees charged, and participant rights
• Record of any overpayment identified and steps taken to recover or report it
• Process for handling invoices from unregistered providers (where permitted under participant plan type)

4. Code of Conduct and worker management

• Written Code of Conduct acknowledgement signed by every worker and subcontractor
• NDIS Worker Screening Check records for all workers in risk-assessed roles (clearance numbers and expiry dates)
• Worker screening policy, including how the organisation monitors expiry dates and manages workers pending clearance
• Recruitment and induction records demonstrating pre-employment verification steps
• Ongoing training register — including NDIS orientation module completion records
• Performance management policy
• Documented process for responding to allegations of worker misconduct

5. Incident management

Under the NDIS (Incident Management and Reportable Incidents) Rules, registered providers must maintain an internal incident management system and report certain incidents to the NDIS Commission within required timeframes.

• Incident management policy, including classification of reportable versus non-reportable incidents
• Incident register (dated entries, outcome and corrective action columns)
• Evidence of NDIS Commission notifications for reportable incidents (portal submission confirmations)
• Post-incident review records for significant events
• Staff training records specific to incident identification and reporting

6. Complaints management

• Complaints management policy that references the NDIS Commission as an external avenue
• Complaints register (dated, outcome recorded, closed-loop evidence)
• Easy-read or accessible complaints information provided to participants (evidence of provision)
• Annual review record of complaints data and any systemic improvements identified

7. Participant rights and engagement

The 2026 strengthened framework places heightened emphasis on rights-based practice. Auditors will look for evidence that rights are not merely stated but actively supported.

• Participant welcome pack including rights statement, complaints process, and privacy notice
• Privacy policy compliant with the Privacy Act 1988 and NDIS-specific consent requirements
• Consent forms — for information sharing, budget management, and plan-management service delivery
• Records showing participants were offered and understood their rights before service commencement
• Feedback mechanism evidence (surveys, review meetings, or equivalent)

8. Business continuity and risk management

• Risk register covering operational, financial, and participant-safety risks
• Business continuity plan addressing how participant financial management continues during disruption
• Cybersecurity and data-breach response plan (particularly relevant given participant financial data held)
• Document retention and destruction schedule

Audit-readiness: a practical approach

1. Map every document to an NDIS Practice Standard outcome. Create a simple cross-reference table so you can demonstrate coverage at a glance.
2. Date-stamp reviews. A policy with a review date of three or more years ago signals to an auditor that governance is not active. Schedule annual reviews as a minimum.
3. Conduct a file-walk with a new staff member. If they cannot locate your incident register within two minutes, your document management system needs work before the audit does.
4. Sample your own financial records. Pull five random participant ledgers and verify completeness, timeliness, and alignment with the service agreement before the auditor does.
5. Close the loop on complaints and incidents. Auditors consistently flag incomplete corrective-action entries. Every record must show what happened, what was done, and what changed.
6. Verify all worker screening checks are current. Create a recurring calendar alert for expiry dates — an expired clearance for a worker in a risk-assessed role is an immediate non-conformance.

Common non-conformances for plan management providers

Getting audit-ready before your next assessment

Pulling together documentation from scratch is time-consuming, particularly for smaller plan management providers who wear many hats. A structured compliance kit — covering every document category above with compliant templates already mapped to the Practice Standards — can compress weeks of preparation into days. The 136-document SIL compliance kit available at ndiscompliant.com.au includes plan-management-relevant policies, registers, and evidence templates that providers have used to prepare for and pass NDIS Commission audits.

Whether you use a kit or build your documents independently, the principle is the same: evidence must be real, current, and retrievable. Start with the checklist above, assign an owner to each category, set review dates, and treat audit preparation as an ongoing operational discipline rather than a pre-audit sprint.