Policy versus evidence: a policy says what you will do, evidence shows it happening

Registration asks for policies, and the policies get written. The Commission's own account of an audit day says how quickly the auditor moves past them: "Very quickly, the focus moves from what your policies say to what actually happens in practice."¹ The same page describes the second stage of a certification audit plainly: "The auditor will look at how you're implementing your policies and procedures."² And it is blunt about what the auditor is after: "They are looking for evidence that your systems are working, not just that they exist."³

This guide separates three things: what a policy proves, what implementation looks like on paper, and how operating effectiveness is tested on the day.

What a policy proves

A policy says what your organisation has decided to do and who is meant to do it. That matters, and the Commission expects those decisions to be yours. Where a provider has used purchased policies or a consultant, the application guidance says "the policies you provide must accurately reflect how your organisation will deliver NDIS supports."⁴ It also expects that responses "are specific to your organisation and are not a direct copy of purchased documents".⁵

The Practice Standards frame the quality management system the same way. The quality indicators say the system "defines how to meet the requirements of legislation and these standards."⁶ Defining how is the policy's job. Showing that it happened is a different job, and a different set of documents does it.

What implementation looks like

Implementation is shown by dated records that a policy generated. The quality indicators are written in that language throughout: records maintained, processes documented, plans reviewed. The Commission's own page explains that the indicators are what "auditors use to assess compliance with the NDIS Practice Standards and indicate how providers may show compliance."⁷

Three examples of that language. Human resource management asks that "Records of worker pre-employment checks, qualifications and experience are maintained."⁸ Information management asks for a system that "records each participant's information in an accurate and timely manner".⁹ Quality management asks that the system "has a documented program of internal audits relevant (proportionate) to the size and scale of the provider".¹⁰

A policy that says these things will happen does not show that they did. What shows it is a record with a date, a name and a result: an acknowledgement signed by a worker, a check completed on a day, a register entry, a review minute, an incident handled from report to close. The third indicator sharpens the distinction rather than softening it — what it asks for is itself a document, and a documented programme of internal audits is the plan; the audits it schedules are what the plan exists to produce.

How an auditor tests operating effectiveness

Operating effectiveness is the third layer. A record shows something happened once; effectiveness is whether the system keeps working, and the auditor scheme sets out how that is tested.

At Stage 2 the auditor "shall evaluate the effectiveness and implementation of the NDIS provider's systems in addressing all relevant modules or parts of the NDIS Practice Standards".¹¹ Four methods follow from the scheme's audit-reporting rules and its audit methodology annex. The last two of them rest on reporting duties the scheme scopes to the certification pathway: they apply "At the completion of the stage two audit conducted for the purpose of NDIS provider certification".¹²

• Sampling. "the principles of sampling apply to the review of documents, interview attendee selection and observations".¹³ Selection sits with the auditor, not the provider: "In every audit, approved quality auditors shall select participant files through random sampling in addition to stratified sampling".¹⁴ The same annex says: "Approved quality auditors shall not allow the provider to pre-select samples."¹⁵ A file the provider chose to show is not evidence about the files it did not.
• Interviews. "Approved quality auditors shall use interviewing to corroborate information such as how processes are implemented and their effectiveness."¹⁶ A worker who cannot describe the complaints procedure contradicts the policy that describes it.
• Triangulation. The certification audit report shall "demonstrate corroboration of evidence triangulated wherever possible from a variety of reliable sources".¹⁷ The record, the interview and the observation are expected to corroborate one another wherever possible.
• Rating by indicator. The same report shall "report attainment ratings against each outcome and indicator as determined at the time of the audit".¹⁸ Evidence is judged indicator by indicator, not folder by folder.

The Commission's case study of a certification audit says the same thing in plain words: "Policies alone were not enough; the auditors wanted evidence of implementation."¹⁹

Five policy-to-evidence pairs

The same pattern appears elsewhere in the core module. An emergency and disaster plan is not shown to work by existing; the indicator asks for "Mechanisms are in place for the governing body to actively test the plans, and adjust them".³¹ A dated test and the adjustments it produced are the evidence.

The evidence test

Before you file a document as evidence, ask five questions of it. If any answer is no, that gap is what sampling, interviews and triangulation are built to find.

• Dated. Does it show when the thing happened, not when the template was written?
• Named. Does it show who did it, and does that person's role match the policy?
• Traceable. Can you point from the record to the policy clause and the quality indicator it satisfies?
• Closed. Does it show the outcome, not only the start? An open incident, an unanswered complaint or an unreviewed risk is evidence of the gap, not of the system.
• Repeated. Is there more than one? The scheme samples, interviews and triangulates, so a single good example is not a working system.

The Commission's advice for working with your auditor includes the practical point: "keep records up to date to support audit evidence and decision making".³² Its account of an audit day lists what the auditor wants to see as "incident reports, complaints records, training logs, supervision notes - not just the policy itself".³³ Those are the documents a policy is supposed to produce. A policy that has produced none of them has nothing to show for its implementation, whatever its version number says.

What ProviderQMS does here

Policies, registers, worker checks and actions live in one workspace, and the people, checks, registers and reviews you link to a document sit beside it, dated. Home ranks what is overdue, expiring and due.

Sources

Each numbered line is the document or page a quotation above was taken from, with the date we opened it.

1. The quality audit process | NDIS Quality and Safeguards Commission
   Opened 27 August 2026.“Very quickly, the focus moves from what your policies say to what actually happens in practice.”
2. The quality audit process | NDIS Quality and Safeguards Commission
   Opened 27 August 2026.“The auditor will look at how you're implementing your policies and procedures.”
3. The quality audit process | NDIS Quality and Safeguards Commission
   Opened 27 August 2026.“They are looking for evidence that your systems are working, not just that they exist.”
4. Apply for registration | NDIS Quality and Safeguards Commission
   Opened 27 August 2026.“the policies you provide must accurately reflect how your organisation will deliver NDIS supports.”
5. Apply for registration | NDIS Quality and Safeguards Commission
   Opened 27 August 2026.“the responses in your application are specific to your organisation and are not a direct copy of purchased documents”
6. National Disability Insurance Scheme (Quality Indicators for NDIS Practice Standards) Guidelines 2018, s 13(1)
   Opened 27 August 2026.“The system defines how to meet the requirements of legislation and these standards.”
7. NDIS Practice Standards | NDIS Quality and Safeguards Commission
   Opened 27 August 2026.“that auditors use to assess compliance with the NDIS Practice Standards and indicate how providers may show compliance.”
8. National Disability Insurance Scheme (Quality Indicators for NDIS Practice Standards) Guidelines 2018, s 17(2)
   Opened 27 August 2026.“Records of worker pre-employment checks, qualifications and experience are maintained.”
9. National Disability Insurance Scheme (Quality Indicators for NDIS Practice Standards) Guidelines 2018, s 14(3)
   Opened 27 August 2026.“records each participant's information in an accurate and timely manner”
10. National Disability Insurance Scheme (Quality Indicators for NDIS Practice Standards) Guidelines 2018, s 13(2)
    Opened 27 August 2026.“has a documented program of internal audits relevant (proportionate) to the size and scale of the provider”
11. National Disability Insurance Scheme (Approved Quality Auditors Scheme) Guidelines 2018, s 15(1)
    Opened 27 August 2026.“shall evaluate the effectiveness and implementation of the NDIS provider's systems in addressing all relevant modules or parts of the NDIS Practice Standards”
12. National Disability Insurance Scheme (Approved Quality Auditors Scheme) Guidelines 2018, s 16(1)
    Opened 27 August 2026.“At the completion of the stage two audit conducted for the purpose of NDIS provider certification”
13. National Disability Insurance Scheme (Approved Quality Auditors Scheme) Guidelines 2018, Annex B.1
    Opened 27 August 2026.“the principles of sampling apply to the review of documents, interview attendee selection and observations”
14. National Disability Insurance Scheme (Approved Quality Auditors Scheme) Guidelines 2018, Annex B.7 (Random Sampling)
    Opened 27 August 2026.“In every audit, approved quality auditors shall select participant files through random sampling in addition to stratified sampling”
15. National Disability Insurance Scheme (Approved Quality Auditors Scheme) Guidelines 2018, Annex B.5(c)
    Opened 27 August 2026.“Approved quality auditors shall not allow the provider to pre-select samples.”
16. National Disability Insurance Scheme (Approved Quality Auditors Scheme) Guidelines 2018, Annex B.9 (Interviewing)
    Opened 27 August 2026.“Approved quality auditors shall use interviewing to corroborate information such as how processes are implemented and their effectiveness.”
17. National Disability Insurance Scheme (Approved Quality Auditors Scheme) Guidelines 2018, s 16(2)(c)
    Opened 27 August 2026.“demonstrate corroboration of evidence triangulated wherever possible from a variety of reliable sources”
18. National Disability Insurance Scheme (Approved Quality Auditors Scheme) Guidelines 2018, s 16(2)(f)
    Opened 27 August 2026.“report attainment ratings against each outcome and indicator as determined at the time of the audit”
19. The quality audit process | NDIS Quality and Safeguards Commission
    Opened 27 August 2026.“Policies alone were not enough; the auditors wanted evidence of implementation.”
20. National Disability Insurance Scheme (Quality Indicators for NDIS Practice Standards) Guidelines 2018, s 16(2)
    Opened 27 August 2026.“including how incidents involving the participant have been managed”
21. National Disability Insurance Scheme (Quality Indicators for NDIS Practice Standards) Guidelines 2018, s 16(3)
    Opened 27 August 2026.“review of the causes, handling and outcomes of incidents, seeking of participant and worker views”
22. National Disability Insurance Scheme (Quality Indicators for NDIS Practice Standards) Guidelines 2018, s 15(2)
    Opened 27 August 2026.“Each participant is provided with information on how to give feedback or make a complaint, including avenues external to the provider”
23. National Disability Insurance Scheme (Quality Indicators for NDIS Practice Standards) Guidelines 2018, s 15(4)
    Opened 27 August 2026.“All workers are aware of, trained in, and comply with the required procedures in relation to complaints handling.”
24. National Disability Insurance Scheme (Quality Indicators for NDIS Practice Standards) Guidelines 2018, s 17(3)
    Opened 27 August 2026.“An orientation and induction process is in place that is completed by workers including completion of the mandatory NDIS worker orientation program.”
25. National Disability Insurance Scheme (Quality Indicators for NDIS Practice Standards) Guidelines 2018, s 17(6)
    Opened 27 August 2026.“The performance of workers is managed, developed and documented, including through providing feedback and development opportunities.”
26. National Disability Insurance Scheme (Approved Quality Auditors Scheme) Guidelines 2018, Annex B.5(e)
    Opened 27 August 2026.“The workers sampled shall include workers in governance, management and service delivery roles”
27. National Disability Insurance Scheme (Quality Indicators for NDIS Practice Standards) Guidelines 2018, s 12(1)
    Opened 27 August 2026.“identified, analysed, prioritised and treated”
28. National Disability Insurance Scheme (Quality Indicators for NDIS Practice Standards) Guidelines 2018, s 12(5)
    Opened 27 August 2026.“Supports and services are provided in a way that is consistent with the risk management system.”
29. National Disability Insurance Scheme (Quality Indicators for NDIS Practice Standards) Guidelines 2018, s 20(4)
    Opened 27 August 2026.“Each support plan is reviewed annually or earlier in collaboration with each participant, according to their changing needs or circumstances.”
30. National Disability Insurance Scheme (Quality Indicators for NDIS Practice Standards) Guidelines 2018, s 20(3)
    Opened 27 August 2026.“Periodic reviews of the effectiveness of risk management strategies are undertaken with each participant”
31. National Disability Insurance Scheme (Quality Indicators for NDIS Practice Standards) Guidelines 2018, s 18A(5)
    Opened 27 August 2026.“Mechanisms are in place for the governing body to actively test the plans, and adjust them”
32. The quality audit process | NDIS Quality and Safeguards Commission
    Opened 27 August 2026.“keep records up to date to support audit evidence and decision making”
33. The quality audit process | NDIS Quality and Safeguards Commission
    Opened 27 August 2026.“incident reports, complaints records, training logs, supervision notes - not just the policy itself”