Is Your Plan Management Business Audit-Ready? The 2026 NDIS Audit Checklist

An audit-ready plan management business can show, within days of being asked, the evidence behind every claim it has paid: the provider's invoice, the service agreement, proof the support was delivered, how it fits the participant's plan, and the checks it ran before paying. Plan managers face two kinds of audit. The NDIS Quality and Safeguards Commission audits your registration, and the NDIA audits individual claims through payment integrity audits.

The new NDIS laws passed on 19 August 2026 make both matter more. Records now have to be kept for 7 years, the window to claim drops to 90 days from 1 December 2026, and from October 2027 plan management moves to a panel of providers. This checklist covers what changed, what each audit looks at, and how to be ready without adding staff.

What changed for plan managers in 2026

The National Disability Insurance Scheme Amendment (Securing the NDIS for Future Generations) Act 2026 brings in changes over the next two years. These are the ones that land on a plan manager's desk.

• 27 August 2026. What changes: Providers must keep records relating to claims for 7 years, with civil penalties for not doing so. New fraud offences start. What it means for plan managers: Your invoice, approval and evidence trail has to survive 7 years and be findable.
• 1 October 2026. What changes: The NDIA can suspend a participant's plan if they don't respond to requests for information. What it means for plan managers: Participants will lean on you to help answer NDIA requests quickly.
• 20 November 2026. What changes: A ban on inducements starts. What it means for plan managers: Review any offers or incentives you use to win participants.
• 1 December 2026. What changes: Claims must be made within 90 days of the support being delivered, down from 2 years. What it means for plan managers: Invoices that sit in an inbox for weeks become claims you can't make.
• 20 February 2027. What changes: A new debt notice framework gives providers 14 days to respond. What it means for plan managers: You need evidence on hand, not in a provider's filing cabinet.
• October 2027. What changes: Plan management moves to a panel of providers, with participants moving across over 6 months. What it means for plan managers: Your compliance record becomes a commercial asset.

The NDIA can still accept a late claim in exceptional circumstances, but no plan manager should build a process around that.

The two audits plan managers face

• Who runs it. Registration audit: An approved quality auditor, for the NDIS Quality and Safeguards Commission. Payment integrity audit: A dedicated NDIA team.
• When. Registration audit: When you register and renew (registration usually runs for 3 years). Payment integrity audit: Any time, before or after a claim is paid. It can be random, triggered by a tip-off or by a red flag in NDIA systems.
• What it checks. Registration audit: Plan management currently uses the verification module: qualifications and experience, incident management, complaints management and risk management. Payment integrity audit: Whether specific claims were genuine, in the plan, correctly priced and backed by evidence.
• What's at stake. Registration audit: Your registration. Payment integrity audit: The money. Unpaid claims are frozen until the audit ends, and paid claims can be clawed back from your next claim.

The payment integrity audit is the one that hurts cash flow. When the NDIA recovers a paid claim from a plan manager, the plan manager either chases the provider for it or wears the loss.

The 10-point audit-ready checklist

Work through these and you'll be ready for both audits. Each one is something an auditor can ask you to prove.

1. One evidence file per claim. Every paid claim links to its invoice, the approval, the service agreement and any proof of delivery, in one place you can export.
2. Current service agreements. Agreements with participants that set out your fees, responsibilities and how you handle disputes, plus a record of what providers have agreed to with the participant.
3. A check on every invoice line. Item number, price against the current NDIS Pricing Schedule, dates inside the plan, and enough funds in the right budget. Record that the check happened and who approved it.
4. NDIS supports only. Since 3 October 2024 the law sets out what is and isn't an NDIS support. Keep a note of how you decided on anything borderline.
5. Duplicate detection. Same provider, same date and same amount under a different invoice number is the classic overpayment an auditor finds.
6. Invoices claimed inside 90 days. From 1 December 2026, track the age of every invoice from the date of service, not the date you received it.
7. Records kept for 7 years. Store invoices, approvals and correspondence in a system, not in personal inboxes, so they survive staff changes.
8. A process for NDIA information requests. The NDIA can ask for information in a specific form, so know who responds, where the evidence lives and how fast you can pull it.
9. Incident, complaints and risk registers. These are what the verification audit checks, so keep them current, not reconstructed the week before.
10. Staff qualifications and conflicts of interest. Keep evidence of each staff member's qualifications and experience, and a written conflict of interest policy.

What a payment integrity audit asks for

Requests vary by support type, but plan managers and providers have been asked for:

• the invoices for a participant or a period
• service agreements and evidence the participant agreed to the support
• case notes, support logs, timesheets and rosters
• travel and mileage logs for provider travel and transport
• how the support links to the participant's plan and goals
• why a higher-cost option was chosen, such as 1:1 instead of group support

Most of that evidence sits with the provider, not the plan manager. That's why the best plan managers ask providers for it up front for higher-risk supports, rather than scrambling when the NDIA's request arrives.

Why audit readiness is now a commercial question

From October 2027, participants will move to a panel of plan management providers over 6 months. The selection criteria haven't been published yet. It's reasonable to expect that a clean compliance record, systems that can show their working and the capacity to take on more participants will count.

Plan managers who treat compliance as a cost centre will spend the next year catching up. The ones who treat it as proof of quality will walk into the panel process with evidence in hand.

Let AI do the checking and people do the judging

Entiprius director Emanuel de Sousa puts it simply: the question isn't what AI can do, but what AI should be allowed to do. In plan management, that means AI checks every line of every invoice, and people approve anything the AI isn't certain about.

That's how NDIS plan management software like Entiprius builds an audit trail as a side effect of normal work. It reads each invoice as it arrives, checks every line against NDIS rules and the participant's live budget through its direct PACE and PRODA connection, and flags duplicates. Invoices it is confident about are marked ready, and the rest go to a person for review. Every check, correction and approval is recorded against the claim. 101 Plan Management credits the software with increasing their compliance, and reports no audits on payment requests since December 2022.

If your evidence for a claim lives in three inboxes and a spreadsheet, book a free demo and see what an audit trail looks like when it builds itself. For the invoice side of compliance, read NDIS invoice requirements: the 2026 checklist.

NDIS audit FAQs

What is an NDIS audit for plan managers?

Plan managers face two audits. The NDIS Quality and Safeguards Commission arranges a registration audit when you register and renew, which for plan management currently uses the verification module. The NDIA also runs payment integrity audits on individual claims, before or after they are paid.

What is an NDIA payment integrity audit?

It is a request from the NDIA for evidence that specific claims were genuine, in the participant's plan, correctly priced and backed by records. Unpaid claims are frozen until it ends, and the NDIA can recover paid claims from your next claim if the evidence isn't good enough.

How long do NDIS providers have to keep records?

Under the new section 45B, introduced by the Securing the NDIS for Future Generations Act 2026, providers must keep records relating to their claims for 7 years from the day the claim is made, with civil penalties for not doing so.

What is the NDIS 90-day claim rule?

From 1 December 2026, claims must be made within 90 days of the support being delivered, down from 2 years. The NDIA can accept a late claim only in exceptional circumstances.

What audit does NDIS plan management need for registration?

Under the NDIS Commission's registration requirements, the plan management registration group (management of funding for supports in participant plans) uses a verification audit. The auditor checks qualifications and experience, incident management, complaints management and risk management.

What is the NDIS plan management panel?

From October 2027, plan management moves to a panel of providers, and participants will transition to a panel provider over 6 months. The selection criteria have not been published yet.

How can software help a plan manager stay audit-ready?

Software can check every invoice line against NDIS rules and the participant's budget, flag duplicates, track the 90-day claim window and record every check and approval against the claim. That builds the audit trail as part of normal work instead of after a request arrives.