NDIS Training Traps: What Auditors Check in 2026
Will and Winter break down the 2026 NDIS compliance risks most providers miss, from lapsed CPR and infection control refreshers to undocumented inductions and participant-specific high-intensity support sign-offs.
They also explain how to move beyond spreadsheets with workforce systems that track credentials, flag expiry dates, and help prove staff are competent in real time.
Is this your podcast and want to remove this banner? Click here.
Chapter 1
The Compliance Trap and Universal Basics
Will, EnableUs Community
Welcome to the show everybody! I'm Will, EnableUs Community, here with Winter, EnableUs Community. And Winter, let's start with a reality check for 2026. If you're an NDIS registered provider, the biggest threat to your audit isn't a missing policy document or an outdated PDF on your drive. It's actually incomplete, lapsed, or poorly documented training records. Auditors are looking way past the checkboxes now to see if your workforce is actually competent in real time.
Winter, EnableUs Community
It is a massive trap, Will. I was looking at the NDIS Commission's recent audit findings, and they are scrutinising workforce competency more rigorously than ever. The Commission doesn't actually give us a single, neat shopping list of mandatory training courses. Instead, they embed these training indicators directly into the NDIS Practice Standards. They expect your HR system to show a clear system to plan, record, and evaluate the effectiveness of training.
Will, EnableUs Community
Right, so it's less about "do you have a certificate" and more "can you prove they know what they're doing?" But there are some universal basics. Let's talk about Tier One, which is mandatory for every single worker, zero exceptions. The big one is the NDIS Worker Orientation Module. It's a 90-minute online module covering their obligations under the NDIS Code of Conduct, and in 2026, auditors are checking for one hundred per cent staff completion before anyone delivers a single hour of support.
Winter, EnableUs Community
Exactly, one hundred per cent, and that certificate must be on file before they start. The good news is it's portable across employers. But then we hit the training area that actually explicitly mandates ongoing refresher training: infection control and PPE. The Practice Standards are super clear here. Each support worker needs initial and refresher training in hand hygiene, respiratory hygiene, and cough etiquette, plus specific PPE training for anyone doing direct support.
Will, EnableUs Community
And that's where people slip up, because they think a certificate from three years ago still works. The recommended refresher cycle for infection control is annually. Most providers use the free Department of Health training, or the dedicated libraries developed by etrainu and NDS. If an auditor walks in and sees a worker who hasn't done an infection control refresher in eighteen months, that's an immediate non-compliance.
Winter, EnableUs Community
And the same goes for your organizational induction. It's not enough to just say, "Oh, they shadow someone for a day." Your induction must be a documented, consistently delivered program covering privacy, risk management, incident reporting, and emergency procedures. Auditors look at that induction as direct evidence of your human resources management practices. If it's not recorded, it didn't happen.
Chapter 2
Role-Specific Triggers and Managing the Matrix
Will, EnableUs Community
That brings us to Tier Two, which is where things get highly specific based on the actual roles and supports being delivered. And we have to talk about what I call the First Aid trap. Most people think their First Aid qualification, the standard HLTAID011, is good for three years. And it is, on paper. But under the NDIS standards, you have to respond to medical emergencies, which includes CPR under HLTAID009. The CPR component must be renewed annually.
Winter, EnableUs Community
And if you miss that annual CPR renewal, the entire qualification effectively lapses for NDIS compliance purposes. You can't have a support worker out in the field with a three-year-old First Aid certificate and a CPR component that's fourteen months old. That is a massive red flag. Plus, First Aid and CPR cannot be online-only. You can do the theory online, but the practical assessment must be face-to-face.
Will, EnableUs Community
Absolutely. And speaking of practical, let's talk about manual handling and high-intensity supports. If a worker is using hoists, slide sheets, or mobility equipment, online theory is not enough. You actually need an observational assessment. A trained assessor, like a senior staff member, a physio, or an occupational therapist, has to physically watch that worker perform the manual handling task and sign off on their competency before they support a participant independently.
Winter, EnableUs Community
It's the same level of rigor for things like mealtime management and dysphagia support, which the NDIS Commission has made a massive regulatory priority lately. If you have workers supporting participants with swallowing difficulties, they must have training aligned specifically to that participant's mealtime support plan. And if you're delivering High Intensity Daily Personal Activities, like complex bowel care or tracheostomy management, generic certificates are completely useless.
Will, EnableUs Community
Exactly. Under the High Intensity Support Skills Descriptors, which are now heavily audited under Module 1, workers must be trained and assessed by an appropriately qualified health practitioner. And that evidence must be participant-specific. You can't just show a general "enteral feeding" certificate. You have to prove the worker has been signed off to deliver that specific feed, for that specific participant, using their specific equipment.
Winter, EnableUs Community
It is a huge administrative burden if you're still trying to track all of this on a manual spreadsheet. Think about it: you've got dozens of staff, all with different CPR expiry dates, different infection control refreshers, different participant-specific high-intensity sign-offs. If one spreadsheet cell gets messed up, you've got a compliance gap.
Will, EnableUs Community
Which is why modern NDIS providers are completely ditching manual spreadsheets. They are moving to purpose-built workforce management platforms like Imploy, ShiftCare, RotaWiz, or iinduct. These platforms have automated credential tracking and expiry alerts. They tell you sixty days in advance when a worker's CPR is about to expire, so you can book them in before the gap even happens.
Winter, EnableUs Community
It takes the manual panic out of the equation. Because at the end of the day, compliance isn't just about surviving the audit; it's about making sure your participants are safe and your workers are actually competent. If you're building your NDIS provider business and want to make sure your training registers, workforce systems, and compliance foundations are bulletproof for 2026, the team at EnableUs is here to guide you through every step.
Will, EnableUs Community
Well said, Winter. Keep those registers clean, stay ahead of those expiry dates, and we'll see you in the next episode!
Winter, EnableUs Community
Bye everyone!