At yesterday’s #NDISLink Conference in Perth, MGA’s David Moody put a confronting question to a room full of NDIS CEOs, CFOs and directors: “Could we defend our revenue under audit tomorrow?”
For most providers, the honest answer is “not fully”; and the reason usually isn’t fraud. It’s paperwork!
The system has changed, quietly
NDIS oversight used to mean periodic audits with limited visibility. In 2026 it means continuous, data-driven monitoring that compares every provider against the market, not in isolation. Outliers get noticed. Small, repeated errors stop looking like mistakes and start looking like a pattern, and patterns are what trigger reviews.
For providers, that means compliance risk now behaves like financial risk. A finding doesn’t arrive as a gentle adjustment; it arrives as a bill, after you’ve already paid the wages and overheads that delivered the service.
How failure actually happens
It rarely starts with intent to defraud (thank God!). It starts small: a late note, a vague note, a roster that doesn’t quite match the claim. Left unaddressed, that gap repeats. Repeat often enough, across enough staff, and it becomes systemic. And systemic issues are what auditors and the NDIS Commission are built to find. As you’d expect, once they find one, the review widens.
The lesson for leaders: a documentation gap isn’t an admin issue sitting with the compliance team. It’s a future financial event sitting on the executive dashboard.
Two outcomes, one root cause
The conference walked through two real cases that show both ends of what happens when evidence and systems fall short.
In the first, a registered, trusted provider delivered services to nineteen participants over two years, claiming just over $400,000. When audited, they could not prove they’d done the work. Doing the work turned out to be irrelevant — because they couldn’t prove it. The outcome was a prison term.
In the second, a provider with three participants had no staff training and no systems in place. An incident occurred, the regulator investigated, and the finding was that the provider had failed to provide safe services. The Federal Court penalty was $1.9 million.
Neither case started as fraud, but both ended the same way: an organisation that could not demonstrate, in writing, that the right thing had happened.
If you can’t prove it, it isn’t revenue
The practical message for boards and executives is straightforward (thankfully, in this complex NDIS world we’ve created!). Revenue that can’t be evidenced end-to-end — roster, service, note, claim — isn’t really revenue. It’s a liability sitting on your books, waiting for the wrong sample audit.
The fix isn’t complicated, but it does need to sit at board level, not just in the compliance register:
- Sample-audit a handful of claims end-to-end, this month, before a regulator does it for you
- Track late notes, roster-claim variance and manual overrides as monthly trend data, not annual anecdotes
- Put your top integrity exposures — and a remediation plan — on the board agenda
Case notes will never be the most exciting item on a provider’s to-do list, and at Management Governance Australia, we’ve seen our share of really good ones and real shockers. But in the current environment, they are the single strongest form of protection an organisation has, for participants, for staff, and for the balance sheet.
MGA works with NDIS providers, boards and executive teams on governance, integrity and compliance frameworks. If this raises questions about your own exposure, we’d welcome the conversation.