David Moody, Head of Strategic Relationships, Management Governance Australia Group
The Australian National Audit Office (ANAO) has released its performance audit into “Effectiveness of the NDIS Quality and Safeguards Commission’s Regulatory Functions.”[1]
Given the NDIS’s scale, complexity and importance to people with disability, the ANAO’s findings merit close attention—not just from regulators, but from every registered (and unregistered) provider across the sector.
Below, we summarise the key findings, our observations on the implications, and what providers should do now to prepare for a more rigorous regulatory environment.
Key Findings from the ANAO Audit
The ANAO’s audit encompassed the period through 2023–24 and assessed whether the NDIS Commission is exercising its regulatory functions effectively and proportionately.
Some of the standout findings:
- Partial effectiveness in regulatory delivery The audit found that while the Commission is exercising many of its regulatory functions, it is only “partly effective” in key areas. Systems and processes for intelligence gathering are only partially effective Some information-sharing arrangements are “largely effective” But no formal regulatory risk framework exists to underpin decision-making across the Commission.[2]
- Weaknesses in monitoring, compliance and enforcement design The Commission lacks a risk-responsive, proportionate approach to monitoring and compliance Compliance actions have increased dramatically: in 2023–24, the Commission finalised 35,519 compliance actions across provider segments (registered and unregistered).[3] However, performance reporting lacks clarity, and there are errors and inconsistencies in public reporting.[4]
- Ten formal recommendations The ANAO made 10 recommendations aimed at strengthening the Commission’s regulatory architecture. [5] The NDIS Commission has accepted all ten (with one “in principle”). Amongst the proposed reforms: instituting a risk-based regulatory prioritisation model, establishing a quality assurance framework, improving consistency in compliance-action policy and guidance, and addressing errors in the Commission’s public reporting.
- Regulatory trajectory underway The Commission is already moving to implement the recommended reforms — notably through a Data and Regulatory Transformation (DART) program, and the phased rollout of its Risk-Based Regulation Prioritisation Model, with full deployment expected by October 2025.
5. Insights & Implications for Providers
Yes, the ANAO audit is a critique of the regulator; however, it also has some strong signals for disability service providers. Here are some of our key observations:
A. The regulatory bar is rising. Providers will be under increasing pressure to demonstrate that their governance, monitoring, risk frameworks and reporting systems are robust, proportionate, and evidence-based. The shift toward intelligence-led, risk-graded regulation means that high-risk providers or practices are more likely to attract scrutiny. It should be emphasised that this is not to say that providers should shy away from implementing ‘high-risk’ initiatives that will produce positive outcomes for NDIS participants; only that these providers should be aware of the potential for increased scrutiny.
B. The distinction between registered and unregistered providers will matter less. While registered providers have always faced greater regulatory scrutiny, the audit highlights that unregistered providers are also within the Commission’s scope (as I recall one former Commissioner constantly reminding me when I raised this concern on behalf of registered providers!). The volume of compliance actions across both segments shows the regulator is not shying away from enforcement. There is, in our view, however, a case for the provider to seek to produce more of a ‘halo’ effect in its regulatory activity, and to publicise its regulatory activity more widely/prominently, so that providers know what the Commission is focusing on, and can change their practices to take account of this.
C. Data, metrics and evidence are becoming central. Weaknesses in the Commission’s reporting were highlighted in the audit, suggesting that providers, too, will need high-quality data systems, consistent metrics (on incidents, complaints, outcomes, and quality), and robust internal reviews to defend their practices.
D. Risk frameworks must be credible, not cosmetic. A paper on board governance in disability services over recent years has noted that many boards struggle to translate risk oversight into concrete practices.[6] In this environment, token risk registers won’t be enough; providers will need proportional, well-documented risk and assurance systems that align with NDIS practice standards and regulatory expectations.
E. The role of governance (boards and leadership) is more exposed. Boards and senior executives will need to ensure clear accountability, documented delegated authority, ongoing oversight of compliance and quality, and responsiveness to indicators of emerging risk. Within the NDIS Practice Standards, governance is, of course, already a core requirement.
F. Public confidence and transparency will be under greater demand. The regulator’s focus on improving its transparency is mirrored by sector expectations for providers to be more open about quality, complaints, outcomes and continuous improvement efforts. Providers will need to be ready to respond to stakeholder scrutiny, media interest and participant expectations (the ‘4 Corners Test’).
Recommendations: How Disability Service Providers Should Respond
To adapt proactively—rather than reactively—to this evolving regulatory landscape, here are some strategic actions providers should consider:
Providers who embed these practices now will be better positioned not just for regulatory compliance, but to deliver the highest-quality, safe, person-centred supports in a more accountable environment.
Final Thoughts & Call to Action
The ANAO’s audit is a wake-up call for the NDIS regulatory ecosystem—and a reminder that, among all the other things providers are currently managing, they may need to evolve faster. The regulatory landscape is shifting toward intelligence-led, risk-graded, more transparent oversight. The providers who thrive in this environment will be those who view compliance not as a burden, but as an opportunity for continuous improvement.
We are here to help
At @Management Governance Australia, we specialise in helping disability service providers translate this emerging regulatory environment into practical strategy, governance, and business improvements. If your organisation needs advisory support—whether in governance review, designing risk frameworks, compliance systems, strategic planning, board enablement or performance and quality architecture—we’d be glad to partner with you.
Contact us:Management Governance Australia
Phone: 1800 118 244
Email: https://mg-australia.com.au/contact-us/
Website: https://mg-australia.com.au
We welcome a conversation about where your organisation is now, where it needs to go, and how to get there with confidence.
[2] Ibid.
[3] Ibid.
[4] Ibid.
[5] Ibid.
[6] Alan Hough (2023) Governing for quality and safeguarding: what might disability service provider boards learn from others?, Research and Practice in Intellectual and Developmental Disabilities, 10:1, 26-41, DOI: 10.1080/23297018.2022.2109193