NDIS Practice Standard 2 (Governance and Operational Management) covers how you run your organisation — not just how you deliver supports. It is the most comprehensive standard and the one most likely to generate non-conformances. AuditCore was designed around S2 requirements, with dedicated modules for every quality indicator: incident management, risk, HR, policies, and governance oversight.
Why Governance Compliance Matters
- S2 generates more non-conformances than any other NDIS Practice Standard — most providers' audit risk lives here
- Strong governance protects participants by ensuring the organisation behind the supports is well-managed and accountable
- The NDIS Commission takes S2 failures seriously — missed incident notifications and lapsed worker checks can result in show cause notices
- Robust governance systems also protect your organisation: documented oversight, tested continuity plans, and active risk management reduce operational and legal exposure
S2.1 — Governance and Accountability
Auditors look for evidence that your governance body (board, committee, or management) is actively overseeing compliance — not just receiving reports. Evidence includes board meeting minutes, delegations of authority, and documented oversight of serious incidents and complaints.
S2.2 — Risk Management
Your risk management framework must be documented, reviewed regularly, and actively used. Auditors check your risk register for currency, your incident data for risk identification, and whether identified risks have mitigation actions with owners and review dates. AuditCore's risk module links incident data to your risk register automatically.
S2.3 — Quality Management
Continuous improvement is a formal requirement under S2.3. Your CI Register must show evidence of improvement activities — not just compliance tasks. AuditCore auto-populates your CI Register from incident findings, complaint resolutions, and internal audit results.
S2.4 — Information Management
Participant records, worker records, and governance documents must be secure, accurate, and accessible. Auditors check your document control system, your data retention practices, and whether you have a privacy breach response procedure.
S2.5 — Incident and Complaint Management
This quality indicator generates more non-conformances than any other in S2. Auditors verify that every reportable incident was notified to the Commission within five business days, that all incidents are logged and classified, and that your complaint register is complete. AuditCore tracks the five-day countdown for every incident automatically.
S2.6 — Human Resources and Worker Screening
Every worker who has more than incidental contact with NDIS participants must have a current NDIS Worker Screening Check. Auditors verify this — and they check it against your service agreement dates, not just your current worker list. AuditCore tracks check status and expiry for every worker and alerts you at 90, 60, and 30 days before expiry.
S2.7 — Continuity of Supports
Your business continuity plan must address how you would maintain participant supports during a crisis — staff shortage, natural disaster, or system failure. Auditors want to see a written plan, evidence it has been tested, and confirmation that participants would be notified promptly if their supports were disrupted.
What Auditors Look For Across S2
- Active governance: board or management meeting minutes that show real oversight of incidents, risks, and compliance — not just routine agenda items
- Complete worker screening: every worker who has contact with participants has a current, verified NDIS Worker Screening Check on file
- Incident notification timeliness: all Commission-reportable incidents notified within five business days with documented evidence of the notification date
- A live, current risk register: risks are dated, mitigation actions have owners and due dates, and the register has been formally reviewed within 12 months
- A CI Register that shows real improvement activity linked to incidents, complaints, and audit findings — not an empty template
Most Common S2 Non-Conformances
- Incident notification not made within five business days
- Worker screening checks expired or missing for some workers
- Risk register not reviewed in the past 12 months
- No evidence of governance oversight in meeting minutes
- CI Register empty or not linked to actual improvement activities
- Business continuity plan not tested or not up to date
Key Outcomes of Strong S2 Compliance
- Fewer audit findings — most providers' non-conformances sit in S2, and strong systems eliminate them at the source
- Protected participants — well-governed organisations respond faster to incidents and safeguard the people they support
- Reduced operational risk — documented oversight, tested continuity plans, and active risk management protect against unexpected disruptions
- Commission confidence — a provider with consistent S2 compliance builds a track record that supports smoother registration renewals
- Organisational resilience — the systems built for S2 compliance are the same systems that keep the organisation running well day-to-day