Pain points
I tracked staff certifications in a spreadsheet for 3 years. Here's what an NDIS audit found.
Three NDIS support workers, three expired clearances, one auditor's question. Why spreadsheets fail at compliance tracking - and what they can't do that audit prep actually needs.
A Melbourne disability provider, profiled by WorkerChecks earlier this year, summed up a problem most NDIS operators will recognise the moment they read it:
“We had three support workers whose clearances expired within the same week. We didn't realise until a routine audit flagged it.”
Three workers. One week. One auditor's question. And the tracking system - because there is always a tracking system, even if no one calls it that - was a spreadsheet.
This is the most common compliance failure in the NDIS sector. Not malice. Not negligence. A spreadsheet that was good enough on day one, scaled past its design, and quietly stopped doing its job.
Why spreadsheets fail at expiry tracking
A spreadsheet is a brilliant tool for one person, on one machine, tracking a small list of things that change occasionally. That's not what NDIS staff compliance is. NDIS staff compliance is dozens of workers, dozens of document types, different expiry windows, different states, different visa rules, different audit cycles - all changing constantly.
Three failure modes show up at almost every provider that grows past about ten staff:
Date logic that doesn't alert you
A conditional-format cell that turns red when =TODAY()-Expiry>0 tells you a clearance has expired. It does not tell you that a clearance is about to expire. By the time the cell goes red, the worker has been non-compliant for days - and you only see it when you happen to open the file.
Version control nobody owns
One spreadsheet becomes two when the office manager goes on leave. Two becomes three when a regional team lead wants their own view. Three becomes “which one is the source of truth?” the day an auditor asks for the staff matrix. The evidence the auditor sees and the evidence the team uses day-to-day are no longer the same document.
No proactive surfacing
Spreadsheets are passive. They wait to be opened. The Melbourne provider's three workers didn't expire mysteriously - the dates were sitting in column F the whole time. Nobody saw them because nobody looked, and nothing prompted them to look. The audit was the prompt. Audits should not be the prompt.
What auditors sample at a Tier 1 audit
NDIS Worker Screening Check
Renew every 5 years
The single most-checked clearance. Auditors will ask for the certificate, the issuing state, and the expiry date - for every worker who has any contact with a participant.
Working with Children Check
Renew every 5 years (state-specific)
Required for any worker delivering supports where children may be present. State-specific. Auditors will sample workers and ask to see this evidence.
Infection Control Training
Annual refresher
Mandatory under the NDIS Practice Standards. Auditors expect a completion certificate, not just a tick on an internal training matrix.
CPR / First Aid Certificate
CPR annually, First Aid every 3 years
Required for SIL and personal-care workers. Auditors check that the certificate is current on the date of audit, not the date of induction.
What auditors actually ask about at a Tier 1 audit
Most providers think the auditor will ask for “the staff spreadsheet.” They won't. Auditors sample. They pick a handful of workers - usually three to six, depending on organisation size - and ask to see the documentary evidence for each clearance, on the date of the audit, with the renewal window visible.
The spreadsheet is fine for the moment they ask “who do you have on staff?” It collapses the moment they ask “can I see the actual NDIS Worker Screening certificate for Priya Sharma, dated within the last five years?”
The four documents above are sampled at almost every Tier 1 certification audit. None of them sit naturally inside a spreadsheet. They are PDFs, scans, and renewal receipts that need to be findable in seconds, attached to the right worker, with the right expiry date next to them.
For the full list of artefacts the Commission samples, see our Tier 1 audit checklist - 38 documents grouped by domain, with the indicator each one evidences. And our NDIS Worker Screening explainer walks through the state-by-state rules.
Proactive expiry alerting
In a spreadsheet
A conditional-format cell turns red on the day it expires. By then it's already late.
In a compliance system
Email + in-app notifications fire 60, 30 and 7 days out, to the worker and their manager.
Role-based view of compliance
In a spreadsheet
Everyone with the link sees everything, or nobody can edit, or the wrong person edited it last Tuesday.
In a compliance system
A team lead sees their direct reports. A worker sees their own. Owners see everything. One source of truth.
Defensible audit trail
In a spreadsheet
"Last edited by Sam on 14 Feb" tells you nothing about what changed, why, or what the document said before.
In a compliance system
Every upload, version, and status change is timestamped and attributed. The auditor's questions answer themselves.
The three things a compliance system has to do
None of these are exotic. They are what every other regulated sector - aged care, finance, healthcare - figured out a decade ago, and what disability providers are now expected to figure out before 1 July 2026.
Alerting. Expiry windows that fire on a schedule, to the right person, with enough lead time to actually renew. Not a red cell. An email, an in-app notification, a task on a manager's dashboard - 60 days out, 30 days out, 7 days out. The clearance never expires by surprise because someone is always told it's about to.
Role-based view. The owner sees the whole org. The team lead sees their team. The worker sees their own documents and what they need to upload next. The auditor, when they're given access, sees a read-only sample, scoped and time-bound. Nobody is editing the same row at the same time, and nobody sees what they shouldn't.
Audit trail. Every upload, every status change, every renewal. Timestamped, attributed, and queryable. The auditor's question “when did this CPR certificate get renewed?” has a one-click answer. There is no scrolling through email threads. There is no “I think Aroha re-uploaded it in March.”
That's the bar. Anything below it is the same trap the Melbourne provider walked into - a system that worked right up until the day it didn't.
What we do
Checkbase tracks the document side of NDIS compliance - staff records, participant files, SIL house evidence, governance. Built specifically for the way the NDIS Commission asks for evidence at audit. If you're a SIL provider preparing for 1 July, two things from us are worth your time:
From Checkbase
Background reading: the SIL mandatory-registration explainer covers the 1 July 2026 deadline in detail.
Sources & further reading
- WorkerChecks - NDIS provider experience report - Source of the opening Melbourne provider quote
- NDIS Commission - audit obligations - What an auditor will sample and how often
- Checkbase - Tier 1 audit checklist guide - 38-artefact catalogue mapped to NDIS Practice Standards indicators
See Checkbase in action
Book a personalised demo or start your free 14-day trial today.
Plain-English reform updates, when they happen.
No spam, no weekly newsletter for the sake of it. Just the bits NDIS providers actually need to know.