EC25-003342
Mr Josh Burns MP Chair Joint Committee of Public Accounts and Audit
Via email: jcpaa@aph.gov.au
Dear Mr Burns
I refer to the invitation of 28 November 2025 from the Joint Committee of Public Accounts and Audit in relation to the inquiry into the administration of the National Disability Insurance Scheme.
The Australian National Audit Office report of 3 September 2025 assessed the NDIS Quality and Safeguards Commission (NDIS Commission) as partly effective in exercising its regulatory functions and made 10 recommendations. The NDIS Commission agreed to nine recommendations and agreed in-principle to one. To support the Committee’s inquiry, the NDIS Commission is sharing a copy of our progress and implementation activity to those 10 recommendations – refer to Attachment A. These initiatives demonstrate the NDIS Commission’s commitment to enhancing its regulatory effectiveness and to ensuring the continuous improvement of its operations.
The NDIS Commission is progressing a broad range of actions to address recommendations to uplift its regulatory capabilities. The NDIS Commission will establish a risk-based regulatory strategy and framework to support its compliance actions and communicate progress against the strategy to the sector.
Action is already underway to improve the NDIS Commission’s access to reliable data, systems, tools and processes through the Data and Regulatory Transformation program and will increase the NDIS Commission’s visibility of the provider market.
The NDIS Commission is improving its regulatory processes through developing and testing an enterprise-wide Risk-Based Regulation Prioritisation Model. It will provide a consistent approach to how the NDIS Commission prioritises complaints and reportable incidents and focuses regulatory efforts on the most serious matters.
The NDIS Commission would welcome the opportunity to appear before the Committee to discuss our progress and implementation activities in response to the ANAO recommendations.
Yours sincerely
redacted: s22(1)(a)(ii) - irrelevant
Louise Glanville Commissioner
15 December 2025
T 1800 035 544 E contactcentre@ndiscommission.gov.au
PO Box 210 Penrith NSW 2751
Attachment A
Status of actions to address ANAO performance audit recommendations – NDIS Commission’s Regulatory Effectiveness
| Rec # | ANAO recommendation | NDIS Commission published response | Implementation timeline | Status of NDIS Commission actions as at 17 November 2025 |
|---|---|---|---|---|
| 1 | To support intelligence and information analysis, the NDIS Commission implement: a) an overarching risk-based plan to guide information analysis and correlation activities; and b) guidance on establishing and conducting Own Motion Inquiries. |
Agreed a) The NDIS Commission has begun the process of improving communication and engagement to better synergise the various intelligence related functions operating within the Commission. Bringing together fortnightly round table meetings of staff from Fraud Fusion Taskforce, Data and Insights, Risk Intelligence and Delivery and Market Insights areas. This group will work towards planning and delivering a more unified approach to intelligence analysis across the business, taking into consideration the diverse functions of the NDIS Commission. The first formal meeting is taking place on the 22 July 2025. b) In addition to the Own motion enquiries (OMI) initiated at the Commissioner’s discretion, the new Risk-Based Regulation Prioritisation Model is piloting assessment of systemic risks by a whole-of-Commission decision-making panel. The panel would recommend planned interventions including OMI for decision by the Commissioner. If this pilot process of establishing and conducting OMIs is successful, guidance documents will document this process. |
30 June 2026 - completion of the Risk Based Framework 30 December 2026 - completion of the Risk Based Framework pilot, testing and review. 30 June 2027 - Risk Based Framework embedded implementation completed. |
a) Program lead and project lead has been assigned. Planning is well underway to develop a risk-based framework that will include: • Purpose and principles focused on regulatory risk management and human centred values. • Risk identification and assessment • Risk based prioritisation and decision making • Engagement, communication and capability • monitoring, learning and continuous improvement. Next steps: Program plan approved, working group established b) Own motion enquiries is at the information gathering stage - All OMI related resources are being identified. Next steps will be to draft a guideline which will then be published into the regulatory resource library. Draft expected to be ready for consultation by February 2026. Next steps: Develop complete guidance. |
| 2 | The NDIS Commission develop and implement a quality assurance process to meet legislative requirements and ensure completeness of the information disclosures record. | Agreed The NDIS Commission has commenced work on a quality assurance process and established a working group to progress. |
30 March 2026 - Completion of the Quality Assurance Framework 30 June 2026 - Completion of the Quality Assurance Framework pilot, testing and review. 30 December 2026 - Quality Assurance Framework implementation completed. |
The 67E register is established and work is underway to complete the process to document information disclosures. Next steps will be to develop a process guideline by February 2026 and a communications plan to be ready by April 2026. Next steps: Program plan approved, working group established |
| 3 | a) prepare for a refreshed Ministerial Statement of Expectations with close engagement with the appropriate minister and portfolio secretary; and b) prepare and issue a responding Regulator Statement of Intent in a timeframe consistent with the Direction to the NDIS Quality and Safeguards Commissioner under section 181K of the National Disability Insurance Scheme Act 2013 – No. 1/2023. |
Agreed With the recent appointment of Minister for Health and Ageing, Disability and the National Disability Insurance Scheme the Hon Mark Butler and the Minister for the National Disability Insurance Scheme Senator the Hon Jenny McAllister, the NDIS Commission has begun the process of engaging with the portfolio agency the Department of Health, Disability and Ageing to support drafting of the Statement of Expectations. This will be worked through at an officer level working group to ensure close engagement during drafting of a Ministerial Statement of Expectations and a timely responding Regulator Statement of Intent. |
TBC with partner entities | Completed 16/10/2025 |
Attachment A
| Rec # | ANAO recommendation | NDIS Commission published response | Implementation timeline | Status of NDIS Commission actions as at 17 November 2025 |
|---|---|---|---|---|
| 4 | The NDIS Commission: a) develop a process for setting compliance priorities to ensure they are risk-based; b) implement action plans to ensure that regulatory interventions are driven by compliance priorities; c) regularly reporting on compliance priorities and action plans, including publicly; and d) publicly outline its regulatory processes and decision-making criteria to support public understanding of how the Commission regulates the NDIS. |
Agreed The NDIS Commission published its annual compliance priorities for 2025-26 on 1 July 2025. Regular reporting will be supported by the implementation of the Risk-Based Regulation Prioritisation Model. A communications plan has also been developed to support increased awareness and stakeholder engagement. |
30 June 2026 - Completion of the Risk Based Framework 30 December 2026 - Completion of the Risk Based Framework pilot, testing and review. 30 June 2027 - Risk Based Framework embedded implementation completed. |
A program lead and project lead has been assigned. Planning is well underway to develop a risk-based framework that will include: • Purpose and principles focused on regulatory risk management and human centred values. • Risk identification and assessment • Risk based prioritisation and decision making • Engagement, communication and capability • monitoring, learning and continuous improvement. Next steps will be to engage a working group and collaborate to develop our framework, ensure measures of success targets are quantifiable and effective. 1. process planning underway 2. action plans planning underway 3. regular reporting planning underway 4. a communications plan has been developed Next steps: Program plan approved, working group established |
| 5 | The NDIS Commission develop, document and maintain a framework to assess, prioritise and manage regulatory risks. Regulatory priorities should be underpinned by risk assessment, data and evidence. The framework should articulate how identified risks are managed in line with well-defined risk tolerances, risk-profiling, and appropriate compliance actions | Agreed Since July 2024, the model has undergone testing and managed using a new prioritisation model. The model establishes a consistent, efficient and responsive process for prioritising matters based on the level of risk to NDIS participants. It marks a shift from focusing on individual complaints and incidents to addressing broader systemic risks, aligning with best practice adopted by most Australian government regulators. We identify and evaluate risks based on: • impact on human rights and participant safety • provider or worker compliance with NDIS legislation and rules • alignment with strategic priorities or emerging risks. |
31 December 2025 - Completion of the Risk Based Prioritisation 30 June 2026 - Completion of testing and incorporation of the model into the Risk based framework. 30 December 2026 - Completed embedment of the Risk Based Prioritisation Model into the Risk based Framework. |
A program lead and project lead has been assigned. Planning is well underway to develop a risk-based framework that will include: • Purpose and principles focused on regulatory risk management and human centred values. • Risk identification and assessment • Risk based prioritisation and decision making • Engagement, communication and capability • monitoring, learning and continuous improvement. Next steps: Program plan approved, working group established to collaborate and develop our framework. |
6 The NDIS Commission develop and Agreed 30 June 2026 - Completion of the Compliance Program lead and project lead has been assigned. Planning is well underway implement an entity-wide compliance Monitoring Strategy to develop a Compliance Monitoring Strategy with a focus on the market monitoring strategy, consistent with its The NDIS Commission will develop a Compliance sector. The strategy is proposed to include an implementation plan for a pilot 30 September 2026 - Completion of testing Compliance and Enforcement Policy, Monitoring Strategy detailing relevant functions and stage to test, review and action once completed. and review that includes the monitoring activities how the monitoring is operationalised across the NDIS Next steps: Program plan approved, working group established the Commission intends to undertake, Commission. 30 December 2026 - Completion of frequency of planned activities, links Implementations compliance monitoring activities to identified risks, and sets out reporting arrangements and intended results.
7 The NDIS Commission: Agreed Quarter 4, 2025-26 NDIS Commission is undertaking work to mature its approach to market monitoring, including monitoring and mitigating the risks related to unplanned a) develop and document a strategy or •The NDIS Commission supports the recommendation service withdrawal. As part of our current market monitoring activities, we plan that sets out the Commission’s to develop a strategy that clearly sets out the NDIS undertake quarterly assessment of NDIA payment data to identify providers approach to market oversight, including Commission’s approach to market oversight, including who have exited the registered market but continue to deliver services to monitoring and mitigating the risks of identifying how we monitor and mitigate the risks of participants in the unregistered market. unplanned service withdrawal; and unplanned service withdrawal. To increase our focus on integrated market monitoring, the NDIS Commission plans to undertake a more holistic assessment of available data sources. This b) works with the NDIA to update the •We will respond to this recommendation through will improve our ability to identify instances of emerging market risk, including joint operational protocol on market activities that include contributing with the NDIA to the provider exits. These data sources include NDIS Commission complaint, stewardship and oversight to include the Provider Registrations and Exits Schedule Oversight reportable incident, and section 13A notifications, where providers advise the Commission’s planned approach to Group, which considers how we can monitor and NDIS Commission of events that could affect their ability to deliver supports market oversight developed in part (a) mitigate the risks of unplanned service withdrawal and and services. By incorporating these notifications into our analysis of market above. contributes to informing our market oversight activities. trends and patterns, the NDIS Commission can more effectively identify areas of risk and unplanned service withdrawal (for unregistered providers), •The NDIS Commission is working collaboratively with informing our responses and market interventions in line with our broader the National Disability Insurance Agency (NDIA) and market stewardship commitment. the Department of Health, Disability and Ageing to develop a series of guiding documents that make up the An effective suite of monitoring measures will be supported through the NDIS updated Market Stewardship Framework (MSF). The Commission’s systems uplift by 30 June 2026. MSF will include the NDIS Commission’s planned The NDIS Commission is working with the Department of Health, Disability approach to market oversight and will provide an and Ageing and NDIA on how monitoring information can be best utilised to update to the current Market Enablement Framework, mitigate the risks of unplanned service withdrawal, including in the context of which was published in 2018 by the NDIA. the broader work on a market stewardship framework.
8 To provide assurance that the NDIS Agreed 30 March 2026 - Completion of the Quality The Quality Assurance Framework has been approved and endorsed. NDIS Commission is taking effective Assurance Framework Commission’s Executive Management Group approved the pilot team and The NDIS Commission will meet this recommendation regulatory action using powers provided pilot plan development on 25 November 2025. through delivery of a quality assurance framework and 30 June 2026 - Completion of the Quality under the NDIS Act and meeting the progressing the implementation of Risk-Based Assurance Framework pilot, testing and review. Next steps: Pilot stage requirements of the Australian Regulation Prioritisation Model across all operational Government Investigations Standards, 30 December 2026 - Quality Assurance areas. Tracking compliance against Australian the NDIS Commission implement quality Framework implementation completed. Government Investigation Standards will also be assurance processes for complaints, supported by the continuing delivery of the regulatory reportable incidents, compliance learning and development program. matters and investigations.
9 The NDIS Commission support staff to Agreed 30 December 2025 - Completion of fit for Purposeful processes and procedures are well on the way for completion apply a consistent approach to purpose policies and procedures December 2025. A list has been created and upon its completion, the compliance actions through: The NDIS Commission is finalising the development of processes will be included into the regulatory resource library. fit for purpose policies and procedures and will also Next steps: socialisation of procedures. establishment of central point for a) finalising fit-for-purpose policies and develop guidance to assist staff on selecting and using compliance and compliance monitoring procedures procedures for compliance actions; and the most suitable compliance tools. activities b) developing guidance to assist staff with selecting and using the most suitable compliance tool for specific circumstances.
10 The NDIS Commission: Agreed in principle Q2 2026-27 Completed: The NDIS Commission uses live data system where • Data Quality Assessment undertaken by DART that will inform cleansing a) implement measures to address data is extracted at point in time. For each quarterly to occur during data migration, and implementation of Quarterly errors in the Commission’s data report, an extract is taken of the data as at the end of Performance Report (QPR) within our new platform. holdings; the quarter for all quarters included the report. Due to be a change in the number reported in previous Planned/In-Progress: b) ensure the accuracy of performance quarters. • Current ‘off-system’ actions that impact QPR will be moved to new case reporting in compliance with the PGPA management system. Act and PGPA Rule, and address issues • Ongoing data quality profiling to be implemented within new platform. identified in relation to Annual The NDIS Commission is on a maturity journey to • Implement QPR within the new Data and Analytics Platform. Performance Statements for embed better practices in performance reporting. • Review method of computation to ensure consistent results, or provide an expectations; improve reliability of reported performance data. explanation for inconsistencies caused by system and/or process performance in line with regulator Framework, in collaboration with key stakeholders to: limitations. performance expectations; and • Explore options within new platforms for managing development and •Record and track data quality issues and identify approval process for individual measures. d)disclose and provide written opportunities to enhance quality across the data • Establish process for issuing a correction if required. explanation for changes to and errors in lifecycle; • Update Data Quality Register to explicitly reference impacts to public the transparency and public confidence analysis to ensure the annual performance statements reporting as a key factor for prioritisation. of performance reporting. meet the government’s expectations; •Keep accurate records on the agreed reporting Planning and Performance methodologies, rationale, performance results, The Planning and Performance Framework was updated in May 2025 (ahead changes, and other information to meet its legislative of the publication of the ANAO Report) with amendments that address requirements; aspects of the ANAO’s findings and recommendations including: •Actively share changes and learnings in our corporate • Inclusion of supplementary guidance on Portfolio Budget Statements documents to enhance transparency and public and Regulator Performance. confidence.
- Inclusion of a defined process for Quarterly Performance Statement reporting.
- Updated Methodology Control Documents (MCDs) to streamline associated processes.
- Updated risk management to align with the Enterprise Risk Management Framework and Policy. MCDs have been developed for each performance measure containing agreed data sources, reporting methodologies, rationale, and planned performance results as well as alignment to regulator best practice principles. Any changes during the performance cycle are captured through the QPS reporting process and then reflected in updated MCDs. MCDs are signed by the relevant Deputy Commissioner and presented to the NDIS Commission’s Executive Management Group and the Audit and Risk Committee for endorsement. Further updates to the Planning and Performance Framework are planned to address the remaining findings and recommendations of the ANAO Report.