National Disability Insurance Agency

Submission to the Joint Committee of Public Accounts and Audit Inquiry into the administration of the National Disability Insurance Scheme

February 2026

1

The National Disability Insurance Agency’s submission

to the Joint Committee of Public Accounts and Audit inquiry into the administration of the National Disability Insurance Scheme (NDIS)

Management of financial sustainability

In April 2023, National Cabinet set an 8% annual growth target for NDIS costs from 1 July 2026. This target was set following prior growth rates exceeding 20%, due to a higher-than-expected increase in the number of participants, inflationary sources (such as increases in wages and consumer prices), and growth in payments above normal inflationary sources.

The NDIA monitors and reports on the management of financial sustainability risks in the Annual Financial Sustainability Report (AFSR). The AFSR highlights actions being taken to improve management of financial sustainability of the NDIS. These activities are monitored by the NDIA and the NDIA Board.

Reforms being implemented from the NDIS Amendment (Getting the NDIS Back on Track No.1) Act 2024 that took effect from 3 October 2024 are intended to improve financial sustainability of the NDIS. Changes already implemented include a list of NDIS supports to clarify what supports participants can access using their NDIS funding as well as funding periods that seek to help participants manage and spend within their plan budgets.

The NDIA is working with the Department of Health, Disability and Ageing to develop and implement a new approach to developing participant NDIS plans, “New Framework Planning”, together with foundational supports and Thriving Kids. These initiatives are also intended to improve financial sustainability of the Scheme.

Management of NDIS claims compliance

Current processes to manage NDIS claim compliance have matured and continue to mature through integrity reforms such as the Crack Down on Fraud (CDoF), Payment Integrity programs and Fraud Fusion Taskforce, delivering system and capability uplifts to enhance the NDIA’s ability to better detect and prevent the exploitation of participants and the NDIS.

The NDIA processes over 600,000 claims per day and risk assesses every claim received, with high-risk claims selected for further review.

Following further review, the NDIA considers any additional integrity interventions such as a review of historical claiming, debt recovery, referral to other agencies for regulatory action, or in the most serious cases, criminal prosecutions.

Monitoring, measuring and reporting on NDIA performance

The NDIA reports on its performance in annual performance statements that are audited annually by the ANAO. In 2024–25 the NDIA reported that 7 key performance measures were fully met. This included:

• first time resolution of queries by the National Contact Centre (84.4%)
• the level of NDIA staff that identify as having a disability (21.6%)
• participants with community and mainstream supports (96.5%)
• Scheme payments made within agreed timeframes (99%)
• annualised Scheme growth rate (10.8%), average payments per participant ($65,800), and
• timely provision of quarterly reports to disability ministers (all).

Of the performance measures not fully met in 2024–25 it is noted that as of 30 September 2025, the participant employment rate was 22% and in line with the 2025–26 target. Participant participation in work has more than doubled from a baseline of 10% to 23% for participants aged 15 to 24 years who have been in the NDIS for 2 years or more.

Additionally, performance against the Participant Service Guarantee (PSG) improved in the quarter ended 30 September 2025, with 8 of the 19 monitored targets fully meeting the 95% target and an additional 6 achieving performance over 80%.

The NDIA is progressively maturing its processes to ensure performance measures are mapped to key activities and legislative functions, ensuring visibility and accountability at the enterprise level. In 2025–26, the NDIA introduced a new integrity performance measure and is also undertaking a review to better define key activities and the performance measures to report against these activities.

The NDIA Quarterly Report to Disability Ministers provides an overview of the performance and operations of the NDIS including key performance metrics, such as data accuracy, timeliness of updates and compliance with legislated deadlines.

Status of Action to Address ANAO Findings

Details on the Status of the NDIA’s Action to Address Findings Raised in the Audit Reports

Details on the status of the NDIA’s action to address findings raised in the 5 ANAO audit reports are included at Attachment A.

NDIS Website - February 2026 | Submission to the JCPAA Inquiry: Administration of the National Disability Insurance Scheme

Submission to the Joint Committee of Public Accounts and Audit Inquiry into the administration of the National Disability Insurance Scheme

Attachment A: Response to open audit findings

Auditor-General Report No. 22 2024–25 (external) Audits of the Financial Statements of Australian Government Entities for the Period Ended 30 June 2024

Removal of user access

Audit finding (from ANAO Audit report)

As part of the ANAO 2020–21 financial statements interim audit, the ANAO found weaknesses in NDIA’s user access terminations processes. User accounts should be removed upon termination date as they no longer have a legitimate requirement to access the NDIA’s network. The report noted the NDIA moved to a new information and communication technology operating environment (PACE) and created a new process to address this finding during the 2022–23 audit, however there were weaknesses with the reporting used to detect potentially inappropriate activity. The ANAO has reviewed the status of this audit finding as part of its 2023–24 financial statements audit.

NDIA response

In response to the original finding, the NDIA implemented processes for early notification and processing of all staff cessations. This includes NDIA staff, labour hire workers and partner organisations who have access to NDIA business systems. Since the 2023–24 financial statement audit, the NDIA has made further improvements to the process for investigating user access and activity following user termination.

Page 6

In 2024–25 the ANAO determined that the new processes ‘appeared to be designed effectively’ and the NDIA will support ANAO testing to validate that the new processes have fully addressed this audit finding.

Privileged user activity monitoring - PACE

Audit finding (from ANAO Audit report)

e As part of the ANAO’s 2022-23 financial statements audit, the ANAO found that the NDIA did not have a formal process to review privileged user activity in the PACE system. The ANAO recommended that the NDIA should assess whether the current real-time alert system meets the underlying business risks relating to privileged user access and implement a formal process to document the outcomes of alerts raised.

NDIA response

The NDIA implemented a new process where privileged user activity logs are used to generate ‘alerts’ that are investigated by a separate team to confirm whether the activity was appropriate.

Since the 2023-24 financial statement audit, the NDIA made improvements to system rules that generate an ‘alert’ and implemented a process to ensure a weekly review of the NDIA’s alert register (which records all alerts generated). This review confirms that all alerts have been investigated, and the outcome documented appropriately.

In 2024–25 the ANAO noted that the ‘design of the control appears appropriate to address the risk’. The NDIA will support ANAO testing to validate that the new processes have fully addressed the audit finding.

Privileged user access monitoring - SAP CRM

Audit finding (from ANAO Audit report)

e As part of the ANAO’s 2023–24 audit, it was identified that the NDIA uses Services Australia as the infrastructure provider for the SAP-CRM IT system. SAP-CRM is used for essential business functions such as payment delivery. Maintaining and supporting IT systems requires some user accounts to have extensive access rights (privileged access). Privileged user accounts have the potential to modify system configurations or controls and perform inappropriate or fraudulent activities with a financial impact.

Audit Findings and Responses

During the 2023–24 audit, the ANAO identified weaknesses in the effectiveness of Services Australia’s logging and monitoring of privileged user activities.

The ANAO recommended that the NDIA assess the risk of existing processes, and document and implement processes to address the identified control weakness.

NDIA response

Working with Services Australia, the NDIA has implemented a standard operating procedure to formalise privileged user access for Services Australia staff. This includes documenting activities privileged users undertake in the SAP-CRM system and the controls for logging and monitoring privileged user activity.

The NDIA has also completed a risk assessment outlining key risks and controls being relied upon to mitigate unacceptable risk and acceptance of remaining risk (within acceptable tolerances).

The NDIA will support ANAO testing to validate that processes documented in the new standard operating procedure fully address the audit finding.

Business assurance over participant plan approvals

Audit finding (from ANAO Audit report)

The NDIA performs monthly testing over participant plans to measure the quality of decision-making and compliance with NDIA operational guidelines and the relevant provisions of the National Disability Insurance Scheme Act 2013 (NDIS Act).

Results from this program provide quantitative and qualitative information to inform key stakeholders about non-compliance with legislation and guidance material, trends, risks and opportunities for improvement. The NDIA’s methodology for sample selection includes stratification and items selected based on risk.

During the 2023–24 audit, the ANAO identified that a significant proportion of the samples selected for compliance activity remained untested, with the proportion of untested items fluctuating on a month-to-month basis. The ANAO noted that:

• it is unclear whether samples tested remain representative of underlying plan approval populations; and whether the samples tested reflect the stratified and risk-based sample selection, and
• where compliance programs are not appropriately designed, or where testing is not completed as per the program’s design, there is a risk that the program does not efficiently and effectively control risks that the compliance program was designed to address.

NDIA response

The NDIA has developed a policy on the minimum sample size required for quality assurance testing to be representative of the underlying plan approval populations. This policy also ensures that there will be proportionally larger minimum samples required for more complex cohorts.

Based on this, and the introduction of processes to monitor the volume of quality assurance testing completed, the ANAO downgraded this to Category C finding in March 2025.

In 2024–25 the NDIA completed testing for 98% of the required sample size and in 2025–26 is working to ensure that 100% of samples will be tested each test period.

Governance of legal matters and legal advice

Audit finding (from ANAO Audit report)

During the 2023–24 audit, the ANAO made requests for information relating to known or suspected instances of non-compliance with laws and regulations including legal matters, whose effects should be considered in the preparation of the NDIA’s financial statements.

In 2022–23, the NDIA received legal advice on the operation of the NDIS Act in relation to debt management processes. During 2023–24, the ANAO identified weaknesses in the financial statements preparation processes with respect to the consideration of this legal advice, including the immaturity of systems and processes for determining the financial statements impact of the legal advice, and weaknesses in quality assurance processes over data extracted for related financial statements disclosures.

The ANAO noted that, in the absence of appropriate governance processes to manage, communicate and track responses to legal advice, there is a risk that matters that may affect the financial statements are not appropriately considered in the preparation of the financial statements. The absence of an appropriate control environment over data extraction processes creates risk that the extractions are not complete and accurate, which could lead to material misstatements in the financial statements.

NDIA response

The NDIA developed a Legal Services Strategy and established a Legal Risk Committee in May 2025, to improve governance processes regarding the management, communication, and tracking of responses to legal advice.

The NDIA also reviewed and updated debt management processes to address gaps identified in prior advice.

As a result of these improvements, the ANAO has downgraded this to a Category C finding and the NDIA expects this finding will be closed in 2025–26 as actions are taken in accordance with the updated debt management processes.

Auditor-General Report No. 25 2024–25 (external) Performance Statements Auditing in the Commonwealth—Outcomes from the 2023–24 Audit Program

NDIA performance statements do not include all functions (completeness)

Audit finding (from ANAO Audit report)

At the end of the 2024–25 audit, the ANAO concluded that there remain gaps / omissions related to the following:

• NDIA has not yet completed a comprehensive assessment of the completeness of performance information, considering legislative functions and key priorities as articulated in the PBS.

• Fraud and integrity performance measure only introduced for 2025–26 (assessed as ‘material omission’ resulting in ‘qualified’ audit opinion).

• Participant choice and control only included analysis on how NDIA supports participant choice and control, with results published covering participant perception of choice and control.

• No measures of efficiency (assessment of inputs / resources) over outputs.

• No measures on effect of early intervention or children (assessed as material omission resulting in qualified opinion.

NDIA response

In Q2 2025–26, the NDIA commenced a review of all performance measures with the aim of better defining the NDIA’s key activities and performance measures for these activities. The outcome of this review is expected to be completed by Quarter (Q) 3 2025–26.

Ahead of the completion of this review, a new performance measure regarding fraud and integrity will also be implemented in 2025–26.

NDIA appropriateness of performance statements measures (risk of bias /

reliability of data)

Audit finding (from ANAO Audit report)

In 2024–25, the ANAO assessed NDIA’s amended performance measures and found the following measures that present a risk of non-compliance with Commonwealth Performance Framework:

• PSG performance measure only includes 10 of 20 PSGs (resulting in an ‘emphasis of matter’ due to data availability).

• Revised targets for average payment per participant and annualised scheme growth rate were not disclosed, creating a risk of ‘bias’.

Measures for participants with community and mainstream supports in plans and payment made within agreed timeframes do not appear to measure performance of relevant NDIA activities.

NDIA response

In Q2 2025–26, the NDIA commenced a review of all performance measures with the aim of better defining the NDIA’s key activities and performance measures for these activities. The outcome of this review is expected to be completed by Q3 2025–26.

This will include review of the PSG metrics to determine the most appropriate measures to monitor performance. Revised measures are expected for the 2026-27 Corporate Plan. Additionally, in Q1 2025–26, the NDIA increased commenced reporting on PSG performance to cover 19 of the 20 PSG targets.

Corporate plan performances measures handbook requires additional information

Audit finding (from ANAO Audit report)

At the end of the 2024–25 audit, the ANAO concluded that sufficient improvements have been made to the NDIAs ‘Corporate Plan Performance Measures Handbook’ to downgrade this finding from ‘B’ to ‘C’. However, the ANAO noted that the following could be improved / undertaken:

• Comprehensive assessment of the completeness of performance information.
• Inclusion of a documented policy or process to support determination of what functions, activities, priorities or areas of interest should be considered for inclusion in suite of published performance measures.

NDIA response

In 2024–25, the NDIA continued to enhance documented procedures for performance reporting in its Corporate Plan Performance Measures Manual (Manual), and this has resulted in the issue being downgraded to Category C. In 2025–26, the ANAO has made new recommendations to continue enhancing this Manual with a documented policy and procedure to assist decision-makers determine what functions or activities are included in performance measures.

Increase and improve level of detail in performance measure methodology documentation

Audit finding (from ANAO Audit report)

At the end of the 2024–25 audit, ANAO recommended a review of the content and level of detail included in performance measure methodology documentation. ANAO recommended that the information should be collated into one comprehensive document which articulates all details required to understand and conduct end-to-end performance statements processes.

NDIA response

In 2024–25, the NDIA made updates to the Manual to better document performance measure methodologies, resulting in the issue being downgraded to Category C. The ANAO will further review documented methodologies for measures in 2025–26.

The NDIA is working to update the Manual with new version expected to be formalised in Q3 2025–26.

Auditor-General Report No. 41 2024–25 (external)

Effectiveness of the Board of the National Disability Insurance Agency

Management of conflict of interest for Board members

Audit finding (from ANAO Audit report)

The ANAO made observations on documentation of strategies to manage conflict of interest where Board members are participants or have family members who have participants. The report suggests sending correspondence to the minister under section 132 of the NDIS Act addressing the member’s employment that gave rise to the potential conflict of interest and for Board meetings minutes to clearly note where a member excused themselves from the meeting or voting.

NDIA response

The NDIA Board processes have been reviewed and updated to document relevant procedures and identified ANAO improvements. These changes are due to be included as part of the annual Charter review which will progress for Board approval in March 2026.

Frequency of review of risk management framework

Audit finding (from ANAO Audit report)

The ANAO highlighted that the risk management framework needs to be reviewed and reported to Board. Under subsection 7(1)(a) of the NDIS Risk Management Rules, the Board is required to ensure that reviews of the Risk Management Framework are ‘effective and comprehensive’ and are conducted by ‘operationally independent and appropriately trained and competent’ people.

The ANAO recommended that Board define the frequency of review of the Risk Management Framework having regard to the size and complexity of the NDIA’s operations and implement mechanisms to ensure the reviews are conducted within these timeframes.

NDIA response

The NDIA is currently commissioning an external party to undertake an independent review of the NDIA’s risk management framework. The scope of this review includes setting the frequency of ongoing reviews for the risk management framework. The review is expected to be completed in Q4 2025–26.

Strengthening Board’s Oversight of Entity Performances

Audit Finding (from ANAO Audit report)

The ANAO found that, overall Board’s governance was largely effective. The ANAO observed occurrences of Board members constructively challenging management in relation to reporting on entity performance results that did not meet targets, issues and risks. These occurrences were inconsistent and did not reflect an established practice.

The ANAO recommends that the Board, including through its committees, strengthen its oversight of entity performance by more consistently responding to management reporting with requests for relevant further information, reporting or assurance from management where results are below targets, assumptions are unclear, or other issues or risks are raised.

NDIA Response

The NDIA has strengthened processes to support the Board in its oversight role. This includes more consistent capturing of information on risks, issues and performance issues raised in prior meetings through a revised template for Board papers based on Australian Institute of Company Directors guidance.

Auditor-General Report No. 48 2024–25 (external) National Disability Insurance Agency’s Management of Claimant Compliance with National Disability Insurance Scheme Claim Requirements

Corporate compliance frameworks and related policies and procedures

Audit finding

The ANAO observed that the NDIA has partly effective frameworks and processes in place to manage claimant compliance with NDIS claim requirements and is implementing a large program of work to remediate identified deficiencies, with a target completion date of December 2025. A fit-for-purpose framework for claim compliance is recommended.

NDIA Response

As part of a program of work the NDIA is undertaking to improve alignment with the 2024 Commonwealth Fraud and Corruption Policy, the NDIA will be updating relevant compliance frameworks, policies, procedures and current practices to address key non-compliance risks. This includes a refreshed Compliance and Enforcement Framework (CEF), which is a publicly facing instrument and explains the Agency’s integrity approach.

The new CEF is currently progressing with final approval expected in Q3 2025–26.

Risk assessments – fraud and operational levels

Audit finding (from ANAO Audit report)

The ANAO found that the NDIA’s oversight and monitoring of claim compliance has been inconsistent, with frequent changes to reporting and oversight arrangements.

Briefing on the status of integrity initiatives has been provided with varying frequency to the NDIA Board, other decision-makers and oversight committees. A range of assurance mechanisms for the Crack Down on Fraud program has been put in place.

Increased risks for claim compliance and significant gaps in existing controls have been identified by NDIA. NDIA has not updated its control assessments at the fraud and operational levels to reflect these identified control weaknesses.

NDIA response

The NDIA is working to holistically review and revise structures to enable consistent and continuous assessment, monitoring and reporting on all fraud and non-compliance risks. This will include better aligning fraud and corruption frameworks and risk assessment methodologies with Commonwealth policies and best practice guidance, ensuring accountabilities are clearly documented and understood, and that required internal capability is in place.

Fraud and corruption oversight is facilitated through formalised quarterly reporting to executive leadership and the NDIA Board meetings. This provides visibility of enterprise-level fraud and corruption risks.

The NDIA has also completed a review of all fraud and corruption controls, with remediation activities currently underway. To strengthen governance, the NDIA has established a dedicated fraud risk function and will implement a new Commonwealth aligned fraud and corruption risk assessment methodology at the operational and effective from Q3 2025–26.

Payment Assurance Testing

Audit Finding (from ANAO Audit report)

The ANAO found that the NDIA conducts assurance testing to estimate payment error rates and identify opportunities for continuous improvement. It does not have robust processes to monitor the implementation of identified improvement opportunities, and it has acknowledged that measured error rates underestimate fraud and non-compliance losses.

In October 2023, the NDIA made commitments to the government to achieve savings and benefits from the Crack Down on Fraud program. The NDIA has not provided reporting against these commitments to the government or the Disability Reform Ministerial Council.

The NDIA is implementing IT systems upgrade through the Crack Down on Fraud program, with a target completion date of December 2025, which aims to increase its capacity to use data analytics to support continuous improvement in claim compliance.

NDIA Response

A number of continuous improvements were made to payment assurance testing during calendar years 2024 and 2025, including increasing sample sizes (especially of self-managed claims) and improved monitoring of referrals for compliance review to other teams. Further improvements are underway during 2026, including applying risk scoring.

In addition, the NDIA has developed a method for measuring integrity losses to the NDIS which is broader than the scope of payment assurance testing. The current estimate of integrity losses to the NDIS is 6-10%.

Combined savings and benefits from Fraud Fusion Taskforce, CDoF program and Payment Integrity, are reported quarterly to the NDIA Board, and reporting is included in the Quarterly Report to Disability Ministers.

The CDoF program delivered against 34 milestones that were committed to Government. Thirty-three milestones were completed and one milestone was retired as it was addressed by other milestones. Completion of these milestones resulted in improvements to the integrity of the NDIS and provides ongoing support in service delivery, integrity management, participant safeguarding and compliance across NDIA operations.

Reporting to Government on progress against committed savings, benefits

and performance measures from compliance initiatives

Audit finding (from ANAO Audit report)

ANAO identified the following issues with the reporting against 10 performance measures that went to the Crack Down on Fraud Program Board in February 2025:

• The NDIA did not provide sufficient detail in explanatory notes in reporting, including how savings are calculated, the year the savings have been applied (when compliance intervention occurred or when savings are expected), and how data from validated myGov accounts is used.

• An incorrect payment error rate was used, resulting in reporting as ‘over target’ in 2023–24 when it should have been reported as ‘off track’.

NDIA response

The NDIA is currently updating reporting to provide a clearer and more consistent approach on suitable methodologies and reporting on savings. Enhanced reporting will provide clarity on savings, including the period this is achieved and clear explanatory notes on methodologies and data used. This is planned for Q3 2025–26.

Additionally, processes for recording payment error rates were amended by Q4 2024–25 to ensure ongoing reporting on the payment error rate is accurate.