National Disability Insurance Scheme (Approved Quality Auditors) Rules 2025

The Rules operate through a set of defined concepts that allocate decision inputs, ongoing conditions, and cross‑references to external accrediting and regulatory mechanisms. Definitions in section 4 (and the note that section 9 of the Act also defines expressions) are the starting point. Key concepts include:

• AQA and applicant: An AQA is a person or body approved by the Commissioner under s 73U of the Act; an applicant is a person or body who has applied under that provision (s 4). The Rules therefore apply to both individual and corporate applicants, and to approvals granted under the Act.

• JASANZ and JASANZ accreditation: JASANZ (Joint Accreditation System of Australia and New Zealand) and JASANZ accreditation are defined and referenced as matters the Commissioner must or may have regard to (s 4; s 6(2)(a); s 7(2)(a)). JASANZ is identified as the body responsible for accreditation of certification bodies and certification bodies may have received JASANZ accreditation towards becoming an AQA (s 4).

• AQA Guidelines and AQA Code of Conduct: The Rules embed the AQA Guidelines 2018 and the AQA Code of Conduct in two ways. First, the AQA Guidelines are defined and referenced as existing from time to time (s 4). Second, compliance with the AQA Code of Conduct is both a matter the Commissioner may consider (s 7(2)(b); s 8(2)(a)) and an express condition of approval (s 11). The Code sits in Annex A of the Guidelines and is applied to AQAs and their auditors and personnel.

• Banning orders: The Rules repeatedly reference banning orders. The Commissioner must consider whether a banning order has ever been in force in relation to the applicant or any member of the applicant’s key personnel when deciding to give or refuse approval (s 6(2)(c)). A condition of approval forbids employing or continuing to employ or engage as audit team members, or as key personnel, any person against whom a banning order has been made (s 10). Banning orders themselves are instruments under the Act and are referred to by the Rules; the Rules do not create banning orders (s 4 note).

• Participant‑centred audit practice: The Rules require the Commissioner to have regard to an applicant’s ability to undertake participant‑centred audit practice when deciding whether to approve (s 6(2)(f)) and to consider that ability at revocation time (s 8(2)(i)). The phrase is used as a capability standard the Commissioner must evaluate.

• Discretionary and mandatory considerations: The Rules distinguish items the Commissioner must have regard to (s 6) from items the Commissioner may have regard to when imposing conditions (s 7) or revoking approvals (s 8). This distinction affects the predictability of decision‑making inputs.

These concepts organise who the Rules regulate, what credentials and behaviour they prioritise, and how the Commissioner may rely on external accreditation and information sources. They also create cross‑linkages: for example a banning order status (an external supervisory outcome under the Act) feeds directly into both approval and continuing eligibility (s 6(2)(c); s 10).

The instrument identifies several classes of affected persons and bodies, and it does so by definition and by operational effect.

• Applicants for AQA approval: A person or body that makes a request to be approved under section 73U of the Act is an applicant (s 4). The Rules affect them at the application stage because the Commissioner must have regard to the list of matters in section 6 when deciding whether to approve (s 5(2)(a); s 6).

• Approved quality auditors (AQAs): Entities that hold approval under s 73U of the Act are subject to conditions that apply to all AQAs (s 9). The conditions are operational constraints on staffing and professional conduct (s 10; s 11). AQAs are also affected by the potential for revocation, where the Commissioner may consider non‑compliance, conduct, conflict of interest, JASANZ information, Commission assessments and accreditation status (s 8).

• Auditors and audit team members: The Rules define auditor broadly to include persons employed, contracted or otherwise engaged by the AQA to conduct an audit, and specifically include auditors‑in‑training and audit team leaders (s 4). The condition in s 11 binds auditors and personnel to comply with the AQA Code of Conduct, and s 10 directly restricts the AQA from engaging persons against whom banning orders have been made as members of an audit team.

• Key personnel of AQAs: The Rules refer repeatedly to key personnel as relevant to approval (s 6(2)(c)) and to conditions (s 10(b)). If a member of key personnel has ever been subject to a banning order this affects both approval and continued approval. The AQA must not have such a person as key personnel while approved (s 10(b)).

• Certification bodies and JASANZ: Entities that are certification bodies seeking JASANZ accreditation are affected indirectly. The Commissioner must consider whether an applicant holds or has held JASANZ accreditation (s 6(2)(a)), and may take into account accreditation status when imposing conditions (s 7(2)(a)). The Rules also permit the Commissioner to rely on information from JASANZ regarding an AQA’s performance (s 8(2)(d)). Certification bodies who have received JASANZ accreditation towards becoming an AQA are included in the definitions (s 4).

• The Commissioner (and the Commission): While not a target of compliance, the Rules structure the Commissioner’s decision‑making. The Commissioner must have regard to specified matters (s 6) and may have regard to others (s 7; s 8). The Commissioner is the decision maker for approvals, conditions and revocations under the Act and these Rules guide that exercise (s 5(2)).

Notably absent are explicit references to appeal rights, procedural timelines, or monetary penalties in the Rules themselves. The Rules regulate the approval process and ongoing conditions rather than setting out detailed procedural steps for applicants or enforcement mechanisms beyond the matters that may be considered for revocation and the conditions imposed on approvals (Part 2; Part 3).

The Rules create duties for AQAs, and they create inputs the Commissioner must or may take into account when exercising statutory powers under the Act. They do not themselves create standalone rights of appeal or discrete statutory penalties. The principal duties and rights established by the instrument, with the relevant source passages, are:

• Duty to avoid employing persons subject to a banning order. The approval of an AQA is subject to the condition that the AQA must not employ or engage, or continue to employ or engage, as a member of an audit team a person against whom a banning order has been made; and must not have such a person as a member of its key personnel (s 10). This is a continuing obligation while the approval subsists.

• Duty to ensure compliance with the AQA Code of Conduct. Every AQA must ensure that the AQA and all auditors and personnel comply with the AQA Code of Conduct (s 11). The Code is located in Annex A of the AQA Guidelines (s 4). The duty is comprehensive, covering all auditors and personnel including auditors‑in‑training and audit team leaders (s 4 definition of auditor).

• Commissioner’s mandatory consideration list. When deciding whether to give or refuse approval the Commissioner must have regard to specified matters: JASANZ accreditation history; prior AQA approval history; any banning order in relation to the applicant or key personnel; experience as a certification body; understanding of the NDIS; ability to undertake participant‑centred audit practice; and real or perceived conflicts of interest including mitigation strategies (s 6(2)(a)-(g)). These factors are statutory inputs the Commissioner must consider.

• Commissioner’s discretionary considerations. The Commissioner may have regard to the applicant’s JASANZ accreditation status and any non‑compliance with the AQA Guidelines, including the Code, when deciding whether to make an approval subject to conditions (s 7). For revocation decisions the Commissioner may have regard to a longer list that includes non‑compliance with the Guidelines, conduct, conflicts of interest, JASANZ information on performance, Commission assessments of audit quality, JASANZ accreditation suspension or revocation, banning orders, understanding of the NDIS, and ability to undertake participant‑centred audit practice (s 8).

• Rights implicit through definitions and statutory framework. The Rules themselves do not state express procedural rights such as notice, review or appeal. They do, however, tie approval and revocation to specified matters and external accreditation, which creates predictable evidential focal points an applicant or AQA can address. The Act provides the statutory architecture for approvals and banning orders; these Rules are expressly framed as made for the purposes of particular subsections of the Act (s 5(1); s 9(1)), so the rights and duties that depend on the Act remain applicable.

• Application of external standards. AQAs are obliged to operate under standards established externally via the AQA Guidelines and JASANZ accreditation regimes. Compliance with those standards is both a matter for the Commissioner to consider and, through s 11, an express condition of approval.

Overall the Rules convert a set of criteria and conditions into enforceable elements of approval. They do not themselves set out enforcement processes or administrative appeal routes; enforcement is effected through the Commissioner’s decision‑making powers under the Act, with the Rules specifying the evidentiary and substantive matters the Commissioner must or may consider.

The Rules do not create new fines, criminal offences, or a separate enforcement apparatus within the instrument. Instead, the Rules operate by attaching conditions to approvals and by specifying the matters the Commissioner may consider when revoking an approval. The practical enforcement pathways established or referenced in the instrument are therefore administrative.

• Conditions as enforceable constraints. Two mandatory conditions apply to every AQA approval: the prohibition on employing or engaging persons against whom a banning order has been made, either as members of an audit team or as key personnel (s 10), and the obligation to ensure compliance by all auditors and personnel with the AQA Code of Conduct (s 11). Non‑compliance with these conditions is addressed indirectly: non‑compliance with the AQA Guidelines, including the Code, is expressly listed as a matter the Commissioner may consider in relation to making approvals subject to conditions (s 7(2)(b)) and in relation to revocation (s 8(2)(a)). This links breaches of the conditions to potential administrative consequences up to revocation.

• Revocation as the principal enforcement tool. The Commissioner may revoke an approval and the Rules list matters that the Commissioner may consider in deciding whether to revoke an approval (s 8(1)-(2)). Those matters include non‑compliance with the AQA Guidelines and Code, conduct and compliance with relevant policies and standards, conflicts of interest, information from JASANZ about performance, Commission assessments of audit and report quality, suspension or revocation of JASANZ accreditation, prior banning orders, and the AQA’s understanding of the NDIS and ability to undertake participant‑centred auditing (s 8(2)(a)-(i)). Revocation is therefore the instrument’s principal regulatory sanction.

• Use of external information for enforcement. The Commissioner may have regard to information from JASANZ about an AQA’s performance (s 8(2)(d)) and to JASANZ accreditation status (s 8(2)(f)). The Rules thus make the Commissioner’s enforcement posture partially dependent on information and decisions produced by an external accreditation body.

• No new penalty provisions in the Rules. The instrument does not specify monetary penalties, infringement notices, or criminal sanctions. It also does not set out the procedural mechanics for imposing or lifting conditions, or for undertaking revocation. Those procedural mechanisms are located in the Act (the Rules are made under the Act (s 3)) but are not restated here. The Rules therefore establish substantive conditions and decision‑making inputs but leave procedural enforcement mechanisms to the parent legislation and to Commission practice.

• Banning orders as an enforcement input. The instrument treats banning orders both as a prior disqualifying fact (s 6(2)(c)) and as a continuing condition trigger (s 10). It does not create banning orders but draws them into the approval and ongoing compliance calculus.

In short, enforcement under these Rules is administrative: conditions attached to approvals, and revocation of approvals, are the operative enforcement levers. The Rules link those levers to JASANZ and the AQA Guidelines for evidential and performance information but do not themselves create express standalone penalties or detailed procedural steps.

The Rules are explicitly made under the National Disability Insurance Scheme Act 2013 and are intended to give content to particular subsections of that Act. They therefore interact with the Act in a subordinate, implementing capacity. The instrument also interacts with external regulatory standards and accreditation systems by reference.

• Interaction with the Act. The Rules state their authority plainly: they are made under the Act (s 3). Several provisions explicitly state that the Part is made for the purposes of specific subsections of the Act: Part 2 is made for the purposes of subsection 73U(9A) (s 5(1)); Part 3 is made for the purposes of subsection 73U(4A) (s 9(1)). The Rules therefore operate as detailed, subordinate guidance on the factors the Commissioner must or may take into account and the conditions that must be imposed on approvals as required or permitted by those subsections of the Act.

• Interaction with banning orders and other Act mechanisms. The Rules refer to banning orders as a factual input to approval and as a proscribed employment/engagement condition (s 6(2)(c); s 10; s 8(2)(g)). Banning orders are instruments under the Act; the Rules rely upon that separate statutory mechanism rather than replicating it. The Rules do not define banning orders themselves but take their existence and effect as given.

• Interaction with JASANZ and external accreditation regimes. The Rules link approval decisions and ongoing compliance to JASANZ accreditation. The Commissioner must consider whether the applicant holds or has held JASANZ accreditation (s 6(2)(a)), may have regard to accreditation status when imposing conditions (s 7(2)(a)), and may regard information from JASANZ about performance when deciding revocation (s 8(2)(d)). This creates an interdependence: technical accreditation is supplied by JASANZ, while statutory approval is given by the Commissioner. The Rules therefore rely on external standards and the outputs of an accreditation body.

• Interaction with the AQA Guidelines and Code. The Rules incorporate the AQA Guidelines and the AQA Code of Conduct by reference and treat them as living instruments, describing them as existing from time to time (s 4). This means that the substantive expectations for AQAs are partly defined outside these Rules and will evolve as the Guidelines change. The Commissioner may consider non‑compliance with the AQA Guidelines and Code both when imposing conditions (s 7(2)(b)) and when considering revocation (s 8(2)(a)), and compliance with the Code is an express condition of approval (s 11).

• Interaction with Commission processes and assessments. The Rules permit the Commissioner to take into account Commission assessments of the quality of audits and reports undertaken by an AQA when considering revocation (s 8(2)(e)). This ties the Rules to internal Commission monitoring and assessment processes.

• Absence of cross‑references to other statutes or procedural regimes. The Rules do not reference other federal or state statutes, nor do they set out procedural rights such as review or appeal within the instrument itself. Any interaction with administrative law remedies, merits review or judicial review frameworks is therefore only implied through the Act and general administrative law, and is not specified in the Rules.

Overall the Rules form a node between the Act’s approval and banning mechanisms, external accreditation by JASANZ, and the AQA Guidelines/Code. They do not, however, create separate enforcement or appeal mechanisms beyond that web of interactions.

The Rules contain limited internal amendment metadata. The instrument includes a commencement table which states that the whole instrument commences the day after it is registered (s 2(1)). An editorial note states that the commencement table relates only to the provisions as originally made and that the table will not be amended to reflect later amendments (s 2 note). The Rules also include a note that information in column 3 of the commencement table is not part of the instrument and may be edited in published versions (s 2(2)). Beyond this commencement information, the instrument does not record any prior amendments or a revision history within the text provided.

The Rules do, however, incorporate by reference other instruments described as "as existing from time to time". Specifically, the AQA Guidelines are defined as the National Disability Insurance Scheme (Approved Quality Auditors Scheme) Guidelines 2018 "as existing from time to time" (s 4). JASANZ accreditation is defined with the same "as existing from time to time" qualifier in relation to the AQA Guidelines (s 4). Those dynamic references mean the substantive expectations for AQAs may change without amendment to these Rules, since those external instruments may be revised. The Rules therefore create a coupling to an external amendment process: updates to the AQA Guidelines or to JASANZ accreditation standards will have practical effect for AQAs.

There is no provision in the Rules itself which logs prior versions, amendments, or revocation dates. The instrument’s own note on the commencement table (s 2(2)) makes explicit that published metadata may be edited but is not part of the instrument. If and when these Rules are amended, the legislative register or Federal Register of Legislation would be the place to observe the recorded amendment history; the instrument itself does not contain that history.

Finally, the Rules reference statutory subsections of the Act (for example subsection 73U(9A) and 73U(4A)) as the provisions for which Parts 2 and 3 are made (s 5(1); s 9(1)). Any amendment to those subsections in the Act could change the operative statutory context for these Rules even if the Rules themselves remain unamended.

The instrument contains no references to case law, judicial decisions, or any litigation history. It does not cite any judicial authority, nor does it record past administrative appeals or outcomes. There are no named cases within the text. The Rules are focused on specifying matters the Commissioner must or may regard and conditions of approval; they do not summarise, refer to, or restate any litigation concerning the AQA scheme.

The absence of litigation references within the text is in itself a usable observation for practitioners: the Rules do not memorialise prior contested decisions or appellate guidance that would otherwise clarify how the Commissioner interprets terms such as "participant centred audit practice", "real or perceived conflict of interest" or the operation of the AQA Code of Conduct. As a result, the Rules stand primarily as a statement of administrative inputs and conditions rather than a codified record of dispute outcomes.

Because the Rules do not set out appeal procedures, the instrument is silent on internal review or merits review rights in this text. Any judicial review or appeal pathways would be found in the Act or in other procedural instruments rather than in these Rules. The Rules’ silence about litigation history means that practitioners should not expect authoritative judicial interpretation to be embedded in this instrument. Assessments of how the Commissioner will apply the criteria listed in sections 6 to 8 will therefore depend upon the Commission’s practice, the AQA Guidelines, JASANZ reporting, and any external decisions recorded elsewhere.

In short, there is no litigation history recorded in the Rules. Practitioners needing precedential or contested‑decision guidance will need to consult the Act, Commission administrative decisions, the AQA Guidelines, and any relevant external tribunal or court decisions outside this instrument.

The Rules are compact but carry several points where compliance or interpretation risks arise because of cross‑referencing, inchoate standards, and the distinction between mandatory and discretionary considerations. The principal "gotchas" to watch for, grounded in the text, are:

• Dynamic external references. The AQA Guidelines and the AQA Code of Conduct are adopted "as existing from time to time" (s 4). That wording means substantive requirements for AQAs can change without amendment to these Rules. Practitioners should not assume the Rules alone define the operative Code or Guidelines; the current version of the Guidelines controls.

• Mandatory versus discretionary "have regard" obligations. Section 6 lists matters the Commissioner must have regard to when deciding to give or refuse an approval (s 6(2)), while sections 7 and 8 list matters the Commissioner may have regard to when imposing conditions or revoking approvals (s 7(2); s 8(2)). "Must have regard" does not guarantee approval; it requires the Commissioner to consider specified items. Conversely "may have regard" gives the Commissioner discretion and therefore reduces predictability. Applicants and AQAs should address both categories but be aware the Commissioner’s discretion is preserved.

• Broad definitions of auditor and key personnel. The definition of auditor includes auditors‑in‑training and audit team leaders (s 4). The prohibition in s 10 on employing persons subject to banning orders applies to members of audit teams and to key personnel (s 10(a)-(b)). This coverage means vetting obligations extend beyond senior auditors to include trainees and team leaders. Failure to screen all such persons could breach an express condition.

• Interdependence with JASANZ. The Commissioner must consider whether an applicant holds or has held JASANZ accreditation (s 6(2)(a)) and may consider JASANZ information about performance when revoking (s 8(2)(d)). Certification bodies that do not pursue or maintain JASANZ accreditation will face a evidential disadvantage; likewise, adverse JASANZ findings can be used against an AQA in a revocation context.

• Conflicts of interest assessed both as real and perceived. Section 6(2)(g) requires regard to "any real or perceived conflict of interest, including any mitigation strategies". The inclusion of "perceived" expands the Commissioner’s concern beyond actual conflicts to reputational or apparent conflicts, increasing the need for documented mitigation.

• Compliance with the Code is an express condition. Section 11 requires AQAs to ensure they and all auditors and personnel comply with the AQA Code of Conduct. Non‑compliance is specifically listed as a relevant matter in both s 7(2)(b) and s 8(2)(a). Since the Code is in Annex A of the Guidelines, practitioners must monitor the current Code and have systems to ensure compliance across all staff categories.

• No procedural detail on enforcement. The Rules do not set out notice periods, show‑cause procedures, or appeal rights relating to conditions or revocation. The instrument is silent on procedural protections and on how the Commissioner will operationalise the "may have regard" matters. This silence increases the importance of engaging with the guidelines and Commission processes and documenting compliance proactively.

• The scope of "participant centred audit practice" is unspecified. The Commissioner must have regard to an applicant’s ability in this area (s 6(2)(f); s 8(2)(i)). The Rules do not define the term, so AQAs must look to the AQA Guidelines and Commission practice to determine what evidence satisfies this obligation.

• Potential for cascading consequences. A suspension or revocation of JASANZ accreditation is a matter the Commissioner may consider for revocation (s 8(2)(f)). Therefore an adverse finding in the accreditation process can cascade into administrative consequences under the Act via these Rules.

These are not theoretical risks; they follow from the Rules’ structure and language. Addressing them requires attention to the AQA Guidelines, robust vetting and HR policies, documented conflict mitigation, and active maintenance of JASANZ accreditation where relevant.

Compliance under these Rules is a mix of pre‑approval evidence, ongoing operational controls, and monitoring of external instruments. The following steps are grounded in the Rules’ provisions and indicate the practical measures applicants and AQAs should adopt.

1. Obtain and maintain JASANZ accreditation where possible. The Commissioner must have regard to whether an applicant holds or has held JASANZ accreditation (s 6(2)(a)) and may consider accreditation status in imposing conditions (s 7(2)(a)). Certification bodies seeking to become AQAs should pursue JASANZ accreditation and document accreditation history and status.

2. Vet key personnel and audit team members for banning orders. The approval and condition regime makes banning orders a disqualifying factor. The Commissioner must consider whether a banning order has ever been in force in relation to the applicant or any member of the applicant’s key personnel (s 6(2)(c)), and the approval condition forbids employing or engaging anyone against whom a banning order has been made as a member of an audit team or as key personnel (s 10). Implement background checks, ongoing screening and recordkeeping for all key personnel, auditors, trainees and team leaders.

3. Implement and evidence participant‑centred audit capability. The Commissioner must have regard to an applicant’s ability to undertake participant‑centred audit practice (s 6(2)(f)) and may consider that ability at revocation (s 8(2)(i)). Ensure training, methodology documents, audit templates and client engagement processes demonstrate participant‑centred approaches, and retain records evidencing the practice.

4. Adopt and operationalise the AQA Code of Conduct. Compliance with the Code is an approval condition (s 11) and non‑compliance is a matter relevant to conditions and revocation (s 7(2)(b); s 8(2)(a)). Obtain the current AQA Code from Annex A of the AQA Guidelines and put in place policies, training, monitoring and disciplinary procedures to ensure all auditors and personnel comply. Keep signed acknowledgements and training logs.

5. Address conflicts of interest comprehensively and document mitigation. The Commissioner must consider real or perceived conflicts of interest and mitigation strategies at approval time (s 6(2)(g)). Maintain a conflicts register, conflict‑management policies, and documented mitigation steps for each identified conflict. Consider public disclosure where appropriate.

6. Maintain records of experience and understanding of the NDIS and of certification activity. The Commissioner will have regard to experience as a certification body and understanding of the NDIS (s 6(2)(d)-(e)). Prepare a portfolio of previous certification work, CVs of key personnel, training materials about the NDIS, and evidence of sector engagement to support applications and to meet Commission inquiries.

7. Monitor JASANZ and AQA Guidelines updates. The Rules reference the AQA Guidelines and JASANZ accreditation "as existing from time to time" (s 4). Subscribe to updates and ensure internal procedures are reviewed when external standards change. Map changes in the Guidelines or JASANZ requirements to operational adjustments and training.

8. Prepare for Commission assessment of audit quality. The Commissioner may rely on Commission assessments of the quality of audits and reports (s 8(2)(e)). Implement quality assurance processes, peer review, file retention, and post‑audit documentation so that audit quality can be demonstrated if assessed.

9. Build HR and contracting controls to implement s 10 and s 11. Employment contracts, contractor agreements and induction processes should include clauses requiring compliance with the AQA Code and representations regarding banning orders and conflicts. Implement contract termination triggers for breaches relevant to the Rules.

10. Keep evidence trail for any discretionary matters. Because sections 7 and 8 list discretionary matters the Commissioner may consider, maintain documentary evidence on matters that might inform conditions or revocation decisions: accreditation status, any incidents of non‑compliance and remediation actions, outcomes of internal or external investigations, and records of communications with JASANZ and the Commission.

11. Seek clarity where necessary from the Commission. The Rules leave procedural mechanics unstated. If there is uncertainty about how the Commissioner will assess particular matters (for example the content of "participant centred audit practice") practitioners should raise these questions with the Commission or rely upon the AQA Guidelines, which the Rules incorporate.

These steps follow directly from the Rules’ textual requirements. Compliance is a combination of credentials (JASANZ), personnel vetting (banning orders), documented practice and conduct (Code), and ongoing monitoring and recordkeeping to meet the Commissioner’s evidential expectations.