What Are the Current Compliance Guidelines for NDIS Self-Management?

Compliance is one of those words that makes people's eyes glaze over. It sounds like something that applies to big organisations with legal teams and audit departments, not to individuals managing their own disability funding.

But if you self-manage your NDIS plan, compliance applies to you. Directly. Personally. And understanding what it actually means in practice is one of the more useful things you can do to protect yourself and keep your self-management running smoothly.

The good news is it's not as complicated as it sounds once you strip away the language. Most of what compliance requires of self-managers is stuff that good self-management already involves. The compliance framework just makes it formal and gives it consequences.

This is what you actually need to know.

What Compliance Means for a Self-Manager Specifically

There's an important distinction worth making upfront. Most compliance content you'll find online is written for providers, not participants. The rules around audits, practice standards, incident reporting, and registration requirements are primarily aimed at organisations delivering NDIS services. As a self-managed participant, a different set of obligations applies to you.

Your compliance obligations as a self-manager come from the NDIS Act itself and the rules that flow from it. They cover four main areas:

• Spending your funding in line with your approved plan and the supports described in it
• Keeping records that demonstrate your spending was appropriate, for a minimum of five years
• Cooperating with payment reviews when the NDIA asks you to show evidence of how your funds were used
• Telling the NDIA about significant changes in your situation that might affect your ability to self-manage

That's the core of it. Four obligations. Everything else flows from those.

Spending in Line With Your Plan

This is where most compliance issues for self-managers actually originate, and it's worth spending some time on because the rules here are more specific than most people realise.

Every support you purchase with your NDIS funding needs to be connected to the goals in your plan and fall within your approved support categories. The NDIA's Compliance Program Branch is very specific about this. When they review a self-managed participant's spending, they're checking whether each payment request was compliant with the plan and consistent with what was approved.

The concept they apply is called reasonable and necessary. Under section 34 of the NDIS Act, supports must meet this standard. In practical terms it means the support needs to:

• Be directly related to your disability
• Help you work toward your plan goals
• Represent good value compared to other available options
• Not be something that should be funded by another government service

That last point trips people up sometimes. Dental, health, hospital, education, housing and public transport all fall under other government systems. NDIS funding isn't for those things even if you need them and even if they relate to your disability.

The key thing to understand is that the reasonable and necessary criteria is what your plan was built on. If a support was approved in your plan, the expectation is that it meets the criteria. What gets you into compliance trouble is spending on things that aren't in your plan or that sit in the wrong budget category.

The Records Requirement — What You Actually Need to Keep

Five years. That's the minimum time you need to keep records as a self-manager. It's a non-negotiable requirement and it covers more than just invoices.

The full picture of what you need to hold onto:

• Invoices and receipts for every support purchased
• Bank statements showing NDIS-related transactions
• Service agreements with every provider you've used
• Any correspondence with providers about the supports they delivered
• If you directly employ staff, payroll records including hours worked, wages paid, superannuation and tax documentation

For directly employed staff, the record-keeping obligation actually extends to seven years to align with standard Australian business record-keeping requirements. Most self-managers who employ their own support workers don't realise this and only keep records for five. Worth knowing upfront rather than discovering it during a review.

Every invoice needs to include the provider's name and ABN, the date of service, a description of the support, which category it falls under, and the amount. If invoices don't have all of that, they're not useful as compliance evidence. Ask providers to reissue anything that's incomplete. A correct invoice is worth the two-minute conversation it takes to request one.

Payment Reviews — What Actually Happens

A lot of self-managers worry about audits. The reality is that what the NDIA mostly does is payment reviews, which is a slightly different thing and less dramatic than the word audit suggests.

A payment review occurs when the Compliance Program Branch of the NDIA finds something to check in your claims history. It can be caused by something in your expenditure that does not appear normal, a statement that does not coincide with the supporting facts, or even some random sample. This is the NDIA review of both provider and self-managed claims that is undertaken regularly.

Should you receive a payment review notice, what you are going to be requested to do is to submit the invoices, receipts or any other proof that you did spend in accordance with your plan. You will be provided with a time limit to answer and contact information of the individual doing the review. They can be contacted during the process in case you have questions.

The NDIA has even come out publicly to say that they know self-managers make mistakes, and they would prefer to assist people to remedy them before they turn out to be serious problems. In the event of no justifiable basis of a claim, they can revoke pending payments or increase a debt. Considering that some problems are severe or chronic, they may also restrict or deny your future self-management capability.

So the compliance goal isn't to be perfect. It's to have genuine records that support genuine spending. If your records are organised and your spending is in line with your plan, a payment review is manageable rather than frightening.

The Eligibility Assessment — New Criteria Now in Place

Self-management eligibility isn't automatic. The NDIA assesses whether self-management is appropriate for your situation, and the criteria they use have been updated and tightened.

The NDIA looks at three main things when assessing a self-management request:

Your financial track record. Have you managed NDIS funding responsibly in the past? Overspending, misuse, or patterns that suggest the funding hasn't been used in line with the plan all come into consideration here.

Your current financial and legal situation. Being involved in bankruptcy proceedings or certain insolvency arrangements is relevant. The concern is straightforward: someone whose personal finances are significantly compromised may face risks when managing a separate NDIS budget.

Whether your overall situation presents unreasonable risk. This is evaluated on a case by case basis. It does not matter what type of disability you have or what is your funding. It is whether the conditions indicate that self-management will expose you or the scheme to risks.

When the NDIA has issues, it does not necessarily say no. They have an opportunity to provide shorter plan periods in order to have more frequent reviews, recommend initial self-management partial rather than one category support, or, provide training support to develop financial management skills and then assume the full responsibility.

What is interesting to learn about these criteria is that they are not aimed to decrease participation in self-management. They are structured to help in cases where a person was silently going through it and providing them with an improved direction. When you are responsible for handling, these criteria do not impose any extra burden. They are basically what you are doing anyway.

The Two-Year Claims Window

This one is newer and catches people by surprise. As of late 2024, an amendment to the NDIS Act introduced a two-year limit for submitting claims. You now need to submit payment requests within two years of the support being delivered.

Before this rule, there was no formal deadline on when claims needed to be lodged. People would sometimes leave claiming until much later, particularly for supports that happened in the early part of a plan year. That flexibility is now gone.

What this means practically is that you can't let claims accumulate for long periods. If you're behind on submitting claims, address that now. If you have a habit of batching claims monthly, that's fine and still well within the two-year window. Just don't leave them any longer than that.

The Code of Conduct Still Applies to Your Providers

Something a lot of self-managers don't know: the NDIS Code of Conduct applies to every provider and worker delivering NDIS supports, registered or not. Using unregistered providers doesn't exempt them from the Code.

The Code expects providers and workers to treat you with respect to your rights and choices and to provide supports in a safe and competent manner, with honesty and transparency, to prevent and address any kind of violence, abuse or neglect, and not to take advantage of your status as a participant by unfair pricing or other unfair manipulative behaviours.

Code of Conduct complaints against unregistered providers and workers can be investigated by the NDIS Quality and Safeguards Commission. It is able to impose banning orders which make people unable to work in the NDIS sector completely. Such powers exist and are more actively used than ever.

The implication of this on your compliance picture is simple. When a provider commits an evil act, then you have a definite way of bringing it up. I do not have any rights as a participant depending on your type of management.

Notifying the NDIA of Significant Changes

This obligation is the one that gets mentioned least often but matters more than people think.

If something significant changes in your life that affects your ability to self-manage, you're required to tell the NDIA. The examples given in the NDIS guidelines include things like entering bankruptcy proceedings, a major change in your health or living situation, or if you're acting as a nominee and a conflict of interest arises.

What is significant enough to notify is a judgment call and not all changes result in the obligation. The idea is that the NDIA endorsed self-management depending upon what was happening to you at the moment. When these conditions alter significantly, they must be aware of them so that they can re-evaluate the viability of the arrangement.

That is why people do not want to have this discussion, as it can make people lose self-management. In reality, the reaction of the NDIA to a change that has been proactively disclosed is usually much more constructive than their reaction to finding out about a change that they were not informed about. It is almost free to be honest. It costs you a lot more to get caught not being upfront.

Staying on the Right Side of Compliance Without It Consuming Your Life

Compliance sounds like a full-time job. It really isn't when you have the right habits in place.

The self-managers who find compliance stressful are almost always the ones who haven't set up a basic system and are trying to manage things reactively. The ones who find it manageable are the ones who spend fifteen minutes a week maintaining their records, check their portal balance monthly, and keep their invoices organised from the start of the plan year.

The compliance framework for self-managers is genuinely designed to support good self-management, not to make it harder. Keep records of what you spend and why. Make sure your spending connects to your plan. Submit claims within two years. Tell the NDIA if something big changes. That's the whole thing.

At Support Network, we work with self-managed participants at every stage of this journey. Whether you're just starting out and want to understand what compliance actually involves, or you've been self-managing for a while and want to make sure your systems are solid, we're here with practical help rather than generic information.