How to Track NDIS Staff Training and Worker Screening Compliance Without Spreadsheets

That question is often something like: which workers were in risk assessed roles on a particular day last year, and were they all cleared? This isn't a trick question. The record-keeping rules for registered providers are written around it.

This guide is for owners, operations managers and compliance leads at registered NDIS providers. It covers what you are required to record, why spreadsheets tend to fail at it, what a working system looks like, and how to decide between configuring the software you already have, buying a dedicated tool, or connecting and building something around your existing systems.

What the rules actually ask you to record

Two sets of requirements matter here. One covers worker screening records. The other covers staff competence and training.

Worker screening records

The NDIS (Practice Standards: Worker Screening) Rules 2018 set out the records a registered NDIS provider must keep. In summary:

Training and competence records

The NDIS (Quality Indicators for NDIS Practice Standards) Guidelines 2018 describe what auditors look for under the Human Resource Management standard in the Core Module. The indicators include:

The training indicator asks for more than a list of completed courses. It asks for a system that identifies what each person needs, records what they've done and checks whether it worked. A spreadsheet can store completion dates. It doesn't do the identifying or evaluating on its own.

Providers delivering only lower-risk supports may be audited against the Verification Module instead, and unregistered providers have different obligations. Confirm which standards apply to your organisation.

Why the spreadsheet breaks

Spreadsheets fail at this job in predictable ways. Knowing which ones apply to you is useful, because it tells you what any replacement must do.

It stores the present, not the history. When someone types a new expiry date over the old one, the previous state disappears. The "any given day in the previous seven years" test in section 20 depends on history: who held which role, from when to when, with which clearance. Most compliance spreadsheets can't reconstruct that.

An expiry date isn't the same as a current status. A clearance generally lasts five years. The Victorian Government states it is valid for five years from the date of the notice unless it is surrendered or revoked, and workers can renew from 90 days before expiry. The WA Government notes that cleared workers are subject to ongoing monitoring during that period. A spreadsheet showing an expiry in 2029 tells you nothing about whether that clearance is still in effect today. Status is checked in the NDIS Worker Screening Database, and your records should show when it was last checked and by whom.

Training needs depend on the role, but spreadsheets are flat. A support worker doing community access, a worker supporting a participant with complex bowel care and a key personnel member need different training. Spreadsheets end up with dozens of columns, most of them blank or marked "N/A", and nobody can say with confidence which blanks are actual gaps.

The evidence lives somewhere else. Certificates sit in email inboxes, shared drives and phones. The spreadsheet says "first aid: yes", but finding the certificate during an audit takes an afternoon.

Rostering doesn't check it. This is the most serious gap in practice. If the roster and the compliance spreadsheet are separate, nothing stops a worker with lapsed training or an unresolved screening issue from being booked for a shift.

What a working system looks like

Whatever tool you end up using, a reliable staff compliance setup has five parts. It helps to think about them separately before you look at products.

1. A role register

This is the list of roles in your organisation, marked as risk assessed or not, with the details section 17 requires. Each role carries its own requirements: screening, mandatory training, qualifications and any participant-specific competencies. Requirements attach to roles, and people inherit them by holding a role.

2. A worker register that keeps history

This holds one record per worker, with every role assignment dated from start to end. When a clearance is renewed, the old record stays and the new one is added. That's what lets you answer the auditor's question about a particular day.

3. A training and credential record linked to requirements

This records each training item and credential with the completion date, expiry or refresher date, and a link to the evidence. Because requirements come from the role, the system can show gaps directly. If a worker's role needs infection control refresher training and there's no current record, the system flags it. Nobody has to notice a blank cell.

4. A single evidence store

Certificates and screening verification notes are kept in one place with controlled access, attached to the worker record rather than scattered across inboxes.

5. Alerts, and a check at the point of rostering

Reminders go to the worker and their manager ahead of expiry, with lead times you choose. More importantly, the roster checks compliance before a shift is confirmed. A warning that a person can override, with a recorded reason, is often more practical than a hard block. What matters is that the check happens.

How this plays out: an illustration

The following is a hypothetical example to show the flow, not a client case.

A provider hires a new support worker for a community access role. The coordinator creates the worker record and assigns the role. The system immediately lists what the role requires: a screening clearance, the NDIS Worker Orientation Module, infection prevention and control training, first aid and the provider's own induction.

The worker uploads their certificates from their phone. A staff member looks up the clearance in the NDIS Commission's portal, links the worker to the organisation and records the result, the date checked and their own name. Two items are still outstanding, so the worker shows as "not ready". When the rostering coordinator tries to book their first shift, the roster shows why. Once the last certificate is added, the status changes and the shift can be confirmed. Months later, the first aid expiry triggers reminders at the intervals the provider set. The history of all of this is kept, so it can be produced at audit.

Three ways to get there

There's no single right answer. The best option depends on the systems you already pay for, your size and how unusual your workflows are.

A practical rule: start by checking whether the software you already pay for can meet the five requirements above. Many providers don't need a new product. Others find their rostering tool, HR system and learning platform each hold part of the picture, and staff spend hours re-keying the same worker details. For them, the fix is usually connecting what exists rather than adding a fourth system. Our NDIS compliance software buyer's guide compares the main off-the-shelf platforms if you're weighing a purchase.

When not to build: if you have one core platform with a decent compliance module, fewer than a couple of dozen staff, and standard roles, custom development is rarely justified. Spend the effort on cleaning your data and setting up the module properly.

Moving off the spreadsheet without losing anything

Data migration is where most projects in this area stall. A sensible order:

Privacy and security for staff records

Staff compliance records hold sensitive information, including dates of birth, home addresses, screening details and sometimes health information linked to role suitability.

Private sector employers often rely on the employee records exemption in the Privacy Act. The OAIC's guidance explains that the exemption is narrower than many people assume. It doesn't cover unsuccessful job applicants, volunteers, or contractors handling another organisation's employee information, and it doesn't cover uses outside the employment relationship. For a typical NDIS provider that relies on contractors, casual pools and volunteers, a meaningful share of the people in the compliance system may fall outside it.

In practice, look for:

Hosting data in Australia is a reasonable requirement to set for a vendor, but it's a choice you make, not a universal legal rule. Ask what the vendor commits to in the contract.

Questions to ask a vendor or developer

Whether you're buying, configuring or commissioning custom work, these questions separate tools that will hold up at audit from tools that only look tidy in a demo:

On the screening question, don't assume software checks the database automatically. Unless a vendor can show you an integration that works with the Commission's systems, verification means a person looking up the worker in the Commission's portal and recording the result. That's fine, as long as the system makes the check easy to do and easy to evidence.

The bottom line

Staff compliance tracking isn't really about the spreadsheet. It's about whether you can show, at any time, that each person working with participants was properly screened, trained and suited to their role, and whether you could show that for a date long past. Start with your role register and requirements, make sure the system keeps history and checks the roster, and only then choose software.

If your worker information is spread across several systems and you'd like a second opinion on how to bring it together, contact Beyond Himalaya Tech. Tell us which tools you use for rostering, HR, payroll and training, and we'll reply within one business day to arrange a conversation about what's worth connecting, what's worth configuring and what you can leave as it is. You can also see how we approached centralised employee records, roles and permissions, and payroll integration in our Rosterly workforce management case study, or read more about how NDIS providers are using AI to cut admin.