Recruitment Vetting That Matches the Role

Winter, EnableUs Community

Last time we covered the personnel file checklist and tracking screening expiries. Today I want to go upstream, to the recruitment workflow itself. Will, where do providers go wrong before a file even exists?

Will, EnableUs Community

They treat vetting as one generic hurdle. Same template, every hire, tick the boxes. The safeguard only works when the check matches the duties, the risk exposure and the statutory classification of the role. So the first question is never what's on our checklist. It's what this person will actually do.

Winter, EnableUs Community

Then start with the one everyone knows, the NDIS Worker Screening Check. Who actually needs it?

Will, EnableUs Community

Anyone in a risk assessed role. Registered providers have to identify those roles themselves and keep records of them. A role qualifies in two ways. Either it's key personnel, so CEOs, directors, executives, board members and sole traders. Or it involves direct delivery of specified supports, or more than incidental contact with participants. That means physical touch, building rapport as an ordinary part of the job, or contact with multiple participants in a specialist setting. And it can cover staff, casuals, volunteers and students, with some contractor and student arrangements handled differently.

Winter, EnableUs Community

So a finance officer in the back office doesn't need one?

Will, EnableUs Community

Not unless they're key personnel. The Commission's own example is an accountant who just says hello to customers in the lobby. That's incidental contact, polite and functional. But the same guidance has an HR executive on the board who helps write driver policies, and that person does need a clearance. The title doesn't decide it. The function does.

Winter, EnableUs Community

Say a candidate hands me a PDF of their clearance. Their name is right, the expiry is years away. Why isn't that enough?

Will, EnableUs Community

Because a clearance is generally valid for five years, and a lot can happen in five years. A paper copy is a snapshot. A registered provider should log in to the Commission portal, look the worker up and link them to the organisation using the Employer ID. Linking is what triggers the notifications if something changes, like an interim bar, a suspension, an exclusion or an upcoming expiry. If you never linked them, nobody tells you.

Winter, EnableUs Community

And what does a good lookup show you?

Will, EnableUs Community

Three things. Worker's status says Clearance, the expiry date is in the future, and Eligible to work says Yes. One timing note from the Commission's guidance: from 12 October 2026, registered providers do all of this in a new NDIS Commission Portal, so check where your team is logging in.

Winter, EnableUs Community

What about the candidate who's still waiting on their outcome? Providers are under pressure to fill rosters.

Will, EnableUs Community

That pressure is the trap. Working on application is only possible where state or territory law allows it. Then you need a written risk management plan, the worker has to be supervised by someone with a clearance, and you record them as a worker without one. Secondary school students on formal work experience have a similar supervision exception. If the supervisor calls in sick, the student moves to duties without more than incidental contact. The roster doesn't get to override the rule.

Winter, EnableUs Community

You said the check should match the role. What does that look like when the role changes the answer?

Will, EnableUs Community

Take transport. If someone drives participants, you want an active driver's licence, a driving history check where relevant, and verified vehicle registration and insurance. None of that belongs on the template for a support worker who never drives. Now take supporting children with disability. That brings in a state or territory Working With Children Check. It's a separate scheme assessing a different kind of risk, so it never substitutes for the NDIS check. Many workers need both.

Winter, EnableUs Community

And clinical roles?

Will, EnableUs Community

Therapy or clinical care means checking current professional registration, for example AHPRA, and confirming credentials directly with the issuing institution or board. Don't just trust the certificate someone scanned.

Winter, EnableUs Community

Before any of that, how do you know the documents belong to the person sitting across from you?

Will, EnableUs Community

That's identity verification, and it's the foundation. If the name differs between documents, or the date of birth or address doesn't match, you investigate before making an offer. Otherwise every other check might be about someone else.

Winter, EnableUs Community

A lot of providers insist every support worker holds a Cert III or IV in disability. Is that required?

Will, EnableUs Community

Not automatically. Qualification requirements depend on the supports delivered and the registration group, so define them per role. And a certificate alone doesn't show person centred judgment, dignity of risk awareness or empathy. You test that with scenario questions and with referees.

Winter, EnableUs Community

Reference checks, though. Are they mandatory?

Will, EnableUs Community

Be precise here. They're not a universal requirement written into every clause for every position. But they're an expected safeguard under good governance, and auditors tend to look for them. With the candidate's consent, ask structured, role related questions about communication, reliability, how they respond to feedback and how they behave around vulnerable people. And probe unexplained gaps in work history. A gap isn't proof of anything, but it's a question you need answered.

Winter, EnableUs Community

Then the record keeping. What does the Commission expect?

Will, EnableUs Community

Two records. First, a written record of your risk assessed roles: the title, which part of the definition applies, a description, the date assessed and who made the assessment. Update it within 20 business days of identifying a new risk assessed role. Second, a record of each worker in those roles, with clearance number, expiry date, any exceptions, and any misconduct allegations and your response. It has to still exist after you unlink the worker in the portal, and be kept for seven years.

Winter, EnableUs Community

That's a lot of sensitive data sitting in one place.

Will, EnableUs Community

Which is why you only collect what you genuinely need, store it securely, and restrict access to authorised people with clear sign offs. Collecting everything just in case creates its own risk.

Winter, EnableUs Community

If a provider listens to one thing from today, what should it be?

Will, EnableUs Community

Review your process whenever you add a service or hire into a new type of role. Build the checklist from the duties, verify online rather than collecting paper, and when you're unsure, go to the official guidance instead of assumptions.