Whaikaha Compliance Checklist for NZ Disability Providers (2026)

Running a Whaikaha-funded disability support service means operating under a layered set of obligations — contractual, regulatory, and quality-based. An audit isn't just about paperwork; it's an assessment of whether your organisation is actually delivering safe, effective, person-centred support in a sustainable way.

This checklist covers the core compliance requirements for NZ disability providers in 2026: the Ngā Paerewa quality standard, worker certification, service delivery obligations, incident reporting, documentation retention, and how to build audit readiness into daily operations rather than treating it as a periodic project.

This article is a practical guide. Requirements vary by service type and contract. Always refer to your Whaikaha service specification and DSS Tier One and Tier Two requirements as the authoritative source. Last reviewed: Aug 2026.

Ngā Paerewa — The Quality Standard You're Audited Against

All Whaikaha-funded providers must meet the Ngā Paerewa Health and Disability Services Standard (NZS 8134:2021), which replaced the previous suite of separate standards (NZS 8134:2008, NZS 8158:2012, and others). Ngā Paerewa is built around four domains:

• Consumer rights — informed consent, privacy, right to complain, cultural safety and responsiveness, supported decision-making
• Organisational management — governance, leadership, risk management, quality improvement, HR systems, financial viability
• Safe and appropriate environment — premises safety, equipment maintenance, infection prevention, emergency preparedness
• Continuum of service delivery — needs assessment, support planning, delivery, monitoring, review, and transitions

Audits against Ngā Paerewa are conducted by accredited Conformity Assessment Bodies (CABs). Your certification period is typically three years, with surveillance audits in the intervening years. Findings at audit are graded — partial attainment generates corrective action requirements with defined timeframes; unattained criteria can trigger escalated monitoring or contract consequences.

The standard places specific emphasis on cultural safety and Te Tiriti o Waitangi obligations. Auditors assess whether services are genuinely responsive to Māori service users, whether staff receive cultural competency training, and whether the organisation has meaningful relationships with iwi and Māori communities where relevant to its catchment.

Worker Certification — What Must Be Current

Worker qualification and certification gaps are among the most commonly cited findings in NZ disability provider audits. The requirements span pre-employment vetting, qualifications, and ongoing mandatory training.

Police Vetting

All workers providing regulated support services to vulnerable people require a current NZ Police vet. Key requirements:

• Vetting must be conducted through the NZ Police vetting service — not a third-party provider or overseas equivalent
• Standard validity period is three years, though some service specifications require more frequent renewal for higher-risk roles
• Volunteers with unsupervised access to the people you support also require vetting
• Workers must not begin unsupervised work until the vet result is received and reviewed — a pending application is not sufficient
• Overseas workers require an NZ Police vet plus police checks from any country where they've lived for 12+ months in the past 5 years

NZ Certificate in Health and Wellbeing

Workers covered by the Care and Support Workers Pay Equity settlement are required to hold (or be actively working toward) an NZ Certificate in Health and Wellbeing (NZCHW) at Level 2, 3, or 4. The qualification level also determines their pay band. Compliance requirements:

• Track each worker's current qualification level and, if not yet achieved, their enrolment status and expected completion date
• Workers without a qualification must be enrolled with a training provider — document the enrolment date and expected completion timeline
• Overseas qualifications must be formally assessed for equivalency before being applied to pay band placement — document the assessment outcome
• When a worker completes a qualification, update their band and pay promptly — retroactive corrections create employment and funding complications

First Aid

• A current first aid certificate (unit standard 6402 or equivalent) is required for workers providing direct support
• Certificates are valid for two years; the CPR component typically renews annually — check the specific certificate issued
• Schedule renewal before expiry, not after — a lapsed certificate during a shift creates both a safety and compliance gap

Mandatory Training

Beyond vetting and qualifications, these training requirements apply across most disability support roles:

• Restraint minimisation and safe practice — mandatory for any worker in a service that uses restrictive practices; requires annual or biennial refresher depending on your service specification
• Medication management competency — required before a worker can administer medication; assessed per role, not just once at onboarding
• Manual handling and safe mobility — required where workers assist with physical transfers, hoisting, or repositioning
• Infection prevention and control — annual refresher recommended across all direct support roles; mandatory in residential settings
• Cultural competency and tikanga Māori — Ngā Paerewa places significant weight on culturally safe practice; training records must reflect ongoing learning, not just induction-level awareness
• Privacy Act and information handling — workers handling sensitive health and disability information require training on their obligations under the Privacy Act 2020

Supervision

• All workers must receive regular professional or clinical supervision — frequency varies by role and risk level but quarterly is a common minimum for experienced workers; monthly for new starters
• Supervision sessions must be documented — date, topics discussed, any follow-up actions, and the supervisor's name
• Supervision records are a standard audit request — gaps in the record suggest either sessions aren't happening or aren't being documented

Service Delivery Obligations

Person-Centred Support Plans

Every person you support must have a current, written support plan developed with their genuine involvement (and, where appropriate, their whānau or representatives). Plans must:

• Reflect their NASC-assessed needs and the hours/services approved
• Document the person's goals, preferences, and what matters to them — not just task lists
• Be reviewed at least annually, or immediately following a significant change in health, living situation, or support needs
• Carry a clear review date with evidence that the review actually happened (meeting notes, person's signature or documented response)

Unreviewed support plans are one of the most common audit findings. Build a rolling review schedule into your coordination workflow rather than waiting for plans to expire.

Funded Hours vs Delivered Hours

Your Whaikaha contract funds a specific volume of support hours per person. Tracking delivered hours against approved allocations is both a billing obligation and a quality indicator:

• Over-delivering funded hours without prior approval creates funding recovery risk — Whaikaha can claw back payments for services delivered beyond authorised levels
• Consistently under-delivering may indicate unmet need, roster gaps, or the person declining support — each of these requires a documented response
• Variances from the funded plan should be documented with reasons at the time, not reconstructed later

Progress Notes

Support workers must record progress notes for each shift — factual, contemporaneous records of what support was delivered, any observations about the person's wellbeing, and any incidents or concerns. Notes should be completed the same day, not days later. They form the primary evidence of service delivery and are reviewed during audits to assess both quality and accuracy against billing claims.

Incident Reporting

Your service specification defines which incidents require notification to Whaikaha and within what timeframes. Common categories requiring prompt notification include:

• Unexpected death of a service user
• Serious injury requiring hospital admission or emergency treatment
• Abuse or neglect — actual or reasonably suspected, by any person in the service environment
• Restraint incidents — any use of physical restraint or near-miss
• Missing persons — a service user who cannot be located and is assessed as at risk
• Serious medication errors causing or capable of causing harm

In addition to funder notification, maintain an internal incident register capturing all incidents — including minor ones that don't meet the notification threshold. This register supports quality improvement, identifies patterns before they escalate, and demonstrates systematic governance during audits.

A good incident record includes: date and time, factual description of what happened, immediate actions taken, notifications made (police, family, HDC if applicable), investigation findings, and follow-up actions to prevent recurrence. Auditors assess whether learnings are actually implemented — not just documented.

Documentation Retention

Auditors will request evidence across multiple categories. Keep these organised and accessible — a 20-minute search for one document during an audit is not a good look regardless of whether it exists.

• Worker files — police vet, qualifications, training certificates, supervision notes, employment agreement, performance reviews, incident involvement records
• Service user files — support plan, consent forms, NASC referral and assessment, progress notes, incident and complaint records, NHI number
• Organisational governance — policies and procedures (dated and version-controlled), board/governance meeting minutes, quality improvement plan, risk register
• Financial and funder records — invoices, funding claims, evidence of hours delivered, pay equity compliance records
• Health and safety — hazard register, accident/incident log, emergency procedures, evacuation drill records, vehicle safety checks (if applicable)

Retain health-related documentation for a minimum of 10 years. Some categories have longer retention requirements — refer to your contract and the Health Information Privacy Code for specifics.

Cultural Safety and Te Tiriti Obligations

Ngā Paerewa places stronger emphasis on cultural safety than the standards it replaced. This isn't a checkbox — auditors assess whether cultural safety is embedded in practice, not just documented in policy.

• Workforce cultural competency — all staff should have completed meaningful cultural safety training, not just a one-time induction module
• Māori service user outcomes — are Māori tāngata whaikaha (disabled people) receiving equitable access to services and achieving comparable outcomes?
• Whānau-centred practice — support plans and reviews should genuinely involve whānau where the person wants that
• Iwi and community relationships — providers in areas with significant Māori populations should have documented relationships with relevant iwi or Māori organisations
• Complaints process accessibility — is your complaints process available in te reo Māori? Do service users know they can involve a Māori advocate?

Building Audit Readiness Into Daily Operations

Providers who treat compliance as a periodic audit-preparation project are always behind. Providers who build compliance tracking into their daily and weekly operations are rarely surprised by audit findings — because they've already seen and addressed the gaps.

Monthly Compliance Check

At the start of each month, review a report of workers with documents expiring in the next 60 days: police vets, first aid certificates, qualifications, mandatory training renewals. Contact those workers now — not when the document has already lapsed.

Support Plan Review Schedule

Maintain a rolling calendar showing every service user's next plan review date. Build it into your coordination team's monthly workflow — who has plans due this month, who is overdue. Don't wait for a plan to expire before scheduling the review.

New Starter Gate

No new worker should be rostered for unsupervised shifts until their full onboarding compliance checklist is complete: police vet received and reviewed, qualifications sighted, mandatory training completed, employment documentation signed. Partial completion creates risk from day one.

Incident Register Review

Review the incident register weekly at team level. Are incidents fully documented? Are follow-up actions completed? Are there patterns emerging that warrant a systemic response rather than incident-by-incident management?

Annual Internal Self-Audit

Conduct an annual internal review against Ngā Paerewa's four domains. This doesn't need to be a formal, consultant-led exercise — walk through the criteria with your team leaders, identify gaps, and document your improvement plan. When the CAB auditor arrives, you can point to your self-audit and your progress against it. That proactive posture carries weight.

The goal of compliance isn't to pass audits. It's to run a service where the people you support are safe, heard, and well cared for. The audit is just the external check on whether that's actually happening. See how KareShift helps NZ providers stay on top of compliance.