Start from the criteria that apply to your service types, close last audit's corrective actions, and test your own files the way the auditor will, at least the square root of the people you support and never fewer than five. Stage one reviews your documents off site, so policies and procedures must be current before the agency asks for them.
What the agency audits
Agencies audit every applicable criterion in the Ngā Paerewa Criteria Application Framework for each service type, collecting evidence and triangulating it to reflect the intent of each subsection.1 Each subsection gets a level of attainment and a risk rating, and a subsection cannot be fully attained while any criterion under it is partially attained.1
The sample the auditor will draw
| What is sampled | Certification audit | Surveillance audit |
|---|---|---|
| Clinical files and interviews with people | Square root of the number of people, rounded up, never fewer than 5 | 0.6 times the square root, never fewer than 5 |
| Medication records | Twice the number of files, outside public hospitals | Twice the number of files, outside public hospitals |
| Staff interviews | Square root rule, across every shift and role | Square root rule, across every shift and role |
| Tracers | At least one per service type | At least one per service type |
Auditors choose the sample themselves, widen it when they find a non-conformity, and interview anyone who asks to be interviewed.1 Whānau count towards the interview sample.1
- List the criteria that apply. From the Criteria Application Framework, for each service type you are certified for.
- Close last audit's corrective actions. Surveillance audits look again at every criterion not fully attained last time.
- Refresh the stage one documents. Policies and procedures for management and clinical systems, dated and owned.
- Sample your own files. Pick them at random, as the auditor will, and read each against the criteria.
- Run a tracer. Follow one person receiving complex care through their record, their medication and the staff who cared for them.
- Brief every shift. Staff should know where procedures live and who they escalate to.
- Check the facility. Building warrant of fitness current and the evacuation scheme approved.
- Service type ______ People receiving services ______
- Files to sample ______ Medication records to sample ______
- Files reviewed ______ Gaps found ______
- Tracer completed on ______ Person's role in the review ______
- Open corrective actions ______ Closed ______
- Lead for the audit ______ Agency contact ______
Announced and unannounced audits
A certification audit is announced, and runs no more than three months before the certificate expires.1 Surveillance audits of aged residential care and residential disability psychiatric services are unannounced spot audits, held within three months either side of the due date.1 On site, an audit typically takes one to five days, depending on the size and complexity of the service.2
Questions
How many files will the auditor review?
At a certification audit, the square root of the number of people receiving services, rounded up, and never fewer than five, across each service type.
Can we choose which files the auditor sees?
No, the handbook says auditors do not let the service pre-select samples of staff, people or clinical files.
Is a rest home surveillance audit announced?
No, surveillance audits of aged residential care are unannounced spot audits, held within three months either side of the due date.
Sources
- 1Ministry of Health, 2025Designated Auditing Agency Handbook, Ministry of Health Auditor Handbook (revised 2025)Read source
- 2Ministry of Health, 2025Information for clinical and frontline staff, the audit process under Ngā PaerewaRead source
- 3Ministry of Health, 2024Applying for certificationRead source
Written by the wai team from HealthCERT, Ministry of Health guidance, checked on 16 October 2026. This is guidance, not legal advice. Neither HealthCERT nor the Ministry of Health endorses wai or any software.