Short answer
Start about three months out. Confirm which conditions and audit requirements apply and when the audit period ends. List every consultation, notification and complaints obligation in the approval's exact words, then test your own evidence before the auditor does by tracing a sample of complaints and notifications from start to finish. Fix what you can, record what you can't with corrective actions, and brief staff to point to records rather than recollections. In NSW, State significant projects follow the department's Independent Audit Post Approval Requirements; elsewhere, your approval and the guidelines it references set the rules.
What does an independent audit of approval conditions involve?
A suitably qualified auditor who is independent of the project assesses whether you have complied with your conditions and approved plans, using documents, interviews and a site inspection, and reports the result to the regulator. The detail depends on the jurisdiction and the approval. NSW publishes the most detailed public requirements, and they are a useful benchmark even for projects elsewhere.
The NSW requirements (March 2026)
The NSW Department of Planning, Housing and Infrastructure's Independent Audit Post Approval Requirements apply to State significant projects whose conditions require an independent audit. Where your conditions say something different, the conditions prevail. Key points:
- Frequency. If the conditions don't set it, the initial construction audit is due within 4 to 12 weeks of construction starting, then at intervals of no more than 26 weeks. The initial operation audit is due within 12 to 26 weeks of operation starting, then at intervals of no more than 3 years.
- The audit team. The Planning Secretary must agree to it in writing before the audit starts. The request goes through the Major Projects Portal at least 8 weeks before the audit period ends, with signed declarations of independence.
- Scope. All conditions for the phase being audited, all post-approval documents including management plans, and a review of environmental performance that covers incidents, non-compliances and complaints, plus feedback from the community or the community consultative committee.
- Consultation. The auditor consults the department on scope, and may be required to consult other agencies and stakeholders, including the committee chair. Issues raised must be investigated and reported.
- Evidence. Findings must rest on verifiable evidence. Interviews are generally not sufficient on their own.
- Status. Each requirement is compliant, non-compliant or not triggered. No other terms are allowed.
- Reporting. The final report and your response to its recommendations go to the department within 2 months of the last day of the site inspection, and both are published on the Major Projects website.
The same document reminds proponents that including false or misleading information in an audit report, or leaving out information you know is materially relevant, is an offence under the Environmental Planning and Assessment Act 1979.
Other jurisdictions
- Commonwealth. The environment department audits EPBC Act approvals on a risk basis, through compliance audits and independent audits, and publishes summaries of audit findings. The 2025 reforms established a National Environmental Protection Agency, with provisions commencing in stages, so check the current position on audit powers with the regulator.
- Victoria. Projects assessed through an environment effects statement are approved under other legislation, and audit arrangements sit in those approvals and in each project's environmental management framework. Several major Victorian transport projects have used an independent environmental auditor. Check your own framework and approval documents.
- Queensland. Check the conditions in any Coordinator-General evaluation report, your environmental authority and your agreements for audit, reporting and complaints obligations.
How are engagement and complaints obligations tested?
By tracing records. Expect the auditor to pick a sample and follow it from start to finish, often starting from the operational record (a site diary, a monitoring exceedance, a road closure) and then looking for the matching engagement record. If operations show an event and the engagement record is silent, that is likely to be a finding.
- Complaints: a sample across the audit period, checked for date and time, channel, location, the nature of the complaint, the action taken, the response to the complainant, and whether timing matched the commitments in your complaints procedure.
- Notifications: dates of out-of-hours work or other notifiable activity, matched to the notice, its distribution and its timing.
- Consultation on plans: where a plan says it was prepared in consultation with an agency or council, the correspondence and a record of how comments were addressed.
- Community committee: meetings held as required, minutes, and follow-up on actions.
- Public information: documents published where and when the conditions require, and kept current.
- The communication strategy itself: each commitment in the approved plan, such as newsletter frequency or hotline hours, tested like a condition.
What does a complete evidence trail look like?
One where each step has a dated record and the steps connect. Two examples of the trails auditors follow:
A complaint:
- Received: date, time, channel and who took it.
- Recorded: complainant (protected appropriately), location and issue.
- Investigated: what was checked, by whom, and what was found.
- Responded: what the complainant was told, when and how.
- Closed: closure date and any follow-up commitment, tracked separately.
- Reported: included in the periodic compliance report, with trends.
A notification:
- Trigger: the activity, its date, and the notice period required.
- Content: the notice text and its version.
- Reach: the notification area, the address list, and the distribution record.
- Timing: the send date, showing the required lead time was met.
- Response: enquiries or complaints that followed, linked back.
If any link is missing, you have the gap the auditor will find. For how to map conditions to evidence in the first place, see how to prove community consultation conditions were met, and for what regulators expect of the register itself, see the major project complaints register.
What is a realistic preparation timeline?
About twelve weeks for a project with routine records, longer if records are spread across contractors. Adjust it to your conditions.
| When | What to do |
|---|---|
| 12 weeks out | Confirm the audit period, which conditions and audit requirements apply, and who will audit. Refresh the compliance table so every engagement obligation is on its own line. |
| 10 weeks out | Self-assess each engagement, notification and complaints line against its evidence. Start the trace tests below. |
| 8 weeks out | In NSW, the deadline to request agreement to the audit team (at least 8 weeks before the end of the audit period). Record any non-compliance you have found, with corrective actions and dates. |
| 4 to 6 weeks out | Bring contractor records into the project record. Build an evidence index that points from each line to its records. Check the website obligations. |
| 2 weeks out | Brief the people who will be interviewed. Make sure the auditor can access systems and records without workarounds. |
| Audit | Opening meeting, document review, interviews and site inspection, then a closing meeting with preliminary findings. |
| After | Review the draft for errors of fact, then respond to every recommendation with an action and a date. In NSW, submit the report and response within 2 months of the last day of the site inspection. |
When you review the draft report, remember its purpose. Under the NSW requirements, the auditor may revise the draft only where new information shows an error of fact or a misunderstanding. The draft review is not a negotiation. Your response to the recommendations is where you set out actions and completion dates, and those actions are checked at the next audit.
Which findings can you pre-empt?
The ones that come from missing links rather than missing work:
- Complaint responses that happened by phone and were never recorded.
- Notifications with no distribution record, or sent inside the required notice period.
- Plans that say they were prepared in consultation, with no record of how comments were handled.
- Engagement by contractors that sits in their own systems.
- Website documents that are out of date or missing.
- Actions from the last audit that were promised and not closed.
Each of these is easier to fix in week ten than in the closing meeting. Keeping an evidence pack current all year, rather than building one per audit, is the subject of the engagement evidence pack checklist.
Where VivoAI fits
VivoAI keeps approval conditions, offsets and agreement commitments in a register, each with an owner and its evidence linked: the meetings, letters and field records behind a condition, in date order, with anything out of sequence flagged. You can see what is evidenced and what is not before the auditor does, and export an evidence pack. A portfolio view shows evidenced conditions, gaps and what falls due next across sites.
See how it works for resources and energy projects.
Frequently asked questions
Who chooses the independent auditor?
It depends on the approval. For NSW State significant projects, the proponent nominates the audit team, and the Planning Secretary must agree to it in writing before the audit starts, with signed declarations of independence from each member. For other approvals, the conditions set out who appoints the auditor and what independence is required.
Can we fix non-compliances before the audit?
Fix what you can, but expect the audit to cover the whole audit period, so a gap that existed earlier can still be a finding. Record what happened, what you did and when. A documented gap with corrective action already under way is a better position than a gap the auditor finds for you.
Will the audit report be made public?
For NSW State significant projects, yes: independent audit reports and the proponent’s response are published on the Major Projects website, and the proponent can supply a redacted copy if the report contains sensitive, personal or commercial information. Publication rules for other approvals vary, so check your conditions.
Does the community have a say in the audit?
Under the NSW requirements, the department may require the auditor to consult other agencies and stakeholders, including the community consultative committee chair, when setting the scope, and the audit must consider feedback from the community or the committee. Issues raised in that consultation must be investigated and reported.
Sources
- Independent Audit Post Approval Requirements, March 2026 (NSW Department of Planning, Housing and Infrastructure)
- Independent audit post approval requirements: current and historical versions (NSW Department of Planning, Housing and Infrastructure)
- Compliance Reporting Post Approval Requirements, March 2026 (NSW Department of Planning, Housing and Infrastructure)
- Audit program: EPBC Act approvals (Department of Climate Change, Energy, the Environment and Water)
- National Environmental Protection Agency Act 2025 (Federal Register of Legislation)
- Ministerial Guidelines for Assessment of Environmental Effects (Victorian Department of Transport and Planning)
This article is general information, not legal advice. Check your own approval conditions and obtain advice for your circumstances.
Next step
Find the gaps before the auditor does
Every engagement condition with its evidence linked, and the missing links visible weeks before the site inspection.