CPD Audit for Lawyers: What to Expect

A CPD audit is an administrative check where your legal regulator asks you to prove the CPD you declared when you renewed your practising certificate. For a practitioner who has genuinely done the hours and kept the evidence, it is a routine paperwork exercise that usually takes no more than an afternoon.

If you have opened a letter or email from your regulator with "CPD" and "audit" in the subject line, your first reaction is probably a quiet sinking in your stomach. You know you have done your CPD. You are just not sure you can prove it in the format someone official wants to see.

The lawyers who run into trouble are almost always the ones who completed their CPD but kept no evidence to show for it - or can't easily find that evidence. This article walks through what a CPD audit actually is, how you get selected, what you are asked to produce, and what happens in the rare case you cannot back up a claim. It is written with NSW solicitors in mind, but the same shape applies across every Australian jurisdiction.

The audit process at a glance

What is a CPD audit?

A CPD audit is a compliance check where your legal regulator asks you to prove the CPD you declared when you renewed your practising certificate. Because your renewal runs on self-certification, where you tick a box to say you completed your units, the audit is how the regulator confirms those declarations are accurate.

In most states this sits under the Legal Profession Uniform Continuing Professional Development (Solicitors) Rules 2015. Other states run parallel schemes through their own law societies and legal profession rules, but the principle is the same everywhere: you make a declaration, and the regulator can ask you to back it up.

The obligation being checked is consistent nationally. Solicitors complete 10 CPD units each CPD year, with at least 1 unit in each of four mandatory fields. In NSW (and most other states) those fields are ethics and professional responsibility, practice management and business skills, professional skills, and substantive law. The CPD year runs from 1 April to 31 March in every state and territory except Tasmania, which runs 1 May to 30 April. If you want the exact wording for your state, the CPD requirements by state pages set each one out, and the legal CPD FAQ covers the broader CPD questions that sit outside audits.

How are you selected and notified?

You are selected either at random or because something flagged your file, and you are notified in writing, usually by email. Regulators run a compliance audit each year and draw a proportion of practitioners into its scope. A share of that group is chosen at random, so selection does not imply anyone suspects you of anything.

The other way you get picked is targeted selection. That happens if you did not complete the compliance declaration at renewal, submitted an incomplete renewal, disclosed that you were short, asked for a late-completion extension, or have a recent conduct issue on file. If none of those apply to you, a notice landing in your inbox is almost certainly a random chance.

In NSW the annual audit round for the previous CPD year typically opens around September, so the window just after renewal is when a notice is most likely to arrive. The Law Society of NSW publishes the current round's timing each year.

What do they actually ask you to produce?

They ask for two things: a record of your CPD activities, and independent evidence that each activity happened. The record is a log; the evidence is the proof behind each line of that log.

Your CPD activity log should set out, for every activity:

• the date and duration,
• the provider or organiser,
• the title,
• the delivery format (for example live interactive webinar, face-to-face seminar, or recorded audio),
• which of the four mandatory fields it falls under,
• the number of units claimed;
• and a short note on how it was relevant to your practice.

The supporting evidence is the part people scramble for. Acceptable proof includes:

• completion certificates from the provider,
• tax invoices or registration confirmations,
• attendance records,
• digital login or activity logs from an online platform;
• and copies of presentation slides or published papers if you claimed units for writing or presenting.

The responsibility sits with you: if you cannot provide evidence for a unit, then for audit purposes it did not happen.

The four mandatory fields

The mandatory fields are where audits most often come unstuck. Most practitioners do well over 10 hours of CPD each year, but sometimes one field is empty or misallocated. In NSW the four are:

A common audit failure is claiming a general legal update under ethics or practice management when it does not genuinely belong there. If you are unsure whether your mix covers all four, the CPD requirements for NSW lawyers page breaks down what counts where. A couple of states add fields: South Australia and the Northern Territory both require a bullying, discrimination and harassment unit, and Tasmania requires an equality and wellbeing unit, so check your own jurisdiction rules if you practise outside NSW.

How long do you have to keep CPD records?

You keep your CPD records and supporting evidence for at least three years after the end of the CPD year in most of Australia. That covers NSW, Victoria, Queensland, WA, SA, the ACT and the NT. Tasmania is the exception at two years.

That three-year window matters because a regulator can ask you to produce records not just for the year you were audited, but for any of the preceding CPD years within that period. Keep those records until the full retention period has passed, even after your practising certificate renews, so an earlier year is still covered if the regulator asks for it.

What happens if you cannot evidence your CPD?

If you fall short, the usual first step is a rectification plan that lets you make up the gap. Under the Uniform Rules, a regulator that finds a deficiency gives you 21 days to submit a plan setting out how you will make up the gap, and you generally have around 90 days to complete that remedial CPD. For an honest shortfall backed by cooperation, this is where most matters end. This is about being unable to evidence CPD you did complete. If your situation is that you did not complete your units at all, our guide on what happens if you do not complete your CPD covers that separately.

Consequences escalate only when someone ignores the notice, submits false or misleading records, or refuses to follow through on an agreed plan. In those cases the regulator can refer the matter for disciplinary action, and deliberate false certification can amount to unsatisfactory professional conduct or professional misconduct, with potential fines or practising-certificate consequences. That path is rare, and it is driven by the practitioner's response to the audit far more than by any initial shortfall.

The response timeframe is tight, which is the real reason to keep records as you go. NSW and Victoria give you 21 days from the notice to produce your evidence. Other states and territories set their own, often shorter, windows, so confirm the deadline for your jurisdiction as soon as a notice arrives. Three weeks is comfortable if your evidence is already in one folder, and very short if you are hunting through two years of inboxes.

How to be audit-ready in under an hour

You can get audit-ready in a single sitting by pulling your record and evidence into one place and checking it against what a regulator looks for. None of this is difficult. The main challenge is simply setting aside the hour before a notice arrives. To make that sitting quick, we have built a free CPD Audit Readiness Checklist. It walks you through confirming your 10 units and correct CPD year, checking all four mandatory fields are genuinely covered, gathering the evidence behind each unit, and spotting a gap early enough to fix it calmly.

Download it, spend an hour with your records, and you will know exactly where you stand before any notice arrives.