Key Takeaways
- RACGP accreditation runs on a three-year cycle against the 5th edition Standards, organised into three modules (Core, Quality Improvement, General Practice) covering 17 standards and 44 criteria; failing any mandatory criterion means you cannot be accredited regardless of performance elsewhere.
- C6.4 Information security, part of the Core module, is where most practices struggle - your IT provider holds the technical evidence, but accountability sits with the practice under the Standards.
- Request documented evidence from your MSP for backup procedures, patch management, and access control policies, and store it tagged to the relevant checklist items.
- Start evidence collection as early as possible in the cycle; continuously accumulated evidence is far more credible than a folder assembled weeks before the assessor arrives.
- Use the self-assessment tool thoroughly before your formal visit - it surfaces fixable issues well ahead of the assessor arriving.
RACGP accreditation can feel overwhelming, especially if it is your first time as practice manager. The Standards are detailed, the evidence requirements are broad, and the assessor visit has a way of feeling like it arrives faster than expected. This guide breaks down the essentials: what the 5th Edition Standards cover, how the assessment process actually works, and where most practices run into trouble.
What is RACGP Accreditation?
The Royal Australian College of General Practitioners (RACGP) sets the Standards for general practices in Australia. Accreditation against these Standards is required for practices to access certain Medicare items and to demonstrate a formal commitment to quality care.
The current 5th Edition Standards organise requirements into three modules: Core (Standards C1 to C8), Quality Improvement (Standards QI1 to QI3), and General Practice (Standards GP1 to GP6), covering 17 standards and 44 criteria in total. Some criteria are mandatory and others are scored on a scale. A practice that fails to meet a mandatory criterion cannot be accredited regardless of how well it performs elsewhere.
Accreditation runs on a three-year cycle. At the end of each cycle, your practice is assessed again. That means the work of staying compliant is continuous, not something you do once and walk away from.
How the Assessment Process Works
Most practices are assessed by one of four organisations approved by the Australian Commission on Safety and Quality in Health Care: ACHS, AGPAL, Global-Mark, or QPA. The process typically runs like this:
You submit an application and pay the assessment fee. The accrediting organisation sends your practice a self-assessment tool, which you work through to document your current compliance position and identify any gaps before the formal visit. This self-assessment is worth doing thoroughly. It often surfaces issues that can be fixed well before the assessor arrives.
On assessment day, an assessor or team of assessors visits your practice. They review documentation, interview staff, observe the physical environment, and check that what you have written down actually reflects how the practice operates. The assessor report goes back to the accrediting organisation, which then makes the formal accreditation decision.
If your practice has gaps, you may be given a period to address them before a final decision is made. If everything is in order, you receive accreditation for three years and the cycle begins again.
The Three Modules at a Glance
Understanding what each module actually covers helps you prioritise your preparation. A quick overview:
Core module (C1 to C8) covers governance, risk management, business continuity, work health and safety, information management (including information security and health records), and staff training and orientation. This is where your policy manual, business risk register, emergency plan, and information security systems live.
Quality Improvement module (QI1 to QI3) covers complaints handling, clinical risk management, and continuous quality improvement activity, including the systems your practice uses to support ongoing clinical governance.
General Practice module (GP1 to GP6) covers practice information and after-hours arrangements, recall and follow-up systems, practitioner qualifications and training, infection control, and cold chain management. This module catches practices out most often on S8 records and cold chain documentation.
Where IT Security Fits In
Criterion C6.4, Information security, part of the Core module, is where most practices struggle. It requires documented IT security policies, evidence of staff training on information security, backup and recovery procedures, and access controls for clinical systems. The challenge is that for most practices, the people who actually hold this evidence are not in the building.
Your IT provider or managed service provider (MSP) is responsible for the technical infrastructure, but the accountability sits with the practice under the RACGP Standards. If your MSP has not given you documented evidence of your backup procedures, your patch management processes, or your access control policies, that gap will surface in an assessment.
The fix is not to become an IT expert yourself. It is to have a clear process for requesting, receiving and storing that documentation from your IT provider, tagged to the right checklist items, so you can produce it on demand. ClinicComply's vendor portal is built specifically for this: you send your MSP a secure upload link, they submit their documentation directly, and it flows into your evidence library against the relevant Standards criteria.
What Evidence You Need to Collect
Evidence takes different forms across the three modules, but the underlying principle is consistent: you need to be able to show that the policies you have written are the policies your practice actually follows, with documented proof.
For policies and procedures, this means version-controlled documents with formal review dates. For staff training, it means attendance records or completion certificates. For cold chain and medicines management, it means continuous logs rather than reconstructed records. For IT security, it means documentation from your providers rather than a written assertion that everything is fine.
Starting your evidence collection as early as possible in the three-year cycle is the single most effective thing you can do to reduce stress at assessment time. Evidence that accumulates continuously is far more credible than a folder assembled in the weeks before the assessor arrives.
Where to Start
If your practice is preparing for an initial accreditation or an upcoming renewal, a structured compliance checklist mapped to the RACGP Standards is the most useful starting point. Work through each criterion, mark what you have in place, and identify the gaps. Prioritise the mandatory criteria first, then work through the scored items.
For most practices, the areas that need the most attention are IT security documentation, medicines management records, staff credentialling, and policy review currency. These are the areas that assessors flag most consistently, and they are all solvable with the right systems in place.
ClinicComply maps your practice against the RACGP 5th Edition Standards across a live checklist, connects your IT vendor documentation directly to your evidence library, and tracks deadline reminders for credential renewals and policy reviews. Start your free 30-day trial at cliniccomply.com.au.