NDIS Incident Management Rules

When the provider becomes aware of a death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, or sexual misconduct including grooming, it must notify the Commissioner within 24 hours with: its name and contact details; a description of the incident; the impact or harm to the person (except for a death); the immediate actions taken to ensure the health, safety and wellbeing of affected persons and whether police or another body was told; the notifier's name and contact details; the time, date and place if known; the names and contact details of those involved; and any other information the Commissioner requires. The notice may be by telephone or in writing on the approved form.

Held text: NDIS (Incident Management and Reportable Incidents) Rules, F2018L00633, as made; no amendments at 1 Oct 2026.

what an auditor asks to see Commission portal immediate notification records with submission timestamps; Incident register showing the awareness time against the notification time; Record of police or other agency reports made

where it usually falls short Notification made after 24 hours counted from when the provider became aware; Immediate safety actions not described

Every Incident Rules clause we hold

For every priority reportable incident the provider must also give the Commissioner, in writing within 5 business days after becoming aware of it, the names and contact details of any witnesses and any further actions it proposes to take.

Held text: NDIS (Incident Management and Reportable Incidents) Rules, F2018L00633, as made; no amendments at 1 Oct 2026.

what an auditor asks to see Written 5-day notifications on the approved form with witness details; Planned further actions linked to the incident action plan; Tracker showing each 24-hour notice paired with its 5-day notice

where it usually falls short 5-day notice missed because the 24-hour notice was treated as complete; Proposed actions vague or absent

Every Incident Rules clause we hold

A reportable incident that is not one of the 24-hour kinds in s 20(1)(b) (a death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, or sexual misconduct) must be notified to the Commissioner in writing within 5 business days after the provider becomes aware of it. In practice this is the use of a restrictive practice that is a reportable incident: a use not in accordance with a State or Territory authorisation (Act s 73Z(4)(f)), or an authorised use not in accordance with the person's behaviour support plan (s 16(3)), unless s 16(4) excludes it. The notice gives the provider's name and contact details; a description including impact or harm; the time, date and place if known; persons involved and witnesses; immediate actions taken and whether police or another body was told; further proposed actions; the notifier's details; and any other information the Commissioner requires, on the approved form.

Held text: NDIS (Incident Management and Reportable Incidents) Rules, F2018L00633, as made; no amendments at 1 Oct 2026.

what an auditor asks to see Commission portal 5-day notification records with the aware date and the lodgement date; Restrictive practice use records (each use tested against the State or Territory authorisation and the behaviour support plan) cross-checked to notifications; Notification timeliness report counted in business days from the aware date

where it usually falls short Unauthorised restrictive practice uses not notified; Authorised uses outside the behaviour support plan treated as not reportable; Notifications missing witness or further action details

Every Incident Rules clause we hold

Any person employed or engaged by a registered NDIS provider who becomes aware of a reportable incident connected with the provider's supports must notify a member of key personnel, their supervisor or manager, or the nominated reporting person as soon as possible.

Held text: NDIS (Incident Management and Reportable Incidents) Rules, F2018L00633, as made; no amendments at 1 Oct 2026.

what an auditor asks to see Worker procedure stating the internal reporting duty and contacts; Incident records showing the time the worker became aware and the time they told the provider; Training records on recognising reportable incidents

where it usually falls short Delay between a worker learning of an incident and telling the provider; Workers unsure whom to tell after hours

Every Incident Rules clause we hold

For each reportable incident alleged to have occurred, the system must record at least: a description of the allegation; the time, date and place if known; names and contact details of those involved and any witnesses; the section 10(3) assessment; actions taken including support to affected persons; consultation with them; whether they received reports or findings; investigation details and outcomes; and who made the record.

Held text: NDIS (Incident Management and Reportable Incidents) Rules, F2018L00633, as made; no amendments at 1 Oct 2026.

what an auditor asks to see Allegation record template distinct from or flagged within the incident register; Sample allegation files with assessment, actions and investigation outcome; Link from each allegation record to its Commission notification number

where it usually falls short Allegations against staff kept only in HR files outside the incident system; Outcome of the allegation never recorded

Every Incident Rules clause we hold

For every incident the system must record at least: a description including the impact on or harm to any affected person with disability; whether it is a reportable incident; the time, date and place if known, or otherwise when it was first identified; names and contact details of those involved and of any witnesses; the section 10(3) assessment; the actions taken, including support to affected persons; consultation with affected persons; whether they received any reports or findings; details and outcomes of any investigation; and the name and contact details of the person making the record.

Held text: NDIS (Incident Management and Reportable Incidents) Rules, F2018L00633, as made; no amendments at 1 Oct 2026.

what an auditor asks to see Incident report form or system screen with every s 12(2) field; Sample of completed incident records checked for all mandatory fields; Record of findings shared with the affected participant

where it usually falls short Witness details and consultation with the participant missing; Reportable status field not completed

Every Incident Rules clause we hold

The system must require every incident to be assessed, taking account of the views of affected persons with disability, for whether it could have been prevented, how well it was managed and resolved, what remedial action is needed to prevent recurrence or reduce impact, and whether other persons or bodies must be notified, and it must set procedures that make sure this assessment happens.

Held text: NDIS (Incident Management and Reportable Incidents) Rules, F2018L00633, as made; no amendments at 1 Oct 2026.

what an auditor asks to see Incident assessment form or register fields for preventability, management quality, remedial action and external notifications; Record of the affected participant's views captured in the assessment; Management sign-off of completed assessments

where it usually falls short Assessment fields left blank once the immediate response is done; Participant's view never sought or recorded

Every Incident Rules clause we hold

The provider must document its incident management system, give copies in an accessible form to the persons with disability it supports, to every person it employs or engages, and to the family members, carers, independent advocates and significant others of those persons with disability, and help each of them understand how the documented system operates.

Held text: NDIS (Incident Management and Reportable Incidents) Rules, F2018L00633, as made; no amendments at 1 Oct 2026.

what an auditor asks to see Easy Read or accessible version of the incident management procedure; Participant welcome pack or service agreement record showing the procedure was given and explained; Worker induction checklist acknowledging receipt

where it usually falls short Only a staff-facing version exists; Families and advocates never given a copy

Every Incident Rules clause we hold

The system must include requirements for training everyone the provider employs or engages in using and complying with the incident management system.

Held text: NDIS (Incident Management and Reportable Incidents) Rules, F2018L00633, as made; no amendments at 1 Oct 2026.

what an auditor asks to see Incident management training module and attendance records; Refresher training schedule and completion rates; Training content covering reportable incidents and the 24-hour timeframe

where it usually falls short Training given at induction only and never refreshed; Casual workers not trained

Every Incident Rules clause we hold

If too little is known within 24 hours, the provider must still give its details, a description of the incident, the impact or harm, immediate actions and the notifier's details within the 24 hours, and give the remaining required information in writing within 5 business days after becoming aware of the incident.

Held text: NDIS (Incident Management and Reportable Incidents) Rules, F2018L00633, as made; no amendments at 1 Oct 2026.

what an auditor asks to see Initial notification record followed by a written completion within 5 business days; Diary or tracker of outstanding notification information with due dates; Copies of written follow-up submissions

where it usually falls short Initial notice lodged but remaining details never supplied; 5 business days counted from the notification rather than from awareness

Every Incident Rules clause we hold

After notifying, the provider must tell the Commissioner in writing, as soon as reasonably practicable, of significant new information that changes the kind of reportable incident or is a further reportable incident; a notice of a further incident under this section counts as its section 20 or 21 notification.

Held text: NDIS (Incident Management and Reportable Incidents) Rules, F2018L00633, as made; no amendments at 1 Oct 2026.

what an auditor asks to see Written update notifications with dates; Incident file showing when new information arose and when it was reported; Procedure step requiring review of open notifications when facts change

where it usually falls short Incident category changed internally but not reported to the Commission; Further incidents discovered in an investigation not notified

Every Incident Rules clause we hold

The provider must keep a record of each reportable incident it becomes aware of for 7 years from the day it was notified under subsection 20(2), paragraph 21(2)(b) or subsection 23(2); keeping the section 12 record satisfies this.

Held text: NDIS (Incident Management and Reportable Incidents) Rules, F2018L00633, as made; no amendments at 1 Oct 2026.

what an auditor asks to see Retention schedule entry for reportable incident records from the notification date; Archived notification copies and acknowledgements from the Commission; Retrieval test of an older reportable incident file

where it usually falls short Retention period counted from incident closure instead of notification; Commission acknowledgements not retained

Every Incident Rules clause we hold

Each incident and alleged reportable incident record made under section 12 must be kept for 7 years from the day it is made, subject to any longer period another Commonwealth, State or Territory law requires.

Held text: NDIS (Incident Management and Reportable Incidents) Rules, F2018L00633, as made; no amendments at 1 Oct 2026.

what an auditor asks to see Records retention schedule showing a 7-year minimum for incident records; Archive or system retention setting for incident data; Evidence that records from at least several years ago can be retrieved

where it usually falls short Paper incident forms destroyed with participant files at exit; Retention rule not applied when changing software

Every Incident Rules clause we hold

The system must provide for periodic review of the system itself to make sure it remains effective.

Held text: NDIS (Incident Management and Reportable Incidents) Rules, F2018L00633, as made; no amendments at 1 Oct 2026.

what an auditor asks to see Scheduled review of the incident management system with date, reviewer and findings; Updated procedure version history following review; Quality or governance meeting minutes tabling the review

where it usually falls short No review since the system was first written; Review limited to formatting changes without testing effectiveness

Every Incident Rules clause we hold