NDIS incident management and reportable incidents.
An incident is not just a form you fill in after the fact. For a registered NDIS provider, having an incident management system is a regulatory obligation — and the record you keep is exactly what the NDIS Quality and Safeguards Commission, and later an auditor, will ask to see.
When something goes wrong for a participant, how you respond matters first. But whether you can show what you did matters almost as much — because getting this wrong is both a participant-safety failure and a compliance one.
Registered NDIS providers must record, manage, and learn from every incident affecting a participant — and report the most serious ones to the NDIS Quality and Safeguards Commission, typically within 24 hours. The six reportable categories include participant death, serious injury, abuse or neglect, unlawful contact, sexual misconduct, and any unauthorised use of a restrictive practice.
What the rules require
Registered NDIS providers are required to have an incident management system under the NDIS (Incident Management and Reportable Incidents) Rules 2018, overseen by the NDIS Quality and Safeguards Commission. The system is not only for the most serious events. It has to record, manage and learn from incidents that affect the people you support, whether or not those incidents are reportable to the Commission.
That means a worker raising a near miss, a medication error, or a difficult interaction is part of the system too — not just the rare critical event. The point is to identify what happened, act on it, and reduce the chance of it happening again, with a record that proves you did.
A binder on a shelf is not a system
A folder of policies nobody opens does not satisfy the Rules. What counts is whether incidents actually get captured, managed, and closed out in practice — and whether you can produce that record when the Commission or an auditor asks.
What counts as a reportable incident
A subset of incidents are reportable incidents, which must be notified to the Commission. These are the serious ones, and the categories are set out in the Rules:
- —The death of a participant.
- —Serious injury of a participant.
- —Abuse or neglect of a participant.
- —Unlawful sexual or physical contact with, or assault of, a participant.
- —Sexual misconduct committed against, or in the presence of, a participant.
- —The use of a restrictive practice that is not authorised, or is not used in line with an authorisation or behaviour support plan.
The list is deliberately broad, and the bar for "serious" is not yours to set casually. That last category is the one that catches providers out: the unauthorised use of a restrictive practice is itself a reportable incident, even if no one was physically hurt. If a worker restrains, secludes, or medicates a participant outside an approved authorisation or behaviour support plan, that is reportable in its own right.
The timeframes
Reportable incidents come with a clock, and the clock starts when you become aware of the incident — not when it is convenient. The most serious reportable incidents, such as a death, serious injury, abuse or neglect, unlawful contact, or sexual misconduct, must generally be notified to the Commission within 24 hours, with a fuller report commonly following within 5 business days. The unauthorised use of a restrictive practice is commonly notified within 5 business days. After the initial notification you are usually asked for a follow-up describing your investigation and the actions you took.
The safe operating rule is simple: the moment an incident looks like it might be reportable, start the clock and treat 24 hours as your default until you have confirmed otherwise.
Always confirm the current requirements
The exact obligation depends on the type of incident, and these requirements can change. The timeframes above are a guide, not legal advice — always confirm the current categories, timeframes, and reporting forms directly with the NDIS Quality and Safeguards Commission at ndiscommission.gov.au rather than relying on memory or an old checklist.
Where providers come unstuck
Most failures here are not about indifference. They are about an incident that was handled in the moment but never properly captured. The common patterns:
Handled in the moment, never captured
The incident was dealt with on the spot, but it lives only in a paper book, a text message, or a worker's memory — never in a system anyone can search. By the time it matters, the detail is gone.
No clear path from noticing to logging
There is no obvious route from a support worker spotting something to it being formally logged, so it depends on someone remembering to follow up — and one busy fortnight later, nobody does.
The reporting clock quietly missed
The notification deadline passed because nobody clearly owned it, or because nobody realised in time that the incident was reportable at all. A missed clock is hard to explain after the fact.
Records that do not connect, or cannot be produced
The incident is not linked to the participant, the case note that first flagged the concern, or the actions taken in response — so the file shows the problem but not the response. Or the records exist somewhere, but cannot be pulled together quickly when the Commission or an auditor asks. Keeping incidents inside your NDIS case management software, linked to the participant record, is what makes them producible on request.
The checklist: what good incident management does
A good incident management system is judged by what it actually does, not by whether a policy document exists. It should:
Let a worker raise an incident at the point of care
From their phone, while the detail is still fresh — not after they are back at a desk and the clock has already been running.
Capture what happened, who was involved, and when
Including the immediate actions taken at the time, so the record reflects the response as well as the event.
Categorise the incident
Including whether it is reportable to the Commission, so the right obligations are triggered.
Start and track the reporting clock
So a notification deadline is never quietly missed, and someone clearly owns it.
Link the incident to the participant
And to the case note or shift it arose from, so the record is connected rather than stranded.
Record the investigation and the actions taken
To show how you reduced the chance of it happening again, not just that it happened.
Retain everything in a tamper-evident, audit-ready record
One that cannot be quietly edited away, so the history holds up as evidence.
Surface open incidents
So none are forgotten before they are closed out, and nothing slips between fortnights.
For NDIS providers using practice management software
Rostrel includes a built-in incident register where support workers can raise an incident directly from a case note or shift record, linked to the participant it concerns, while the detail is still fresh. Each incident is categorised at the point of logging — including whether it is reportable — so the 24-hour clock is visible from the moment it starts. All records are held behind a deletion-protected audit trail, and open incidents surface on the dashboard so nothing is forgotten before it is closed out.
Frequently asked questions
What is an incident management system under the NDIS?
Registered NDIS providers must have an incident management system under the NDIS (Incident Management and Reportable Incidents) Rules 2018, overseen by the NDIS Quality and Safeguards Commission. It has to record, manage and learn from incidents that affect the people you support — not only the most serious events, but near misses, medication errors and difficult interactions too.
What is a reportable incident?
A reportable incident is a serious incident that must be notified to the NDIS Commission. The categories are set out in the Rules: the death of a participant, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, sexual misconduct, and the use of a restrictive practice that is not authorised or not used in line with an authorisation or behaviour support plan.
How quickly must a reportable incident be reported to the NDIS Commission?
The most serious reportable incidents — death, serious injury, abuse or neglect, unlawful contact or sexual misconduct — must generally be notified to the Commission within 24 hours, with a fuller report commonly following within 5 business days. The unauthorised use of a restrictive practice is commonly notified within 5 business days. Timeframes depend on the type of incident and can change, so always confirm the current requirements directly with the Commission.
Is the unauthorised use of a restrictive practice reportable?
Yes. The use of a restrictive practice that is not authorised, or is not used in line with an authorisation or behaviour support plan, is a reportable incident in its own right — even if no one was physically hurt. It is the category that most often catches providers out.
Do I have to report every incident to the NDIS Commission?
No. Only reportable incidents — the serious categories set out in the Rules — must be notified to the Commission. But every incident that affects a participant still has to be recorded and managed within your incident management system, whether or not it is reportable.
Keep every incident on the record
Rostrel includes an incident register built for this. An incident can be raised straight from a case note, linked to the participant it concerns, with the actions taken recorded against it — all behind a deletion-protected audit trail, so the history cannot be quietly changed. Open incidents surface on the dashboard so none are forgotten before they are closed.
Book a 20-minute demo