The legal foundation
The NDIS (Incident Management and Reportable Incidents) Rules 2018 require every registered provider to have an incident management system that is proportionate to the size of the organisation and the supports delivered, documented, and understood by workers. The system covers all incidents connected with your supports: things that harmed or could have harmed a participant, and acts by a participant that harmed or could have harmed others.
What the system must include
- A documented procedure covering identification, immediate response, assessment, recording, investigation, and resolution of incidents, including who does what and within what timeframes.
- An incident register recording each incident, the participants and workers involved, the response, investigation outcomes, and corrective actions.
- Support for impacted participants: keeping them informed, involving them in the response, and providing supports they need after an incident.
- Worker training so every worker can recognise, respond to, and report incidents, evidenced in your training register.
- Periodic review of incident data to identify trends and feed your continuous improvement plan, auditors love seeing an incident trend review minuted in a management meeting.
Reportable incidents and timeframes
A subset of incidents must be notified to the NDIS Commission whenever they occur in connection with NDIS supports:
| Reportable incident | Notify the Commission |
|---|---|
| Death of a participant | Within 24 hours of key personnel becoming aware, with a detailed report within 5 business days |
| Serious injury of a participant | |
| Abuse or neglect of a participant | |
| Unlawful sexual or physical contact with, or assault of, a participant | |
| Sexual misconduct against, or in the presence of, a participant | |
| Use of an unauthorised restrictive practice | Within 5 business days (24 hours if the participant was harmed) |
Notifications go through the Commission's portal, and your procedure should name who is authorised to submit them. Timeframes and definitions are maintained by the Commission and can change, build the current versions into your procedure and check them at each policy review.
Building a system that passes Stage 2
Most providers fail incident management at implementation, not documentation. The Stage 2 audit samples your register, traces individual incidents through your own procedure, and asks workers what they would do. To be ready:
- Make the form easy. If reporting an incident takes 40 minutes of friction, workers will under-report and your register will look implausibly clean. A one-page initial report with a follow-up workflow beats a perfect form nobody completes.
- Record near misses. An empty register at an established provider reads as under-reporting, not excellence. Near misses evidence a living system.
- Close the loop. Every register entry should show an outcome: what changed, who was informed, and when it was reviewed. Open-ended entries are standing audit findings.
- Brief your workers, then test them. Five minutes in each team meeting on "what would you do if" scenarios prepares staff for the exact questions auditors ask.
Where to get the documents
Our 220+ document package includes the complete incident management set: policy, procedure with reportable incident workflows and timeframes, incident report forms, the register, investigation templates, and the training materials to brief your team, all editable and structured against the Practice Standards outcomes your auditor will assess.