What the Practice Standards require
The Core Module requires risk management proportionate to your organisation's size and the scope and complexity of the supports you deliver. Proportionate does not mean optional: whether you're a sole trader or a 200-staff organisation, the auditor expects a documented framework, a living register, and risk thinking visibly applied to each participant's supports. Risk management also anchors the verification pathway, where a risk management approach is one of the named document requirements.
Layer 1: organisational risk
Your enterprise risk system needs four working parts:
- A risk management policy and framework describing how risks are identified, rated, treated, owned, and reviewed, usually with a simple likelihood-by-consequence matrix.
- A risk register covering the real categories for an NDIS provider: participant safety, workforce and screening compliance, clinical and medication risk, WHS, financial viability, information and privacy, fraud, and continuity. Each entry carries a rating, a treatment, an owner, and a review date.
- Linked registers. Incidents, complaints, and corrective actions all feed risk reviews; an incident trend that never updates the risk register is a classic finding.
- Scheduled review. A standing agenda item with minutes, quarterly works for most small providers, showing the register is used, not framed.
Layer 2: participant risk
Every participant file should show an individual risk assessment completed at intake and reviewed regularly: health and medication risks, environment and home safety, behaviours of concern, communication and decision-making support needs, transport, and community settings. Two qualities separate a pass from a finding:
- The assessment matches the plan. Risks identified at intake should visibly shape the support plan, dignity-of-risk conversations included, with the participant's choices documented.
- The assessment matches reality. Stage 2 auditors cross-check files against worker interviews and, where applicable, site visits. An assessment that hasn't been reviewed since intake while the participant's needs changed is the most common participant-level finding.
The overlaps: WHS and emergency planning
NDIS risk management doesn't replace work health and safety law, your workers are owed a safe system of work under WHS legislation regardless, and home visits, manual handling, and community settings are where the two regimes meet. Keep WHS hazards in scope of the same register rather than running parallel systems.
Emergency and disaster management is now a distinct Core Module expectation: a documented plan for maintaining critical supports through pandemics, natural disasters, and infrastructure failures, with participant-level continuity arrangements for people who depend on your services for daily living. Review it annually and after every activation, and minute the review.
What auditors check, by pathway
| Verification | Certification |
|---|---|
| A documented, proportionate risk management approach alongside your incident and complaints processes | The full framework: register quality, participant assessments sampled from files, linkage to incidents and improvement, emergency planning, and whether workers and managers can describe how risk is actually managed |
Where to get the documents
Our 220+ document package includes the complete risk set: risk management policy and framework, organisational risk register with matrix, participant risk assessment templates, WHS forms, and the emergency and disaster management plan, all editable Word documents structured against the Practice Standards outcomes auditors assess.