From Incident to Improvement: Building a Process Your Workers Will Use

Most NDIS providers have an incident policy. Far fewer have an incident system that works at 2am on a Sunday, when a support worker is alone with a participant who has just fallen, or when a family member raises a concern about how a shift was handled. The gap between those two things is where audit findings, delayed reports and repeat incidents usually come from.

A strong NDIS incident management process is not about paperwork for its own sake. It protects participants, gives workers confidence about what to do under pressure and shows the NDIS Quality and Safeguards Commission that your organisation learns from what goes wrong.

This guide explains what the rules require, the steps a practical process should follow, how reportable incidents fit in and what a strong policy needs to cover.

What the Rules Actually Require

Registered NDIS providers must have an incident management system. The NDIS Commission describes it as setting out procedures for identifying, managing and resolving incidents, and a registered provider without one may be in breach of its conditions of registration.

The detail sits in the NDIS (Incident Management and Reportable Incidents) Rules. They require procedures that cover how incidents are identified, recorded and reported, who is responsible for notifying reportable incidents to the Commission, and when investigations and corrective action are needed. Each incident should be assessed for whether it could have been prevented and how well it was managed, taking into account the views of the people affected.

The Rules also set expectations for the people running the system. The system must define the roles and responsibilities of workers and include requirements for training them in it. Records of each incident must be kept for seven years from the day the record is made.

In practice, effective NDIS incident management is less about the policy document and more about whether these elements show up in daily work: workers who know what to do, records that are complete, and reviews that lead to real change. That is exactly what an auditor will test.

Seven Steps in a Practical Incident Process

Every organisation’s process will look slightly different, but strong systems tend to follow the same sequence. Use these steps to check whether yours would hold up in a real situation.

1. Respond and make people safe. The first priority is the safety and wellbeing of the participant and anyone else involved. That may mean first aid, calling emergency services, removing a hazard or separating people. Workers should never delay an urgent response to fill in a form.
2. Notify a supervisor or on-call manager. Workers need a clear, simple escalation path that works around the clock. Make sure the on-call number is easy to find on every shift and that the person answering knows the next steps.
3. Record the facts promptly. Write down what happened, when, where, who was involved and what action was taken, in plain and factual language. Records made close to the event are more accurate and carry more weight later.
4. Decide whether the incident is reportable. A manager should assess every incident against the list of reportable incidents and make the notification decision quickly. Building this check into your process prevents missed or late notifications.
5. Support and involve the people affected. Check in with the participant, their family and any workers involved. Explain what is happening, offer support and access to an advocate where appropriate, and take their views into account when the incident is reviewed.
6. Investigate where needed. More serious incidents, or patterns of smaller ones, may need a structured investigation. Keep it proportionate, fair to everyone involved and focused on causes rather than blame.
7. Act on what you learn. Record corrective actions, give each an owner and due date, and check later that they worked. Review incident trends regularly so repeated issues, such as medication errors on one shift, are picked up early.

A simple way to test your process is to walk through a realistic scenario with your team, such as a participant falling during an evening shift. Ask each person what they would do first, who they would call and what they would write down. Different answers usually point straight to the parts of your process that need clearer instructions or more training.

Reportable Incidents and Notification Timeframes

Some incidents are serious enough that registered providers must notify the NDIS Commission. Under the Rules, reportable incidents include the death of a person with disability, serious injury, abuse or neglect, unlawful sexual or physical contact with or assault of a person with disability, sexual misconduct, and the use of a restrictive practice that is not authorised or not in line with a behaviour support plan. Alleged incidents count too, so you do not wait for proof before notifying.

Timeframes are strict. Death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, and sexual misconduct must be notified within 24 hours of a key person becoming aware. If some details are not available within 24 hours, the core information must still be provided in that window, with the remaining details within five business days. Unauthorised use of a restrictive practice must be notified within five business days.

The Commission may then ask for a final report, generally within 60 business days of the notification. That report covers any investigation or assessment, who carried it out, what was found, what corrective action was taken and whether the people affected were kept informed.

Because the 24-hour clock starts when your organisation becomes aware, the biggest risk is often internal delay. A worker who does not escalate on a Friday night can turn a compliant response into a late notification by Monday.

What a Strong Policy Should Cover

Your NDIS incident management policy is the document auditors read first, but they will test it against your records and your staff. These are the areas where strong policies stand out and weak ones are most often found wanting.

1. Clear definitions with examples. Explain what counts as an incident, a near miss and a reportable incident, using examples relevant to your services. Workers should not need to interpret legal wording to know when to report.
2. Named roles and responsibilities. State who responds, who records, who decides whether an incident is reportable and who notifies the Commission, including after hours. Generic job titles that do not exist in your organisation are a common audit finding.
3. Timeframes that match the Rules. Set out the 24-hour and five-business-day notification requirements and the internal deadlines that make them achievable, such as escalation to a manager within the same shift.
4. Participant involvement and support. Describe how participants and their families are informed, supported and involved in reviews, including access to advocates. The Rules expect the views of affected people to be considered.
5. A proportionate investigation process. Explain when an investigation is needed, who conducts it, how procedural fairness is maintained and how findings are documented. Not every incident needs a full investigation, but the policy should say how that decision is made.
6. Record keeping and data. Specify where incidents are recorded, how long records are kept and how incident data is analysed for trends. The Rules require records to be kept for seven years.
7. Training and review. Describe how workers are trained in the system at induction and refresher points, and when the policy itself is reviewed, such as after a serious incident, an audit or a change in NDIS Commission guidance.

How Angels Compliance and Training Services Can Help

Angels Compliance and Training Services is a compliance consultancy based in Gosnells, Western Australia, supporting NDIS and DVA providers across Australia. Our incident management training is designed for support workers, team leaders, clinical and operations managers, business owners and compliance officers, in fact anyone who reports or responds to incidents.

The session runs for two hours, or as two one-hour sessions, and is delivered virtually or onsite in Perth by arrangement. It covers identifying incidents under NDIS Commission guidelines, immediate response steps, the roles of workers and managers, documenting and reporting within required timeframes, incident reviews and preventive actions, and compliance with the Incident Management and Reportable Incidents Rules. Sessions can be tailored to your own policies and reporting procedures, and participants receive a digital certificate of completion.

Final Thoughts

Incident management is one of the clearest tests of whether an organisation’s systems work in real life. Make sure workers know how to respond and escalate at any hour, record incidents promptly and factually, assess every incident against the reportable list, support the people affected and turn what you learn into lasting improvements. When your process and policy reflect what your team genuinely does, you protect participants and walk into every audit with confidence.

Disclaimer: This article is general information for NDIS providers and is not legal advice. NDIS rules and NDIS Commission guidance can change, and your obligations depend on your registration and circumstances. Always check current guidance from the NDIS Quality and Safeguards Commission.