Incident management is one of the most critical compliance obligations for NDIS providers. Getting it wrong — failing to report, reporting late, or not following up — can result in significant consequences including registration suspension. This guide explains exactly what you need to do.
What is a Reportable Incident?
Under the NDIS Act, certain incidents involving NDIS participants must be reported to the NDIS Quality and Safeguards Commission. These are called “reportable incidents” and include:
- Death of an NDIS participant
- Serious injury of a participant (including hospitalisation)
- Abuse or neglect of a participant
- Unlawful sexual or physical contact with a participant
- Use of a restrictive practice not authorised in a behaviour support plan
- Unexplained absence of a participant from a residential setting
Not all adverse events are reportable incidents. A participant tripping and receiving a minor graze, for example, should be recorded in your internal incident register but is not a Commission-reportable incident. Good judgment — and clear internal policies — help workers understand the distinction.
Mandatory Reporting Timeframes
Registered NDIS providers must report certain incidents to the Commission within strict timeframes:
- Priority incidents (death, serious injury, abuse, neglect): Initial report within 24 hours of becoming aware of the incident. Written report within 5 business days.
- Non-priority reportable incidents: Report within 5 business days.
Unregistered providers do not have mandatory reporting obligations to the Commission, but should still maintain internal incident records and have their own processes for managing and responding to incidents.
The Four Stages of Incident Management
- Immediate response: Ensure the safety of the participant and others. Provide first aid if needed. Contact emergency services if the situation requires it. Remove the person involved if ongoing risk exists.
- Record and report: Complete an incident report within your system as soon as practicable. Notify your supervisor or manager. Notify the participant’s family or nominee where appropriate. Submit to the Commission if reportable.
- Investigation: For serious incidents, conduct a thorough root cause investigation. What happened? What were the contributing factors? What could have prevented it?
- Review and improvement: Update your policies, procedures, or training based on what the investigation found. Document the actions taken. Close the incident in your system only once all follow-up actions are complete.
Building Your Incident Register
Every NDIS provider should maintain an incident register that records:
- Date, time, and location of the incident
- Description of what occurred
- People involved (participants, workers, third parties)
- Immediate actions taken
- Whether the incident is reportable and, if so, whether it has been reported to the Commission
- Investigation findings and root cause
- Corrective actions taken and their completion dates
Your incident register will be reviewed during audits. Auditors look not just at whether incidents were recorded, but at the quality of your investigation and whether you took meaningful corrective action.
Common Mistakes Providers Make
- Underreporting: Workers not understanding what constitutes a reportable incident. Fix this with clear definitions in your policies and regular training.
- Late reporting: Missing the 24-hour window because incidents weren’t escalated promptly. Fix this with an on-call management contact and a clear escalation pathway.
- Inadequate investigation: Closing incidents without genuinely understanding why they occurred. Every serious incident needs a root cause analysis.
- No follow-up: Identifying corrective actions but not completing them. Assign every action to a named person with a due date.
Key Takeaways
- Know the definition of a reportable incident — all staff should be trained on this.
- Meet the 24-hour reporting deadline for priority incidents — have an escalation pathway ready.
- Investigate every serious incident to find the root cause, not just to document the outcome.
- Close incidents only when all corrective actions are complete.
- Use software to track incidents, investigation status, and action completion in real time.