Understanding Incident Management in the NDIS
Incident management is one of the most critical compliance areas for NDIS providers. Getting it right protects participants, protects your organisation, and demonstrates your commitment to quality and safety.
This guide covers everything you need to know about identifying, responding to, and reporting incidents as an NDIS provider.
Why Incident Management Matters
Incident management isn't just a compliance requirement - it's fundamental to participant safety and service quality.
Effective incident management:
- Protects participants from harm
- Identifies systemic issues before they escalate
- Demonstrates accountability and transparency
- Supports continuous improvement
- Meets regulatory requirements
Poor incident management:
- Puts participants at risk
- Exposes your organisation to regulatory action
- Creates liability issues
- Damages trust and reputation
- Suggests broader quality problems
What Counts as an Incident?
An incident is any event that causes or could cause harm to a participant, or represents a departure from expected care.
Reportable Incidents (Must be reported to NDIS Commission)
The following incidents MUST be reported to the NDIS Quality and Safeguards Commission:
1. Death of a Participant Any death that occurs in connection with supports or services you provide, regardless of cause.
2. Serious Injury Physical injury requiring medical treatment beyond first aid, including:
- Hospital admission
- Treatment by a doctor for significant injury
- Injuries with potential long-term impact
3. Abuse or Neglect Any abuse or neglect (alleged or substantiated) including:
- Physical abuse
- Emotional or psychological abuse
- Financial abuse
- Neglect (failure to provide adequate care)
4. Unlawful Sexual Contact Any sexual contact without consent, or with a person unable to consent.
5. Unlawful Physical Contact Physical contact that constitutes assault or is otherwise unlawful.
6. Unauthorised Restrictive Practices Use of any restrictive practice:
- Without appropriate authorisation
- Beyond what's authorised
- In an emergency without subsequent reporting
Other Incidents (Internal management required)
Not all incidents require NDIS Commission notification, but all incidents require internal management:
- Near misses (events that could have caused harm but didn't)
- Minor injuries (requiring first aid only)
- Medication errors (without significant harm)
- Property damage
- Complaints that don't meet reportable thresholds
- Behavioural incidents (without injury)
- Service delivery failures
Reporting Timeframes
Immediate Notification (Within 24 hours)
For reportable incidents, you must notify the NDIS Commission within 24 hours of becoming aware of the incident.
What to include in immediate notification:
- Type of incident
- When it occurred
- Who was involved (participant identifiers)
- Brief description of what happened
- Immediate actions taken
- Whether emergency services were contacted
Note: You won't have full details at this stage. The immediate notification is about alerting the Commission quickly, not providing comprehensive information.
5-Day Report
Within 5 business days, you must submit a more detailed report including:
- Comprehensive incident description
- Immediate response actions
- Support provided to the participant
- Support provided to others affected
- Initial investigation findings
- Preliminary corrective actions
- Status of notification to participant/family
Final Report
When your investigation is complete, you must submit a final report including:
- Full investigation findings
- Root cause analysis
- Corrective actions implemented
- Preventive measures
- Evidence of implementation
- Confirmation of participant/family notification
Building Your Incident Management System
1. Incident Management Policy
Your policy should cover:
Definitions:
- What constitutes an incident
- Categories of incidents
- Reportable vs non-reportable incidents
Responsibilities:
- Who can identify incidents (everyone)
- Who is responsible for initial response
- Who is responsible for reporting
- Who is responsible for investigation
- Who is responsible for resolution
Procedures:
- How to report incidents internally
- Escalation pathways
- Investigation procedures
- Documentation requirements
- Communication protocols
Review:
- How incidents inform improvement
- Trend analysis
- Policy review triggers
2. Incident Reporting Mechanisms
Make it easy for anyone to report incidents:
Multiple reporting channels:
- Verbal reporting (immediate)
- Incident report forms
- Electronic reporting (if systems support it)
- After-hours reporting pathway
Accessible formats:
- Easy Read versions for participants
- Multiple languages if needed
- Clear, simple instructions
Supportive culture:
- No-blame approach to reporting
- Clear that reporting is expected and valued
- Protection for people who report
3. Incident Register
Maintain a register that tracks:
- Incident date and time
- Discovery date and time
- Incident type/category
- People involved
- Brief description
- Immediate actions
- Investigation status
- Corrective actions
- Reporting status (if applicable)
- Closure date
4. Investigation Procedures
For incidents requiring investigation:
Immediate response:
- Ensure safety
- Provide support
- Preserve evidence
- Document initial facts
Investigation:
- Gather information
- Interview witnesses
- Review documentation
- Identify contributing factors
- Determine root cause
Resolution:
- Implement corrective actions
- Support affected people
- Document outcomes
- Report as required
Responding to Incidents: Step by Step
Step 1: Immediate Response (Minutes)
Priority 1: Safety
- Is anyone in immediate danger?
- Do emergency services need to be called?
- What immediate actions are needed to ensure safety?
Priority 2: Support
- What support does the affected participant need?
- What support do witnesses or others need?
- Who needs to be notified immediately?
Priority 3: Preservation
- Document what you observe
- Preserve any evidence
- Note names of people present
Step 2: Initial Documentation (Within hours)
Complete an incident report form including:
- Factual description of what occurred
- Time, date, location
- People involved
- Immediate actions taken
- Injuries or impact
- Witness information
Step 3: Assessment (Within 24 hours)
Determine:
- Is this a reportable incident?
- What is the severity?
- What investigation is required?
- Who needs to be notified?
Step 4: Reporting (If required)
For reportable incidents:
- Submit immediate notification within 24 hours
- Prepare for 5-day report
- Plan investigation
Step 5: Investigation
For incidents requiring investigation:
- Appoint investigator (may need to be external for serious incidents)
- Gather information
- Interview relevant people
- Review documentation
- Identify causes and contributing factors
Step 6: Corrective Action
Based on investigation:
- Implement immediate fixes
- Develop systemic improvements
- Update policies/procedures if needed
- Provide additional training if needed
Step 7: Closure and Review
- Complete all reporting requirements
- Confirm corrective actions are effective
- Update incident register
- Consider what can be learned for the future
Special Considerations
Restrictive Practices Incidents
Restrictive practices have additional reporting requirements:
Monthly Reporting: All use of regulated restrictive practices must be reported monthly to the NDIS Commission, including:
- Type of practice used
- Duration of use
- Reason for use
- Authorisation status
- Follow-up actions
Unauthorised Use: Any unauthorised use of restrictive practices is a reportable incident requiring immediate notification.
Incidents Involving Death
Deaths have specific requirements:
- Immediate notification to Commission
- Immediate notification to police (if applicable)
- Notification to coroner (varies by jurisdiction)
- Notification to family/representatives
- Internal incident management
- Potential external investigation cooperation
Multi-Provider Incidents
When an incident involves multiple providers:
- Each provider has reporting obligations
- Coordinate where possible
- Don't assume someone else is reporting
- Document your involvement and response
Staff Training on Incident Management
All staff need to understand:
Basic Training (All Staff)
- What is an incident
- How to recognise incidents
- How to respond immediately
- How to report internally
- Their role in supporting participants after incidents
Advanced Training (Key Personnel)
- Reportable incident categories
- NDIS Commission reporting requirements
- Investigation procedures
- Documentation requirements
- Root cause analysis
- Corrective action development
Common Incident Management Mistakes
Mistake 1: Not Recognising Incidents
Problem: Incidents happen but aren't identified as incidents. Solution: Train all staff on incident recognition. When in doubt, report.
Mistake 2: Delayed Reporting
Problem: Incidents are identified but not reported within timeframes. Solution: Clear escalation procedures. Don't wait for full information before notifying.
Mistake 3: Inadequate Documentation
Problem: Incident reports lack detail or aren't completed. Solution: Use structured forms. Train staff on documentation requirements.
Mistake 4: No Root Cause Analysis
Problem: Incidents are managed but underlying causes aren't addressed. Solution: Always ask "why" - identify systemic issues, not just individual failures.
Mistake 5: Corrective Actions Not Implemented
Problem: Actions are identified but never completed. Solution: Track corrective actions to completion. Verify effectiveness.
Key Requirements Summary
| Requirement | Timeframe | Details |
|---|---|---|
| Internal incident identification | Immediately | All incidents |
| Immediate notification to NDIS Commission | Within 24 hours | Reportable incidents only |
| 5-day report | Within 5 business days | Reportable incidents only |
| Final report | When investigation complete | Reportable incidents only |
| Monthly restrictive practices report | By 14th of following month | All authorised restrictive practices |
| Incident register maintenance | Ongoing | All incidents |
Resources
- NDIS Commission Incident Management Guide
- Reportable Incidents Fact Sheet
- NDIS Commission Portal (for reporting)
- Your state/territory health complaints body
- Emergency services (000)
The Bottom Line
Incident management is about protecting participants and learning from events. The goal isn't to avoid incidents entirely (some are unavoidable) but to respond effectively, report appropriately, and improve continuously.
Build systems that make incident identification and reporting easy. Create a culture where reporting is expected and valued. Learn from every incident to improve your services.
If you're unsure whether something is reportable, err on the side of reporting. The NDIS Commission would rather receive a notification that turns out not to be required than not receive one that should have been submitted.
