Incident management and reportable incidents

Your incident management system

The NDIS Practice Standards require every registered provider to have an incident management system in place official source (opens in a new tab). This is not simply a form to fill in after something goes wrong. It is an organisational system that covers how your staff identify and respond to incidents as they happen, how incidents are documented, how they are reviewed, and how the organisation learns from them to reduce the risk of recurrence.

A well-designed incident management system will have clear definitions of what constitutes an incident, a straightforward process for staff to report incidents without fear of blame, timelines for reviewing and escalating reports, and evidence that learning from incidents is fed back into practice. The system must cover incidents involving participants in the delivery of supports, including those that occur in the community, not only on your premises.

What is a reportable incident

The Commission’s categories cover death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, sexual misconduct including grooming, and unauthorised use of a restrictive practice. Allegations are included; a provider must not wait for proof before considering notification official source (opens in a new tab).

Assess the facts against the legal categories. An unexplained absence, fall or other safety concern still needs an internal response and may meet a reportable category depending on what happened. The event’s informal label does not decide reportability.

Timeframes

The clock starts when the registered provider becomes aware of the incident. Most categories require notification within 24 hours. Unauthorised restrictive practice without harm has a 5-business-day window; where it causes harm, the deadline is 24 hours. Additional information is normally due within five business days of awareness official source (opens in a new tab).

Record both the occurrence and awareness times. Escalate promptly and verify the legal deadline rather than relying only on a software reminder.

How to notify the Commission

From 12 October 2026, lodge new incidents in the new NDIS Commission Portal. For incidents lodged before that date, follow-up reports and existing history remain in the earlier portal. Check the Commission’s official source (opens in a new tab) before starting.

Recording an incident in your own software does not notify the Commission. An authorised person must submit the required report, retain the confirmation and complete follow-up. Emergency and police responses remain separate obligations.

Records and learning

Keeping complete records of every incident, including those that are internal-only and those reported to the Commission, is a core obligation under the Practice Standards official source (opens in a new tab). Records must be maintained securely and retained for the period required by the rules. During an audit, the auditor will review a sample of incident records to assess whether your system is operating effectively, whether incidents have been responded to appropriately, and whether there is evidence of learning being applied.

The learning loop is often where incident management systems fall short. Recording incidents diligently but taking no action to prevent recurrence is not compliance. Your system should include a mechanism for reviewing incident patterns across your organisation, identifying themes, and feeding those insights back into training, supervision, and practice improvement. Where behaviour support is involved, incidents relating to the use of restrictive practices must also be reported through the behaviour support plan framework official source (opens in a new tab).