Incident management system

What is an NDIS incident management system?

An incident management system is the documented set of policies, procedures and records a registered NDIS provider uses to identify, respond to, record, investigate and learn from incidents connected with its supports. Every registered provider must have one that is proportionate to its size and the supports it delivers. It covers all incidents, not just the serious ones that must be notified to the NDIS Commission.

The requirement comes from section 73Y of the NDIS Act 2013 and Part 2 of the NDIS (Incident Management and Reportable Incidents) Rules 2018. Auditors assess it against the incident management outcome in the NDIS Practice Standards core module. The "system" doesn't have to be software: a small provider can meet the Rules with clear written procedures, trained staff and a well-kept register. What matters is that it works in practice.

When people search "NDIS incident management", they usually want one of three things: what counts as an incident, what the system must contain, or how it relates to reportable incidents. This page covers all three.

What counts as an incident

Section 9 of the Rules defines an incident broadly. A provider's system must cover:

• acts, omissions, events or circumstances connected with the provider's supports that caused, or could have caused, harm to a person with disability, including near misses;
• acts by a person with disability, connected with the supports, that caused serious harm, or a risk of serious harm, to another person; and
• reportable incidents that are alleged to have occurred in connection with the supports.

That means a medication error with no harm, a fall, a near miss in a vehicle, property damage that put someone at risk, and an allegation of abuse all belong in the system. Only the six reportable types are also notified to the NDIS Commission.

What the system must include

The Rules set out the minimum. Drawing on sections 10 to 12 and the Commission's Incident Management Systems detailed guidance, a compliant system has:

How an incident moves through the system

Most incidents follow the same path, whether or not they are reportable. Speed matters at the start, because a reportable incident's 24-hour clock starts when the provider becomes aware.

Assessment should consider the views of the person affected. For serious matters an impartial investigator, with no involvement in the incident, gathers records and evidence, interviews the person, witnesses and the subject of any allegation, and documents findings and corrective actions. The Commission can also refer a reportable incident to police or another body, require remedial action, require the provider to investigate or engage an independent expert, or run its own inquiry.

Incident management system vs reportable incidents vs complaints

These are three connected but separate obligations. One event can touch all three.

A provider also needs a complaints management system under separate rules. Many providers run incidents and complaints in the same platform, but keep the processes distinct.

What providers need to do

1. Write it down. A policy and procedure that matches your size and services, naming who notifies the Commission and who covers after hours.
2. Make reporting easy for workers. A phone call to a supervisor at the time, then a short, objective written report. The free progress note writer helps workers keep notes factual.
3. Triage every incident. Decide quickly whether it is reportable; the reportable incident checker applies the Commission's rules and works out the deadlines.
4. Keep one register. Every incident, reportable or not, with its assessment, actions and close-out.
5. Review the data. Look for patterns by person, site, time or type at least monthly, and record what you changed.
6. Train and test. Train new and existing workers, give participants accessible information, and review the system periodically.

Incidents often reveal gaps elsewhere, such as an out-of-date participant risk assessment or poor shift handover. Good systems feed those lessons back into everyday practice.

Recent changes (2026)

• The Rules are unchanged. The Incident Management and Reportable Incidents Rules 2018 were in force without amendment as at October 2026, so the Part 2 requirements stand.
• Higher penalties. Since 9 April 2026 the Integrity and Safeguarding Act 2026 allows civil penalties of up to 250 penalty units for breaching a condition of registration, or up to 10,000 penalty units for a serious contravention.
• More providers covered. Mandatory registration for SIL from 1 July 2026 means every SIL provider now needs a compliant incident management system.
• Updated guidance. The Commission republished its detailed reportable incidents guidance in February 2026; the incident management systems guidance linked above is dated September 2024.

What participants and families should know

If you receive supports from a registered provider, you can ask for a copy of its incident management procedures in a form you understand. When something happens to you, the provider should support you, involve you in working out what went wrong, and tell you what it is doing about it. You can bring a family member, guardian or independent advocate into that conversation.

If you don't think an incident was handled properly, raise it with the provider first through its complaints process. You can also contact the NDIS Commission directly, and in an emergency or where a crime may have happened, contact police.

Common mistakes

• Only recording reportable incidents. Near misses and minor incidents are where most of the learning is.
• A policy nobody uses. Auditors look for evidence the system works: completed records, actions and reviews.
• No after-hours cover. Weekends don't pause the 24-hour reportable incident deadline.
• Closing without action. Every incident needs an assessment and, where needed, a corrective action with an owner.
• Leaving the person out. The Rules expect the person affected to be supported and involved.
• Ignoring unregistered status. Unregistered providers aren't bound by Part 2 of the Rules, but they must follow the NDIS Code of Conduct, and a simple incident process is still good practice.