Incident management is one of the important aspects of running and managing an NDIS provider organisation. It deals with the health, safety and well-being of the participants, staff and others involved. Therefore, it is important to know how to effectively manage incidents so as to reduce the threats during the delivery of service and guarantee the protection of everyone involved.
The first step to better handle incidents is to clearly understand and know what an incident is. This means understanding what kind of event counts as an incident, measuring the impact or seriousness of an incident, and knowing the types of incidents that need to be handled and recorded internally and what needs to be reported.
The NDIS Quality and Safeguards Commission provides detailed guidance on incident management that clearly and in detail explains what incidents are. The NDIS also expects providers to have an incident management system in place for better management of incidents that happen while providing support to participants. While most providers only focus on reportable incidents, the NDIS expects the system to cover and consider a wider range of incidents that occur.
Identifying such situations or accidents and responding to them in a responsible and suitable manner is important to ensure such issues are handled well and with the least effect on the participants' and other people's well-being. It is the responsibility of the provider to have a proper system in place that defines effective handling of any unexpected situation, records it, and learns from it to proactively avoid such incidents happening again.
This article helps you understand what incidents are in depth to better identify them, understand them and improve your system and procedures for the best incident management approach. In practice, incident management does not mean your service is perfect and the probability of incidents is zero, because unexpected situations can happen anytime. Therefore, effective management of incidents involves having the right procedures to avoid incidents as much as possible and better manage incidents when they do take place.
This guide breaks down how the NDIS incident framework works, what incidents your system must capture, and when an incident becomes a reportable incident.
Recommended Reads
Having a suitable incident management system (IMS) to manage incidents is a requirement for NDIS providers. It is, in fact, a condition for registrations for registered NDIS providers. This means that if a provider applies for registrations or for a renewal, the auditor checks whether you have an incident management system to identify, manage and resolve incidents effectively.
An effective incident management system should be able to identify risk early, respond quickly when something happens, manage incidents appropriately, and learn from previous incidents. The system should display accountability and transparency.
At its core, the system must support three functions:
Without a structured system, incidents can easily be missed, poorly documented, or handled inconsistently across staff and services.
An incident is broader than many providers expect.
The NDIS Quality and Safeguards Commission provides detailed guidance for incident management. According to that, an incident is defined as the occurrence of something, an absence/omission or a situation that causes harm or could have caused harm to people involved when a service is being provided to a participant.
To be counted as an incident, it needs to occur in connection with the delivery of a service or support. Moreover, an incident can be harmful to a participant as well as to a worker. It is clearly stated that an incident can be either an act that caused or could have caused harm to a participant or an act by a participant that caused harm or risk of serious harm to another person.
The harm may be:
The person who is responsible for the incident can be many people:
These incidents that happen in association with the delivery of service must be recorded in the provider's IMS.
So what does 'in connection with service delivery' mean?
This is one of the most misunderstood parts of the framework. This phrase is broad and covers a wide range of incidents. There is no one specific definition or incident. An incident can be considered an occurrence in connection with the delivery of support or service in one of these conditions:
Therefore, the incident should be linked in some way to the provision of support or should be a result of the way it is delivered. Registered providers are only required to report an incident that happened or is alleged to have happened to the commission if the event happened in connection with the service delivery.
Reportable incidents can happen in many places. For example, in a participant’s home; in supported accommodation or on the provider's premises, such as therapy rooms; or while accessing the community with a support worker.
An NDIS provider should understand and carefully evaluate whether there is a link between the service and what happened or whether the service delivery caused it. It is important to think before tagging incidents as reportable because some may simply occur by coincidence, even if they occurred during the time of service delivery.
For example, if the person trips over their shoelaces while leaving the appointment or is hit by a falling brick from the roof, this will not be considered an incident that occurred in connection with service delivery.
A provider’s incident management system must capture several types of events, even when they are not reportable incidents.
These incidents involve acts, omissions, or circumstances related to supports that resulted in harm or posed a risk of harm.
Examples might include:
Even if the harm was minor, recording these incidents helps providers identify patterns and improve safety.
The system must also capture incidents where a participant’s actions cause serious harm or risk of serious harm to another person.
The impacted person could be:
These incidents still need to be recorded because they relate to the provision of support and may indicate behavioural risks or support needs that must be addressed.
However, not all worker injuries fall into this category. For example, if a worker accidentally burns themselves while cooking a participant’s meal, this would normally be handled under work health and safety processes, not the NDIS incident management system.
Some incidents are considered so serious that they must be reported to the NDIS Quality and Safeguards Commission.
These are called reportable incidents.
An incident becomes reportable when two conditions are met:
These incidents must be reported within specific timeframes.
The NDIS framework identifies six types of incidents that providers must report.
These categories focus on serious harm or serious safeguarding concerns involving a person with a disability.
A death is reportable when it occurs in connection with the provision of supports or services.
A common mistake is assuming that a death does not need to be reported if it appears to be due to natural causes. However, if the participant was receiving support or under supervision at the time, the incident may still need to be reported.
Providers should focus on whether there was any connection between the service and the circumstances surrounding the death.
A serious injury typically involves harm that has a significant or lasting impact. Examples may include injuries that require:
These incidents may arise from falls, unsafe environments, incorrect support practices, or other risks associated with service delivery.
Abuse can take many forms, including the following:
Neglect often occurs when a participant’s basic care, supervision, or support needs are not adequately met.
In practice, providers sometimes treat these situations as staffing or rostering issues. However, if a participant’s well-being were compromised because supports were not provided appropriately, it would become a safeguarding incident, not just an operational issue.
This category covers situations where a participant experiences unlawful sexual or physical contact or assault.
Importantly, the alleged subject of the incident does not have to be a worker. The person involved could be:
What matters is whether the incident occurred in connection with the provision of support or services.
Sexual misconduct includes inappropriate sexual behaviour directed towards a participant or behaviour that occurs in the presence of a participant.
This category also includes grooming, where someone attempts to build trust with a participant in order to exploit them sexually.
Sometimes, early warning signs appear long before a serious incident occurs. Boundary violations, inappropriate messages, or unusual patterns of contact can all be indicators that require attention.
Restrictive practices are actions or interventions that restrict the rights or movement of a person with a disability.
They are only permitted when properly authorised and documented through behaviour support processes.
A reportable incident occurs if a restrictive practice is used:
A common example is environmental restraint, such as locking cupboards, fridges, or gates in a way that restricts a participant’s freedom or access.
Even when staff believe these actions are necessary for safety, they must still follow the proper authorisation and documentation processes.
Providers must notify the Commission within specific timeframes after key personnel become aware of the incident.
| Incident Type | Reporting Timeframe |
| Death | Within 24 hours |
| Serious injury | Within 24 hours |
| Abuse or neglect | Within 24 hours |
| Unlawful sexual or physical contact/assault | Within 24 hours |
| Sexual misconduct, including grooming | Within 24 hours |
| Unauthorised restrictive practice | Within 5 business days |
If the restrictive practice caused serious harm or injury, the timeframe is 24 hours.
Incident management under the NDIS is not just about responding to serious events. It is about creating a system that captures risks early, protects participants, and ensures transparency when harm occurs.
By clearly distinguishing between:
Providers can build safer services and avoid many of the compliance issues that arise during audits.