What counts as an incident
The NDIS Commission defines an incident as an act, omission, event or circumstance that has or could have caused harm to a person with disability, or where a person with disability has caused serious harm, or the risk of serious harm, to someone else.
That is broader than a reportable incident. A near miss, a medication error that caused no harm, or an unexplained bruise are all incidents that belong in your system, even if only some must be reported to the Commission.
Who needs one
Registered providers must have an incident management system as a condition of registration, and it is assessed against the NDIS Practice Standards at audit. It must comply with the NDIS (Incident Management and Reportable Incidents) Rules 2018.
The Commission says all NDIS providers should have one, including unregistered providers and sole traders. The NDIS Code of Conduct, which applies to everyone, requires providers to respond to incidents.
What your system must include
For registered providers, written procedures must describe:
- How incidents are identified, recorded and reported, and who they must be reported to
- The person responsible for notifying reportable incidents to the NDIS Commission
- How you support and assist the person affected, including information about advocates
- How the affected person is involved in managing and resolving the incident
- How investigations into causes and contributing operational issues are carried out
- When corrective action is needed and what it looks like
The six steps for managing an incident
The Commission's guidance sets out a sequence every system should follow:
- Identify the incident, including from indirect signs such as a change in behaviour or physical evidence
- Immediately support the person affected, and call 000 if they need urgent medical care or you suspect a crime
- Record the incident and any evidence, stored securely and privately
- Report and assess it internally: why it happened, whether it could have been prevented, and who else must be told
- Investigate where the initial assessment cannot find the cause
- Learn from it, and change practices to prevent it happening again
Reportable incidents
Some serious incidents must also be reported to the NDIS Commission by registered providers. There are six types: death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, sexual misconduct, and unauthorised use of a restrictive practice. Most must be notified within 24 hours of becoming aware, followed by a 5 day report.
Since 12 October 2026, new reportable incidents, including the 24 hour and 5 day reports, are lodged in the new NDIS Commission Portal. Incidents lodged before that date stay in the existing portal.
Making it proportionate
Your system should fit your size and the supports you deliver, be documented in an accessible form, and be available to all your workers and the participants you support. A sole trader might use a simple incident form, a one page procedure and a log. A large SIL provider will need escalation pathways, a nominated reporting officer and regular review of trends.
The NDIS Commission publishes Incident Management Systems: Detailed Guidance for Registered NDIS Providers, which is also useful if you are unregistered.
Tips that auditors look for
- Workers can explain what to do after an incident without looking it up
- Participants are told how incidents involving them were handled
- Records show follow up actions, not just the first report
- You review incident trends and update policies as a result