National Disability Insurance Scheme (Incident Management and Reportable Incidents) Rules 2018

The instrument revolves around a small set of tightly defined concepts and operational rules. The principal concepts to track and translate into operational practice are incident management system, incident (and categories of incident that must be covered), reportable incident, notification obligations and timeframes, duties of specific persons, documentation and retention, Commissioner powers, and procedural fairness.

Incident management system and coverage. Section 8 imposes an obligation to implement and maintain an incident management system that complies with Division 2. Section 9 defines the incidents that must be covered. These are acts, omissions, events or circumstances that occur in connection with providing supports or services and that have, or could have, caused harm to a person with disability (s 9(1)). The system must also cover acts by a person with disability that, in the course of supports, have caused serious harm or risk of serious harm to another person (s 9(2)). Reportable incidents that are alleged to have occurred must also be covered (s 9(3) and s 7).

Incident management procedures. Section 10 lists procedural content obligations: how incidents are identified, recorded and reported (s 10(1)(a)); to whom incidents must be reported (s 10(1)(b)); the person responsible for reporting to the Commissioner (s 10(1)(c)); how the provider will support affected persons and involve them in resolution (s 10(1)(d)-(e)); thresholds and scope for provider investigations (s 10(1)(f)); and when corrective action is required (s 10(1)(g)). The system must require assessment of preventability, management quality, remedial action and whether other bodies need notification (s 10(3)). Periodic review is mandated (s 10(6)). The system must be proportionate to provider size and services (note to s 8).

Reportable incident definition and exceptions. The instrument adopts the Act’s categories (death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, sexual misconduct including grooming, and use of restrictive practice outside authorisation) and then specifies limited exceptions and clarifications. Notably, negligible unlawful physical contact is excluded (s 16(2)). Authorised restrictive practices may still be reportable if not in accordance with a behaviour support plan (s 16(3)); conversely, where a restrictive practice is not subject to a State/Territory authorisation process but is used in accordance with a behaviour support plan, it is not reportable (s 16(4)). The instrument explicitly includes alleged reportable incidents (s 17).

Notification timeframes and content. The rules distinguish 24 hour notifications (death, serious injury, abuse/neglect, unlawful sexual/physical contact or assault, sexual misconduct including grooming) from other reportable incidents notified within 5 business days (s 20, s 21). Section 20 specifies initial required data fields and permits telephone notification followed by written material where full information is not available (s 20(3)-(6)). The Commissioner must approve notification and report forms (s 20(8), s 21(5), s 24(4)). Section 22 creates a targeted non‑disclosure exception where obtaining or notifying certain information would prejudice a criminal investigation or expose a person with disability to risk of harm.

Duties of persons. Key personnel of registered providers and the person specified for reporting are required to take all reasonable steps to ensure reportable incidents are notified to the Commissioner (s 18). Workers who become aware of reportable incidents must notify a manager, key personnel, or the specified person as soon as possible (s 19). The provider must keep records and may be required to provide final reports and investigative material to the Commissioner (s 24).

Documentation, retention, statistics. Section 12 requires documentation of the incident management system, accessible distribution to participants, staff and families, and assistance to help people understand the system (s 12(1)). Minimum fields for incident and alleged incident records are listed (s 12(2)-(3)). Records must be kept for 7 years from the day the record is made (s 12(4)). Section 12(5) requires collection of statistics to identify systemic issues and to be available for Commissioner requests.

Commissioner powers and inquiries. The Commissioner may refer incidents to other bodies, require remedial action, require internal or independent investigations (independent investigations at provider expense), carry out inquiries, and take other reasonable action (s 26(1)). Inquiries can be authorised in relation to one or a series of reportable incidents, can proceed without prior notification, are not bound by rules of evidence, may consult other agencies, request information, involve people with disability, and the Commissioner may prepare and publish findings (s 27). The Commissioner must have due regard to procedural fairness (s 28) and may take enforcement action under the Act (s 29).

Interplay with other instruments and laws. The instrument is made under the Act (s 3) and repeatedly cross‑references Act provisions (for example subsection 73Z(4) and 73Z(5) in s 16 and the notes to s 6 and s 15). It also cross‑references other Commission rules, including the Protection and Disclosure of Information rules (note to s 26) and the Complaints Management and Resolution Rules (note to s 6). The instrument acknowledges potential overlap with Commonwealth, State and Territory laws for record retention and authorisation processes for restrictive practices (s 12(4), s 16(4), s 25(2)).

The instrument prescribes obligations that fall primarily on registered NDIS providers, their key personnel, their workers and indirectly on persons with disability and their representatives. It also engages the NDIS Quality and Safeguards Commissioner and, in practice, other governmental or investigatory agencies that may receive referrals.

Registered NDIS providers. Every registered NDIS provider must implement and maintain an incident management system that complies with Division 2 (s 8). The system must be documented, made accessible to persons with disability and staff and must record specified information for each incident (s 12). Providers carry ongoing obligations to assess incidents, involve affected persons, support their health and wellbeing, and undertake corrective actions where necessary (s 10). Providers are also directly responsible for making notifications to the Commissioner for reportable incidents, and the provider must identify in its system the person responsible for reporting to the Commissioner (s 10(1)(c), s 20(2)(a)-(h)).

Key personnel and specified reporters. The instrument imposes a positive duty on members of the provider’s key personnel and on the person specified for reporting under the provider’s system to take all reasonable steps to ensure reportable incidents are notified to the Commissioner (s 18). The rules therefore place accountability at senior control points within provider organisations. The system must set out roles and responsibilities for all engaged persons, and each person must comply with the incident management system (s 13(1)-(2)).

Workers. Persons employed or otherwise engaged by the provider have a statutory duty to notify a member of key personnel, a supervisor or the specified reporting person as soon as possible if they become aware that a reportable incident has occurred (s 19). The requirement is immediate and internal; the worker reports to the provider, and the provider assumes the duty to notify the Commissioner where required (s 19, s 18).

Persons with disability, their families and advocates. The rules name persons with disability as parties to be supported and involved. The system must specify how affected persons will be provided support and assistance and how they will be involved in incident management and resolution (s 10(1)(d)-(e)). Providers must make the documented system available in accessible form to persons with disability receiving supports and to their family members, carers and independent advocates, and assist them to understand the system (s 12(1)(b)-(c)). The Commissioner may require the provider to provide investigation progress or outcomes to the person with disability or their representative (s 26(3)(a)).

The Commissioner. The NDIS Quality and Safeguards Commissioner receives notifications, acknowledges written notifications within 24 hours (s 20(7), s 21(4)), approves notification and report forms (s 20(8), s 21(5), s 24(4)), may require investigations, remedial action or independent experts at the provider’s expense (s 26), and may authorise and publish inquiries (s 27). The Commissioner is also bound to have due regard to procedural fairness when taking action (s 28) and may share information consistent with other disclosure rules (s 26 note).

Other agencies. The Commissioner may refer incidents to other responsible persons or bodies such as State or Territory child protection agencies (s 26(1)(a)). Section 22 creates a non‑notification exception where disclosure would prejudice a criminal investigation, implying interaction with police and prosecuting authorities.

Who pays. The instrument expressly places the cost of an independent expert engaged at the Commissioner’s direction on the provider (s 26(1)(d)). Providers therefore face both operational costs of implementing and maintaining systems, training staff, record keeping and the potential for bearing expense for external investigations and remedial action ordered by the Commissioner. There is no penalty schedule in this instrument, but failure to comply is noted as a breach of registration conditions and therefore exposes providers to enforcement under the Act (s 6 note 1, s 15 note 3, s 29).

Where decision-making occurs. Providers must document who within their organisation is responsible for reporting to the Commissioner (s 10(1)(c)). Key personnel and the specified reporting person must take all reasonable steps to ensure notifications are made (s 18). Workers are required to notify internal supervisors or the specified person (s 19). The Commissioner exercises decision‑making power in requiring investigations, remedial action, referrals and inquiries (s 26-27), and has discretion about the content and timing of requests (for example s 24(1) allows the Commissioner to set or extend the period for a final report).

This instrument creates a set of affirmative duties for providers, designated persons inside provider organisations, and workers, and a set of procedural and informational rights for persons with disability and the Commissioner. Below are the principal duties and the rights they interact with.

Provider duties

• Implement and maintain an incident management system that complies with Division 2 (s 8). The system must be appropriate for the size of the provider and the classes of supports or services provided (note to s 8 referencing paragraph 73Y(a) of the Act).

• Ensure the incident management system covers the incidents defined in s 9: incidents that could have caused harm to a person with disability (s 9(1)), acts by a person with disability that cause or risk serious harm to another person (s 9(2)), and alleged reportable incidents (s 9(3)).

• Establish procedures specifying identification, recording and reporting processes; the person responsible for reporting to the Commissioner; support and involvement of persons with disability; thresholds for investigations; corrective action; and periodic review (s 10(1)(a)-(g); s 10(6)).

• Afford procedural fairness in incident handling (s 11). The Commissioner may issue guidelines about procedural fairness (s 11(2)).

• Document the incident management system, provide accessible copies to persons with disability, workers and family/carers/advocates, and assist their understanding (s 12(1)(a)-(c)).

• Record prescribed minimum data in relation to each incident and alleged incident, and retain records for 7 years from the day the record is made (s 12(2)-(4)).

• Collect statistics and other information to identify systemic issues and to report to the Commissioner if requested (s 12(5)).

• Set out roles and responsibilities, require compliance with the system by all engaged persons, and provide training in use and compliance (s 13(1)-(3)).

• Notify the Commissioner of reportable incidents within the statutory timeframes and according to content rules: 24 hours for the serious categories and 5 business days for others (s 20, s 21). Provide updates and final reports if required (s 23, s 24). Keep records of reportable incidents for 7 years from notification (s 25).

Duties of designated persons and workers

• Key personnel and the person specified for reporting must take all reasonable steps to ensure reportable incidents are notified to the Commissioner (s 18).

• Workers who become aware of a reportable incident must notify a member of key personnel, a supervisor or manager, or the specified reporting person as soon as possible (s 19).

Commissioner’s powers and duties

• The Commissioner may require remedial action, internal or independent investigations (independent experts at the provider’s expense), refer matters to other agencies, carry out inquiries and take other reasonable action on receiving notifications (s 26(1)(a)-(f)).

• The Commissioner may require providers to provide updates and final reports about investigations within specified timeframes (s 24).

• The Commissioner may authorise inquiries into one or a series of reportable incidents, consult widely, request information and publish reports of findings (s 27).

• The Commissioner must have due regard to procedural fairness when taking action (s 28).

Rights and protections for persons with disability

• The incident management system must set out how affected persons will be supported and involved in incident management and resolution, including information about access to independent advocates (s 10(1)(d)-(e)).

• Providers must assist persons with disability and their representatives to understand the documented incident management system (s 12(1)(c)).

• If an investigation is carried out under Commissioner direction, the Commissioner may require information to be provided to the person with disability or their representative, and with consent may allow information to be shared with other people (s 26(3)(a)-(b)).

Process protections

• The system must afford procedural fairness when incidents are dealt with by the provider (s 11), and the Commissioner must have due regard to procedural fairness when taking action (s 28). The Commissioner may publish guidelines for procedural fairness (s 11(2), note to s 28).

Discretionary exemptions and exceptions

• Providers need not obtain or notify certain details where doing so would prejudice a criminal investigation or expose a person with disability to risk of harm (s 22). This creates a narrow statutory pathway for withholding specified incident details from the Commissioner pending criminal process or where disclosure would cause harm.

Breach consequences

• The instrument states that failure to comply with Parts 2 or 3 constitutes a breach of a condition of registration and may lead to compliance and enforcement action under the Act (s 6 note 1; s 15 note; s 29); the instrument itself does not list specific monetary fines or criminal penalties but triggers the Act’s enforcement framework.

This instrument does not itself specify monetary fines, administrative penalties or criminal sanctions. Instead, it binds compliance to the registration regime and provides enforcement levers in two ways: it records that failure to comply is a breach of registration conditions and it gives the Commissioner targeted regulatory powers to direct remedial action, investigations and inquiries.

Breach of registration conditions. The instrument makes explicit that failure by a registered NDIS provider to comply with the requirements of Part 2 (incident management systems) or Part 3 (reportable incidents) constitutes a breach of conditions of registration. Section 6(1) states the Part 2 rules are made for the purposes of paragraph 73Y(b) of the Act and the Note states non‑compliance constitutes a breach of the condition of registration (see paragraph 73F(2)(g) of the Act). Section 15 carries a comparable note that non‑compliance with Part 3 constitutes a breach of the condition of registration (see paragraph 73F(2)(h) of the Act). The Act’s Division 8 of Part 3A is identified as the statutory pathway for compliance and enforcement action (s 6 note 1, s 15 note, s 29). Practically this means the Commissioner can use the Act’s enforcement mechanisms against providers for breaches arising from non‑compliance with these rules.

Commissioner’s direct powers. Section 26 enumerates a suite of actions the Commissioner may take on receiving a notification. These include referral to other persons or bodies with responsibility (s 26(1)(a)), requiring or requesting specified remedial action within a specified period (s 26(1)(b)), requiring internal investigations and reports within specified parameters (s 26(1)(c)), requiring the provider to engage an independent expert at the provider’s expense to investigate and report (s 26(1)(d)), carrying out an inquiry (s 26(1)(e)), and taking any other action the Commissioner considers reasonable in the circumstances (s 26(1)(f)). If the Commissioner requires an investigation under s 26(1)(c) or (d), subsection 26(2) provides the Commissioner with discretion to take any action considered appropriate on the basis of the investigation.

Costs and financial consequences. The instrument places the cost of any independent expert investigations required under s 26(1)(d) on providers. Remedial actions required under s 26(1)(b) are not cost‑shifted in the instrument, but are obligations that the provider must implement within the timeframe specified by the Commissioner. The practical effect is that providers may incur additional compliance costs beyond ordinary incident management for Commissioner‑ordered investigative or remedial steps.

Referral and information sharing. The Commissioner can refer incidents to other agencies such as State child protection bodies (s 26(1)(a)). The instrument’s note points to powers to share information in accordance with section 67E of the Act and specific Protection and Disclosure rules (note to s 26). This enables administrative coordination with other regulators or enforcement agencies.

Procedural protections. The Commissioner must have due regard to procedural fairness when taking action (s 28). The instrument also provides for the Commissioner to make procedural fairness guidelines (s 11(2) as to provider systems, and the note to s 28 referencing subsection 181D(2) of the Act). These process protections shape how enforcement will be exercised, though the instrument leaves detail to Commissioner guidelines.

Absence of built‑in fines in the instrument. The instrument contains no express penalty amounts or criminal sanctions; instead the enforcement path runs through the Act’s registration regime and the Commissioner’s powers. Providers therefore face regulatory consequences and the possibility of registration conditions being varied, suspended or revoked under the Act, rather than immediate monetary penalties prescribed in this instrument.

Inquiry and publication powers. The Commissioner may authorise and undertake inquiries (s 27), which may proceed without prior notification of a reportable incident (s 27(4)), are not bound by rules of evidence (s 27(5)), and may result in published reports (s 27(7)). Publication can carry reputational consequences for providers and may affect market prospects or contractual relationships, even though the instrument does not translate that reputation effect into a specific penalty.

Record of enforcement triggers. The instrument’s Notes make clear that non‑compliance with both incident system and reportable incident duties are linked to the Act’s enforcement framework. Providers should therefore treat breaches as potentially escalating to regulatory action under Division 8 of Part 3A of the Act.

The instrument situates the incident management and reportable incident regime within the broader NDIS legal architecture and its intersection with State and Territory laws in particular areas. The instrument repeatedly cross‑references the National Disability Insurance Scheme Act 2013 and other NDIS rules, and it creates specific interfaces with criminal processes, behaviour support authorisation regimes, privacy and record retention regimes, and the Commissioner's information‑sharing rules.

Primary statutory authority. The instrument is made under the National Disability Insurance Scheme Act 2013 (s 3). It is expressly made for the purposes of several specific Act provisions: paragraph 73Y(b) of the Act for Part 2 (s 6(1)), section 73Z of the Act for Part 3 and inquiries (s 15(1), s 27(1)), and subsection 73Z(5) for the specification of acts that are or are not reportable incidents (s 16(1)). The instrument therefore operates as a delegated rule within the framework of the Act and is intended to implement statutory obligations and definitions found in the Act (for example subsection 73Z(4) definition of reportable incident is quoted and modified where this instrument exercises its delegated power to specify exceptions, s 16).

Interaction with criminal processes. Section 22 permits a provider not to obtain or notify certain specified information where doing so would, or could reasonably be expected to, prejudice the conduct of a criminal investigation or expose a person with disability to a risk of harm. The scope of the non‑notification is limited to particular data items listed in s 20(2)(b), (c), (f) or (g), 20(4)(a) or 21(3)(b)-(e). This creates a statutory interface between the Commissioner’s reporting regime and police or prosecutorial processes. It requires providers to assess the risk that notification could prejudice criminal enquiries, and potentially to defer disclosure of particular details until it is appropriate to do so.

Restrictive practices and State/Territory authorisations. The instrument modifies the Act’s handling of restrictive practices. While subsection 73Z(4)(f) of the Act treats use of a restrictive practice as a reportable incident unless the use is in accordance with a State or Territory authorisation, this instrument adds a layer: if the use of a restrictive practice is in accordance with a State or Territory authorisation but not in accordance with a behaviour support plan for the person, it is nevertheless a reportable incident (s 16(3)). Conversely, if the restrictive practice is used in accordance with a behaviour support plan and the State or Territory does not have an authorisation process, the practice is not a reportable incident (s 16(4)). Those clauses require providers to map their behaviour supports and State regulatory frameworks to determine reportability.

Record retention and other jurisdictional obligations. Section 12(4) and s 25(2) include notes that a registered NDIS provider may be required to comply with other Commonwealth, State or Territory laws in relation to retention of records. The instrument sets a minimum 7 year retention period for incident records and for reportable incident records, but explicitly acknowledges that other laws may impose different or additional record retention requirements.

Interaction with other NDIS rules. The instrument references the National Disability Insurance Scheme (Complaints Management and Resolution) Rules 2018 in the note to s 6, indicating that incident reporting may overlap with complaint obligations and that providers must be aware of both regimes. The note to s 26 references section 67E of the Act and the National Disability Insurance Scheme (Protection and Disclosure of Information,Commissioner) Rules 2018 for authorised information sharing by the Commissioner.

Procedural fairness and guidelines. The instrument allows the Commissioner to issue guidelines on procedural fairness for provider systems (s 11(2)) and references subsection 181D(2) of the Act for the Commissioner making guidelines dealing with reportable incidents in relation to procedural fairness (note to s 28). This creates an administrative interface whereby the Commissioner’s guidelines will affect how both providers and the Commissioner must act when incidents are handled.

No conflict‑resolution mechanism in the instrument. The instrument does not set out a particular conflict resolution hierarchy between its notification requirements and other statutory obligations such as mandatory reporting to State child protection agencies; however the Commissioner’s referral power (s 26(1)(a)) contemplates coordination with other responsible agencies. Providers must consider how to discharge overlapping duties to different bodies, and must document roles and reporting lines in their incident management system (s 10(1)(b)-(c)).

Summary. The instrument operates as part of the NDIS regulatory scaffolding and explicitly interacts with the Act’s definitions and enforcement provisions, the Commissioner’s information rules, State and Territory authorisation processes for restrictive practices, criminal procedures via the s 22 non‑disclosure carve‑out, and other Commonwealth/State record retention laws. Providers must map these interfaces in their internal policies to ensure that notifications and disclosures do not inadvertently prejudice criminal investigations or breach other statutory obligations.

The instrument itself contains a commencement table and an explanatory note about the table but does not record any later amendments in the text provided. Section 2 sets out commencement: the whole instrument commenced on 1 July 2018 (s 2 and the Commencement table). The table includes a note that it relates only to provisions as originally made and will not be amended to deal with later amendments of the instrument. There are no amendment clauses within the text that amend or repeal parts of the instrument, and no schedule of subsequent amendments is included in the provided material.

Because this instrument is made under the National Disability Insurance Scheme Act 2013 (s 3), any amendments would normally be published as amending instruments or replacements under the Act and reflected in consolidated versions of the rules. The published text here contains only the original instrument as made and commences from the 1 July 2018 date. Users seeking a current authoritative version should consult official legislative databases or the Commissioner’s website to determine whether subsequent amending instruments have altered any provisions cited in this analysis.

The instrument’s own internal notes indicate that certain matters are governed by other instruments or by the Act. For example, procedural fairness guidance may be made by the Commissioner under subsection 181D(2) of the Act (note to s 28), and the instrument references other related instruments such as the National Disability Insurance Scheme (Complaints Management and Resolution) Rules 2018 and the National Disability Insurance Scheme (Protection and Disclosure of Information,Commissioner) Rules 2018 (notes to s 6 and s 26). Those interlinked instruments may themselves be amended independently.

In short, the instrument as provided shows a single‑date commencement and contains no recorded amendments in the text supplied. Confirming amendment history for operational or compliance reasons requires checking the consolidated legislative register or the Commissioner’s current instruments.

The text of the instrument supplied contains no case names, citations to judicial decisions, or references to litigation. It does not contain a litigation history or identify any judicial interpretation of its provisions. The instrument is a delegated legislative rule made under the National Disability Insurance Scheme Act 2013 and itself does not record or summarise litigation outcomes.

Because the instrument interacts with the Act and with administrative enforcement, disputes about its application could subsequently give rise to litigation or administrative review under the Act’s enforcement provisions, or to civil proceedings where applicable. The instrument does not identify such cases. For practical compliance and risk assessment, providers should treat the instrument’s obligations as regulatory prerequisites and monitor administrative enforcement activity and published Commissioner guidance or decisions that might interpret or apply these rules.

To ascertain whether there has been litigation concerning these rules, including judicial review of Commissioner action under the instrument or determinations about whether particular events are reportable incidents, consult published Tribunal or court decisions and the Commissioner’s enforcement statements. The instrument itself does not supply such material.

Several operational and legal pitfalls arise from the instrument’s structure and wording. These are concrete points likely to cause compliance gaps if not anticipated and addressed.

Alleged incidents are reportable. The instrument explicitly treats alleged reportable incidents as reportable (s 17). Providers must therefore have systems to capture and evaluate allegations, even if later unsubstantiated, and must treat those allegations as events triggering internal recording and possibly notification obligations. Failure to recognise allegations as reportable may be treated as non‑compliance.

Different timeframes for different categories and the telephone/written split. The 24 hour notification window in s 20 applies to a specified set of serious categories, including death and serious injury. Section 20 allows initial phone notifications (s 20(5)) but requires written follow up for incomplete information and the Commissioner’s approved forms for written notifications (s 20(6), (8)). Mis‑routing or delay in internal escalation can cause the provider to miss the 24 hour window. Providers must ensure internal reporting pathways from workers to the specified reporting person operate in real time.

Who must ensure notification. Key personnel and the person specified for reporting must take all reasonable steps to ensure notifications are made (s 18). This is a positive duty at senior levels that creates accountability beyond the worker who first discovers an incident. If the provider’s internal delegation is unclear, senior staff may be judged non‑compliant.

Specified data fields and non‑disclosure carve‑out. The instrument prescribes specific fields to be provided in notifications (s 20(2), s 21(3)). Section 22 allows providers not to obtain or notify certain fields where such obtaining or notifying would prejudice criminal investigations or expose a person to harm. That carve‑out is narrow and limited to the specified fields listed. Providers need legal input when withholding information on this ground. Blanket non‑disclosure without a considered assessment that disclosure would prejudice a criminal investigation is not authorised.

Record retention date differences. General incident records must be kept for 7 years from the day the record is made (s 12(4)). For reportable incidents, records must be kept for 7 years from the day that notification of the reportable incident is given (s 25(2)). Providers should avoid confusion: if a reportable incident record is contemporaneously made with notification, retention will likely run from the notification date under s 25(2); if records are made earlier, s 12(4) applies. Providers must reconcile both provisions in practice.

Restrictive practices complexity. The instrument changes the default for restrictive practices depending on State/Territory authorisation regimes and behaviour support plans (s 16(3)-(4)). A use authorised by a State authority but not in accordance with a behaviour support plan is reportable. Conversely, a use in accordance with a behaviour support plan in a jurisdiction that has no authorisation process is not reportable. Providers operating across jurisdictions must map local authorisation regimes and ensure behaviour support plans align with authorisations.

Commissioner discretion and cost exposure. The Commissioner can require independent experts at the provider’s expense (s 26(1)(d)). That is a direct financial exposure that can be triggered by notification. Providers should budget for the possibility of external investigations and remedial actions.

Inquiries without notification. The Commissioner may carry out inquiries whether or not notifications under s 20 or s 21 have been received (s 27(4)). Providers cannot assume absence of notification to the Commissioner immunises them from scrutiny.

Procedural fairness obligations on both sides. Providers’ systems must afford procedural fairness (s 11). The Commissioner must have due regard to procedural fairness when taking action (s 28). Providers should document how procedural fairness is embedded in incident handling to avoid procedural challenges to Commissioner action or to their own internal processes.

Forms and approvals. The Commissioner must approve forms for written notifications and final reports (s 20(8), s 21(5), s 24(4)). Providers must use the Commissioner’s approved forms for written notifications to satisfy the timing and content rules. Failure to use the correct form or to receive acknowledgement within 24 hours for written notifications could complicate proof of compliance.

Overlaps with complaints management. The instrument’s note references the Complaints Management and Resolution Rules (note to s 6). Providers must coordinate incident management with complaint handling processes to avoid contradictory responses or unnecessary duplication.

Statistical collection and systemic identification. Providers are required to collect statistical information to identify systemic issues (s 12(5)). This is an ongoing obligation that requires data capture and analysis capability and should be implemented proactively rather than treated as retrospective reporting.

To translate the instrument’s obligations into an auditable compliance programme, providers should adopt a structured implementation plan covering governance, policy, operations, training, records, liaison with the Commissioner and coordination with other bodies and laws. Below is a practical checklist and set of actions mapped to the instrument’s provisions.

Governance and documentation

• Register a responsible officer or position as the person specified for the purposes of paragraph 10(1)(c) in your incident management system (s 10(1)(c)). That role must be authorised and contactable 24/7 where feasible for serious incidents.

• Ensure key personnel understand and accept the duty to take all reasonable steps to ensure reportable incidents are notified to the Commissioner (s 18). Document delegation, escalation lines and decision points.

• Document the incident management system in accessible form and maintain it as a controlled document. Provide accessible copies to persons with disability receiving supports, staff and family/carers/advocates, and assist those people to understand the system (s 12(1)(a)-(c)).

Policy content and scope

• Ensure the system covers the incidents listed in s 9: incidents that could have caused harm to persons with disability (s 9(1)), acts by persons with disability that cause or risk serious harm to others (s 9(2)), and alleged reportable incidents (s 9(3)).

• Include procedural content required by s 10(1)(a)-(g): identification, recording and reporting processes; internal recipients; the person responsible for Commissioner reporting; how affected persons will be supported and involved; investigation thresholds and methods; corrective action triggers; and periodic review processes.

• Build in the assessment requirements of s 10(3) for each incident: preventability, quality of management, remedial action needed, and whether other persons or bodies need to be notified.

Operational processes and timelines

• Create two notification workflows: one for 24 hour notifications under s 20 and one for 5 business day notifications under s 21. Map trigger events to these categories and create a decision tree to determine which pathway applies, ensuring alleged incidents are assessed quickly (s 17).

• For 24 hour events, set procedures to permit immediate telephone notification followed by written completion within 5 business days if full information is not available (s 20(3)-(6)). Ensure your specified reporter has authority to provide initial phone notifications and to assemble written material promptly.

• Ensure written notifications and final reports use Commissioner‑approved forms (s 20(8), s 21(5), s 24(4)). Monitor the Commissioner’s website for updated forms and sample templates.

Information handling and legal checks

• For each incident assess whether any of the specified fields listed in s 20(2)(b), (c), (f) or (g) and s 21(3)(b)-(e) would, if obtained or notified, prejudice a criminal investigation or expose a person with disability to a risk of harm. If so, rely on s 22 to withhold those fields and document the legal basis and timing for the decision.

• Map behaviour support plans and State/Territory restrictive practice authorisation frameworks to determine reportability under s 16(3)-(4). Ensure that behaviour support plans explicitly authorise any restrictive practice uses that are authorised locally to avoid unintended reportability.

Records, data and retention

• Build record templates that capture the minimum required fields for incidents (s 12(2)) and for alleged reportable incidents (s 12(3)). Ensure the record template captures the assessment under s 10(3) and the name/contact details of the person who made the record (s 12(2)(l), s 12(3)(j)).

• Implement retention schedules to keep incident records for at least 7 years from the day the record is made (s 12(4)) and to keep reportable incident records for 7 years from the day notification is given (s 25(2)). Reconcile these with other applicable Commonwealth, State or Territory record retention obligations (note to s 12(4) and s 25(2)).

• Record and report statistical information to enable identification of systemic issues and to be able to respond to Commissioner requests (s 12(5)).

Training and roles

• Train all workers and contractors about their duty to notify the provider if they become aware of a reportable incident (s 19), how to use internal reporting channels, and the difference between incident categories.

• Train key personnel and the specified reporting person in the Commissioner notification requirements, use of approved forms, obligations under s 22, and timelines for written follow up, final reports and inquiries.

• Ensure staff are trained in procedural fairness basics so the incident management system can afford procedural fairness (s 11). Document procedural fairness steps in investigation templates.

Investigation and remedial readiness

• Create protocols for internal investigations, including who conducts them, how independence is secured, and how outcomes and corrective actions are documented (s 10(1)(f), s 12(2)(k)).

• Budget for the possibility that the Commissioner may require the engagement of an independent expert at the provider’s expense (s 26(1)(d)). Maintain a pre‑qualified list of independent experts who meet likely Commissioner expectations.

Liaison with the Commissioner and other agencies

• Maintain contact procedures for the Commissioner’s office, ensure written notifications are acknowledged within 24 hours and log acknowledgements (s 20(7), s 21(4)). Use the Commissioner‑approved forms for written notifications.

• If an incident may involve other bodies such as police or child protection agencies, establish protocols for referral and information sharing, and document the legal basis for any decision to withhold specified information under s 22.

Periodic review and continuous improvement

• Conduct scheduled reviews of the incident management system as required by s 10(6). Use statistical collections mandated by s 12(5) to identify systemic issues and to adjust policies, training and supervision accordingly.

• Keep records of periodic review outcomes and improvement actions to demonstrate compliance and to provide evidence in any Commissioner review or inquiry.

Checklist summary (operational)

• Designate the person responsible for Commissioner notifications and record this in the incident management system (s 10(1)(c)).

• Publish the documented incident management system in accessible formats and distribute to participants, staff and carers; provide assistance to understand it (s 12(1)).

• Implement real‑time internal reporting lines from workers to supervisors and to the specified person (s 19).

• Configure decision trees to separate 24 hour urgent notifications from 5 business day notifications (s 20, s 21).

• Adopt Commissioner‑approved notification forms and maintain procedures for telephone notification followed by written material where necessary (s 20(5)-(8)).

• Document non‑disclosure decisions under s 22 with legal input and keep logs of withheld fields and the grounds for doing so.

• Establish investigation templates embedding assessment criteria from s 10(3), procedural fairness steps and remedial action tracking.

• Ensure records and reportable incident files are kept for 7 years per s 12(4) and s 25(2), and reconcile with local retention laws.

• Maintain a budget line and prequalified experts list to meet potential s 26(1)(d) orders.

• Review the system periodically and adjust training, roles and data collections in response to systemic findings per s 12(5) and s 10(6).

Following these steps will align operational practice with the instrument’s requirements, create evidentiary trails for compliance, and prepare providers to respond to Commissioner enquiries, requirements for investigations and potential enforcement action under the Act.