Free template

Free NDIS Incident Management Policy template

A ready-to-tailor Incident Management Policy and Procedure for small NDIS providers and sole traders. It covers how you respond when something goes wrong, how incidents are recorded, assessed and followed up, and which incidents must be reported to the NDIS Quality and Safeguards Commission - including the 24-hour and 5-business-day timeframes. Pre-fill your details, download the Word file or copy the text, then tailor the highlighted prompts to how your business actually runs. Free, with no sign-up.

Who it’s for

Sole traders and small NDIS providers - support workers, community access, personal care, domestic assistance and similar supports. If you are registering, incident management is assessed on both audit pathways: it is one of the four principal areas in the Verification Module, and it sits inside the Core Module for certification audits. If you are unregistered, the NDIS Code of Conduct still applies to you, and some plan managers, support coordinators and other organisations may ask to see an incident management policy before engaging a provider.

How to use it

Pre-fill your details below and they drop into the [highlighted] prompts automatically.
Replace the remaining prompts so the policy describes what you actually do - not what a template guesses you do.
Train your workers in it, and keep evidence of the training.
Walk through one imagined incident from start to finish before you ever need it for real.

What an incident management system must include

Every registered NDIS provider must have an incident management system under the NDIS (Incident Management and Reportable Incidents) Rules 2018. A policy document on its own is not a system - the Rules expect a set of working procedures that cover, at minimum:

What counts as an incident. The Rules cover acts, omissions, events or circumstances connected with providing supports that harmed, or could have harmed, a participant - including near misses - plus acts by a participant, in connection with their supports, that caused serious harm or a risk of serious harm to another person. Many providers also choose to record lower-level participant-related events as good practice, beyond what the Rules require.
Identifying, recording and reporting. Workers need to know what to record, how, and who to tell - and participants need to know how to raise an incident too.
Assessing each incident. Whether it could have been prevented, how well it was managed and resolved, what remedial action is needed, whether it is a reportable incident, whether anyone else must be notified - and the views of the person with disability affected.
Supporting the people affected. What support and assistance the people involved receive, and how they are kept informed and involved in the response.
Investigation, procedural fairness and corrective action. When you look deeper into the causes, how anyone whose conduct is investigated gets a fair opportunity to respond, and what you change so it is less likely to happen again.
An accessible system. Information about how the system works must be available in an accessible form to participants, workers and relevant supporters, with help to understand it.
Records, statistics and review. Incident records must be kept for 7 years, and the system itself should be reviewed periodically using what your incidents are telling you.

Your workers also need to be trained in the system, and you need to be able to show that - a written policy nobody has read will not stand up when an auditor asks a worker what they would do.

Reportable incidents and the timeframes

Some incidents must be notified to the NDIS Commission. For registered providers there are six categories of reportable incident when they occur, or are alleged to have occurred, in connection with providing NDIS supports or services - you do not wait for an allegation to be substantiated before assessing and reporting it:

The death of a person with disability
Serious injury of a person with disability
Abuse or neglect of a person with disability
Unlawful sexual or physical contact with, or assault of, a person with disability
Sexual misconduct committed against, or in the presence of, a person with disability, including grooming for sexual activity
Use of a restrictive practice that is unauthorised under the relevant state or territory requirements, or is not used in accordance with the person’s behaviour support plan

The Rules contain a narrow exception for unlawful physical contact where both the contact and its impact on the person with disability are negligible - it does not apply to sexual contact or assault. Seek advice or contact the Commission if you are unsure whether an incident is reportable.

The timeframes run from when the registered provider becomes aware of the incident - so workers must escalate possible reportable incidents immediately, including over a weekend or public holiday:

Incident type	What to submit, and when
Categories 1 to 5 above	Immediate Notification Form within 24 hours, then the 5 Day Form - additional information and the actions taken or proposed - within 5 business days of becoming aware
Unauthorised restrictive practice that has not resulted in harm	5 Day Form within 5 business days - this is the only initial notification form required
Unauthorised restrictive practice that has resulted in harm to a person with disability	Immediate Notification Form within 24 hours, then the 5 Day Form within 5 business days

The Commission may also require a final report - investigation findings, corrective actions and related information - within 60 business days after the 5 Day Form is submitted, or within a longer period the Commission specifies. Notifications are made through the NDIS Commission Portal under “My Reportable Incidents”; follow the Commission’s current login arrangements (provider portal access is transitioning from PRODA to myID and RAM). Reporting is free and is something you do directly with the Commission - no template or document pack does this step for you.

If anyone is in immediate danger, call 000 first. Reporting to the Commission never replaces getting urgent medical help or contacting police where a crime may have occurred.

The template

Pre-fill your details (optional)

Add your details and they fill straight into the template below and the Word download. Nothing is saved or sent anywhere - it stays in your browser.

Business name (or your name, if you're a sole trader)ABNYour name (the person responsible for incidents)

Download Word (.docx)

The template

Download

[your business or your full name] - Incident Management Policy and Procedure

ABN [your ABN] · Version 1.0 · Effective [date]

Purpose

This policy explains how [your business or your full name] identifies, manages, records and reports incidents that happen in connection with the supports we provide. Managing incidents well keeps participants safe, helps us learn and improve, and meets our obligations under the NDIS (Incident Management and Reportable Incidents) Rules 2018.

Our incident management system

[your business or your full name] has a written incident management system. As a minimum, it lets us:

Identify incidents, including near misses.
Record each incident promptly and accurately.
Assess each incident, including whether it is a reportable incident.
Manage and resolve the incident, with actions to reduce the risk of it happening again.
Support and involve the people affected, including the participant, their family, carers and workers.
Notify the NDIS Commission and any other body (police, work health and safety regulator, OAIC) where required.
Review what happened and identify improvements.
Continuously improve our supports and this system, and train workers in how it works.

What is an incident?

In line with the NDIS Commission's definition, an incident is any act, omission, event or circumstance that occurs in connection with providing supports or services to a participant, and that has, or could have, caused harm to the participant. An incident also includes acts by a participant that happen in connection with the provision of supports and that caused serious harm, or a risk of serious harm, to another person. Incidents include:

Harm, or risk of harm, to a participant.
Acts by a participant - in connection with the provision of supports - that caused serious harm, or risk of serious harm, to another person.
Injury to a participant or worker.
Errors (for example a medication error) or near misses.
Property damage, or a participant going missing.

Reportable incidents

Some incidents are "reportable incidents" that must be notified to the NDIS Quality and Safeguards Commission. Reportable incidents are those that happen, or are alleged to have happened, in connection with the provision of supports or services delivered by [your business or your full name]. In the categories below, "a participant or other person with disability" means the incident is reportable whether it affects a participant we support or another person with disability, where the incident occurs in connection with supports or services delivered by [your business or your full name]. The reportable categories are:

the death of a participant or other person with disability, where the incident occurs in connection with supports or services delivered by [your business or your full name];
serious injury of a participant or other person with disability, where the incident occurs in connection with supports or services delivered by [your business or your full name];
abuse or neglect of a participant or other person with disability, where the incident occurs in connection with supports or services delivered by [your business or your full name];
unlawful sexual or physical contact with, or assault of, a participant or other person with disability, where the incident occurs in connection with supports or services delivered by [your business or your full name];
sexual misconduct committed against, or in the presence of, a participant or other person with disability, including grooming, where the incident occurs in connection with supports or services delivered by [your business or your full name];
the use of a restrictive practice in relation to a participant that is unauthorised or not in line with a behaviour support plan.

Reporting timeframes

Once [your business or your full name] becomes a registered NDIS provider, reportable incidents must be notified to the NDIS Commission within these timeframes:

Items 1–5 above (death, serious injury, abuse/neglect, unlawful sexual or physical contact/assault, sexual misconduct): notify the Commission within 24 hours of becoming aware (the Immediate Notification Form), then provide the 5 Day Form - additional information about the incident and the actions taken or proposed - within 5 business days of becoming aware.
Use of an unauthorised restrictive practice that has NOT resulted in harm to a person with disability: notify the Commission within 5 business days of becoming aware. For these, the 5 Day Form is the only initial notification required.
Use of an unauthorised restrictive practice that HAS resulted in harm to a person with disability: notify the Commission within 24 hours of becoming aware (the same 24-hour rule as items 1–5), then provide the 5 Day Form within 5 business days.
The Commission may also require a final report - investigation findings, corrective actions and related information - within 60 business days after the 5 Day Form, or within a longer period the Commission specifies.

Reportable-incident notifications are made through the NDIS Commission Portal. The Commission's timeframes run from when the provider becomes aware of the incident - so we treat the clock as starting the moment any worker becomes aware, including over a weekend or public holiday.

Fill in: Name the person responsible for deciding whether an incident is reportable and for notifying the NDIS Commission, and name their backup for when that person is away. State exactly how a worker reaches them after hours, on weekends and on public holidays (for example: a mobile number workers can call any time) so a 24-hour report is never missed.

What to do when an incident happens - step by step

Make the situation safe. Provide first aid, call 000 if anyone is in danger, and remove or reduce immediate risks.
Support the participant. Reassure them, respect their wishes and keep them informed.
Record it. Complete the [your business or your full name] Incident Report Form as soon as possible (the same day where you can).
Notify [your business or your full name]. Tell [your name] straight away - immediately for anything serious or potentially reportable.
Assess whether it is a reportable incident. [your name] decides whether the Commission must be notified, and within which timeframe.
Consider other notifications. Decide whether the incident must also be reported to another body - for example the police where there has been unlawful physical or sexual contact, assault, or theft, or a work health and safety regulator for a notifiable workplace incident.
Report to the Commission if required, within the timeframes above.
Review and learn. Consider whether the incident could have been prevented, how well it was managed and resolved, and what remedial action is needed to prevent it happening again or reduce its impact - seeking and taking into account the views of the participant (or other person with disability) affected, and involving them and the people they choose in the review. Record the outcome in our Incident Register and update our Risk Register and procedures.

Where an incident or allegation involves the conduct of a worker or another person, [your business or your full name] affords them procedural fairness: they are told the substance of the allegation, given a reasonable opportunity to respond before findings are made, and their response is considered impartially. Any conflict of interest in who assesses or investigates the matter is identified and managed. These steps may be adjusted where necessary to avoid prejudicing a police or NDIS Commission investigation, or to protect a person with disability from harm.

Incident triage checklist

For every incident, [your name] works through these questions before closing it off, because one incident can trigger more than one obligation:

Is it a reportable incident that must be notified to the NDIS Commission (and within 24 hours or 5 business days)?
Should the police be called - for example unlawful physical or sexual contact, assault, or theft?
Is it a notifiable incident under work health and safety law (a death, serious injury or illness, or dangerous incident) that must be reported to the work health and safety regulator?
Is it a privacy or data breach that may need assessment and notification to the OAIC under the Notifiable Data Breaches scheme?
Did it involve an unauthorised or unlawful use of a restrictive practice?
Does open disclosure apply - do we need to be open with the participant and the people they choose about what happened, say sorry, and explain what we will do?

Answering "yes" to more than one of these is common. Each obligation is followed in addition to the others - notifying the Commission does not remove the duty to call police or report a workplace incident.

Recording incidents

Every incident is recorded on the Incident Report Form and logged in our Incident Register. Records are kept securely and confidentially in line with our Privacy and Records policies, and retained for at least the period required by the NDIS Rules.

Fill in: Write here what software or system you use to record incidents (for example: the Bluetail CRM, a secure spreadsheet, or a paper form filed in a locked cabinet).

Fill in: Write here where your Incident Register is kept, who enters incidents into it, who reviews every incident and by when (for example: [your name] reviews each one within 5 business days), and how the corrective actions from a review are added to your Continuous Improvement Plan (QIP).

Supporting and involving people

[your business or your full name] supports participants, families and workers affected by an incident. No one will be disadvantaged for reporting an incident in good faith. A participant affected by an incident is kept informed and is involved in how it is managed and reviewed, in the way that suits them.

Our incident management system is written down and available on request. Any participant, their family or representative, a worker, or another person can ask to see how we manage incidents, and we will provide this information in a way they can understand. Participants are told that this system exists and how to access it.

Continuous improvement

Incidents and near misses are reviewed regularly to spot patterns and prevent recurrence. Lessons learned feed into staff training, our Risk Register and our Continuous Improvement Policy.

Responsibilities

Workers: keep participants safe, record incidents promptly and report them.
[your business or your full name] management ([your name]): assess reportability, notify the Commission, lead reviews and drive improvements.

This template is general information to help you get started, not legal advice. Tailor every prompt to how your business actually operates, train your workers in it, and obtain advice if you are unsure how the Incident Management Rules apply to your services.

The incident report form

The policy tells everyone what happens; the report form is where each incident is actually captured. To meet the record requirements in the Rules, your form should capture, at minimum:

A factual description of the incident, in the order it happened, without opinions or blame - and whether it occurred or is an allegation (allegations are recorded and assessed the same way)
The impact on, or harm caused to, each person affected
Date, time and place of the incident - or, if that is not known, the date and time it was first identified
Names and contact details of the people involved and any witnesses
Any injuries, and any first aid or medical attention given
Immediate actions taken to make people safe
Who has been notified - family or guardian, police, the NDIS Commission, your insurer
The assessment: severity, whether it was preventable, how well it was managed, and whether it is a reportable incident
The affected participant’s views, details of consultations with them, and whether they were given any findings or reports
Details and outcomes of any investigation, where one occurred
Follow-up actions, who owns them, and the due date
The name and contact details of the person making the record, and sign-off with the date the incident was closed

The incident register

The register is the single log that lets you track and trend incidents rather than just file them. One row per incident is generally enough for the register itself, provided each row links to a completed Incident Report Form or case file containing everything the Rules require. Useful columns: incident number, date, person affected, type of incident, brief description, severity, reportable to the Commission (yes or no, and the date notified), corrective action, status, and date closed. For reportable incidents, also track the date you became aware, the 24-hour and 5-business-day deadlines, the Commission reference number, and whether a final report is required and when it is due.

How to tailor it (and what an auditor actually checks)

Replace every highlighted prompt, then delete anything that does not match your services - and add what is missing. If you use restrictive practices or provide high-intensity supports, a generic template is not enough on its own; have those areas reviewed by an appropriately qualified person.
Make the roles real. Name the person who assesses incidents and notifies the Commission, name their backup, and state exactly how a worker reaches them after hours so a 24-hour report is never missed.
Sole traders: plan for the awkward case. If an allegation concerns you personally, you still assess whether it is reportable and notify the Commission within the timeframe where required. Manage the conflict of interest by having an appropriately independent person assess or investigate where practicable, cooperate with any police or regulatory investigation, and give the affected participant information about independent advocacy and external complaint options.
Set internal timeframes you will actually meet. An internal rule you routinely miss looks worse at audit than a realistic one you always follow.
Run a practice drill. Walk one imagined incident from first response through the form, the register and the triage questions before you ever need them in a real situation.
Remember what the evidence is. An auditor checks whether you genuinely follow your policy - workers who can describe what they would do, forms that are filled in, a register with real entries and closed-out actions - not just whether the document exists.

Frequently asked questions

Do I need an incident management system to become a registered NDIS provider?

Yes, on either audit pathway. Incident management is one of the four principal areas assessed in the Verification Module (alongside human resource management, complaints management and risk management), and it is also an outcome within the Core Module used for certification audits. Every registered provider must have an incident management system that meets the NDIS (Incident Management and Reportable Incidents) Rules 2018 - a documented policy, a report form and a register are the usual written backbone of one, alongside evidence that workers are trained in it and that it is actually used.

What is the difference between an incident and a reportable incident?

An incident is any act, omission, event or circumstance connected with your supports that harmed, or could have harmed, a participant - including near misses - plus acts by a participant, in connection with their supports, that caused serious harm or a risk of serious harm to another person. All of these are recorded and managed in your own system. A reportable incident is the narrower set of six serious categories that must also be notified to the NDIS Commission within set timeframes - and that includes alleged incidents in those categories, not just confirmed ones. Every reportable incident is an incident, but most incidents are not reportable.

Do unregistered providers have to report incidents to the NDIS Commission?

The reportable incident obligations in the Rules apply to registered providers. Unregistered providers are still bound by the NDIS Code of Conduct, which requires them to act on quality and safety concerns, and complaints about them can still be made to the Commission. In practice, many unregistered providers keep an incident policy and register anyway - it protects participants, and some plan managers, support coordinators and other organisations may ask to see one before engaging a provider.

What if the incident might involve a crime?

Safety first, then police. Call 000 in an emergency; otherwise contact police on 131 444 where a crime may have been committed. Preserve evidence where it is safe to do so, and do not run your own internal investigation in a way that could interfere with the police investigation. Reporting to police does not replace notifying the NDIS Commission if the incident is also reportable - both can apply to the same incident.

Is this template enough to pass an audit?

No. It is a draft policy only. An auditor assesses your actual practice against the applicable standards - whether workers know the process, whether incidents are genuinely recorded and followed up, and whether your responses match what your policy says. Tailoring the template, training your workers and keeping real records may support compliance, but no document can guarantee registration, conformity or any particular audit outcome.

Need the matching form, register and the rest?

This incident management policy is one of the 71 editable Word documents in the Bluetail registration pack - which also includes the matching Incident Report Form and Incident Register, an Open Disclosure Policy, and a participant guide to raising incidents and complaints, all pre-filled with your business name and logo. The pack is designed to support common registration and audit-preparation tasks for small providers - the documents and evidence you actually need will depend on your registration groups, audit pathway, business structure and services, and the pack does not guarantee registration, audit conformity or legal compliance. Consultant pricing for an equivalent document set varies considerably, commonly running into the thousands. Preview every page free, then unlock all 71 for $50 once.

See the $50 pack

This page is general information, not legal advice. Bluetail is not affiliated with, endorsed by, or connected to the NDIS Quality and Safeguards Commission or the NDIA. For advice on how the NDIS (Incident Management and Reportable Incidents) Rules 2018 apply to your services, speak to a qualified professional.