NDIS templates
NDIS risk management policy template
Written by James, creator of BluetailPublished 18 October 2026
Risk management is assessed in every NDIS audit, verification or certification. This template gives you a policy and framework in one: how you find, rate and manage risks to participants, workers and the business, how you respect a participant's right to take risks, and when a risk has to go to someone more senior.
Do it yourself with Bluetail
Prepare your registration without paying thousands
The document pack
82 registration documents pre-filled with your business name and logo. Preview every page free; $65 once to unlock the editable Word files.
Also on Bluetail - free
- DIY registration guideStep-by-step, start to finish
- YouTube seriesFollow a real registration as it happens
- Compliance CRMShift notes, rosters, workers and registers
150+ providers have bought the pack · 650+ use the free guides and CRM
| Document | Risk Management Policy & Framework |
|---|---|
| Part of the pack | Governance & quality |
| Format | Editable Word file, pre-filled with your business name, ABN and logo |
| Cost | Page one is free below; the editable file is in the $65 pack |
What the template covers
The policy sets out the types of risk you consider, how each participant's risks are assessed and reviewed (when their needs change, and otherwise at least once a year), and dignity of risk - supporting people to make their own choices, including ones that carry some risk. It walks through the risk process (identify, assess, treat, record, monitor and review), rates risks by likelihood and consequence on a simple matrix, sets your risk appetite and escalation thresholds, and links everything to the Risk Register, with responsibilities and an annual review.
Sections in the document
- Purpose
- Scope
- Our approach
- Types of risk we consider
- Individual participant risk assessment
- Dignity of risk
- The risk management process
- Rating a risk - likelihood and consequence
- Our risk appetite and escalation thresholds
- Linking to the Risk Register
- Escalation
- Responsibilities
- Review of this policy
- Approval
Which NDIS rules it helps you meet
- Core Module 2.2 - Risk Management
- Core Module 1.4 - Independence and informed choice ("each participant's right to dignity of risk in decision-making is supported")
- Verification Module - risk management
Who needs it
Every registered NDIS provider: risk management is part of the Core Module and one of the four areas a verification audit focuses on. Sole traders need one too: keep it proportionate to your business, with the same steps and a shorter register.
Page one, free
This is the real document, filled in for an example business so you can see exactly what you get.
Example Provider Pty Ltd - Risk Management Policy and Framework
ABN 12 345 678 901 · Version 1.0 · Effective 1 June 2026
Purpose
This policy explains how Example Provider Pty Ltd identifies, assesses, treats and monitors risk. Managing risk well keeps participants safe, protects workers, supports good decisions, and helps us deliver consistent, quality supports in line with the NDIS Practice Standards and the NDIS Code of Conduct.
Scope
This policy applies to everyone working for or on behalf of Example Provider Pty Ltd - including the owner, employees, contractors and volunteers - and to all supports we deliver and all sites we work from, including participant homes and the community.
Our approach
We treat risk management as part of everyday work, not a once-a-year task. We aim to prevent harm where we can, reduce it where we cannot, and learn from what happens. Where a risk could affect a participant, we involve them (and their nominee or support network where appropriate) in decisions about how it is managed.
Types of risk we consider
- Risks to participants - health and wellbeing, safety, neglect or abuse, rights and dignity, and risks linked to a participant’s individual support needs.
- Risks to workers - work health and safety (WHS), manual handling, lone work, travel, and exposure to aggression or distress.
- Operational risks - service continuity, staffing gaps, missed shifts, communication breakdowns, and reliance on key people.
- Information and privacy risks - loss, misuse or unauthorised access to personal and health information.
- Financial and business risks - cash flow, insurance gaps, fraud, and inability to meet commitments.
- External and environmental risks - emergencies, severe weather, infectious illness, and community hazards.
Individual participant risk assessment
Organisational risk management is not enough on its own - each participant faces their own risks linked to their support needs, environment and choices. Example Provider Pty Ltd completes an individual risk assessment for each participant at intake, before or as supports begin, and records it using our Participant Risk & Emergency Plan. It covers matters such as health and medical risks, medication, mobility and falls, behaviours of concern, environmental hazards in the home or community, lone-support situations, and any risks the participant or their nominee raises.
Each participant's risk assessment is reviewed when their needs or circumstances change (for example after an incident, a hospital stay, a change of accommodation or a change to their plan), and otherwise at least once a year. The controls agreed are reflected in the participant's support plan so workers know how to keep the participant - and themselves - safe.
Get it with your business name on it
The Risk Management Policy & Framework is one of 82 documents in the Bluetail registration pack, each pre-filled with your business name, ABN and logo and editable in Word. Build your pack to preview every document free, then unlock them all for a one-off $65. The documents help you prepare - they don't register you.
See the $65 packBefore you use it
- Set your own risk appetite and escalation thresholds - who decides what, and at which rating.
- List the risks that are real for your services; a generic list is easy for an auditor to spot.
- Keep a Risk Register and use it: the policy is only evidence if the register shows risks being reviewed.
- Make sure each participant's individual risk assessment links back to the process the policy describes.
A template is a starting point. An auditor looks for a document that matches how your business really runs and evidence that you follow it, so read it through and change anything that isn't true for you.
Common questions
What should an NDIS risk management policy include?
How you identify, rate, treat and monitor risks; how participant risks are assessed and reviewed; how dignity of risk is respected; who is responsible; when risks are escalated; and how the policy links to a risk register. This template covers each of these.
What is dignity of risk in the NDIS?
The right of a person with disability to make their own choices, including choices that carry some risk. The Core Module asks providers to support it, so a good risk policy manages risk with the participant rather than simply removing their choices.
Do I need a risk register as well as a risk management policy?
Yes. The policy says how you manage risk; the register is the record that you do it. Auditors usually look at both, and at whether risks in the register have actually been reviewed. The Bluetail pack includes a Risk Register alongside this policy.
Related templates
The section list and page one are read from the current version of the document, so they match what you download. This page is general information to help you prepare for NDIS registration. It isn't legal or compliance advice and isn't affiliated with the NDIS Quality and Safeguards Commission or the NDIA.