NDIS Incident Reporting, a Guide for Providers
Registered NDIS providers must run an incident management system that records every incident, and must notify the NDIS Quality and Safeguards Commission of reportable incidents: an Immediate Notification within 24 hours of key personnel becoming aware of the incident or allegation, then a more detailed 5 Day form within five business days. Both are lodged through the NDIS Commission Portal.
On this page
This guide is for the quality manager, service manager or operations lead responsible for incidents at a registered provider. It covers what counts as reportable, when the two clocks start, what the record has to contain, where providers lose the five days, and what an end-to-end compliant workflow looks like. It is a plain-language explainer, not legal advice; the Commission's own guidance is linked throughout and is the authority.
Six Categories Count as Reportable
Under section 73Z(4) of the NDIS Act and section 16 of the NDIS (Incident Management and Reportable Incidents) Rules 2018, a reportable incident is one of the following, occurring in connection with the provision of supports or services.
| Reportable incident | Immediate Notification due | 5 Day form due |
|---|---|---|
| Death of a person with disability | Within 24 hours | Within 5 business days |
| Serious injury of a person with disability | Within 24 hours | Within 5 business days |
| Abuse or neglect of a person with disability | Within 24 hours | Within 5 business days |
| Unlawful sexual or physical contact with, or assault of, a person with disability | Within 24 hours | Within 5 business days |
| Sexual misconduct committed against, or in the presence of, a person with disability, including grooming | Within 24 hours | Within 5 business days |
| Use of a restrictive practice that is unauthorised or not in accordance with a behaviour support plan | Within 5 business days, unless the practice caused harm, in which case within 24 hours | Within 5 business days |
An allegation is enough. The clock does not wait for the provider to establish what happened.
The Two Clocks Start When Key Personnel Become Aware
Both deadlines run from the moment the provider's key personnel, the people with authority over the service, become aware of the incident or the allegation. Not from when the incident happened, and not from when a support worker wrote it down. That distinction cuts both ways: a worker who sits on an incident overnight has not started the clock, but has created a gap the Commission will ask about.
The Immediate Notification carries the specific information known about the incident and the steps already taken. The Commission's guidance describes the 5 Day form as providing "additional information and actions taken by the registered NDIS provider": what the investigation found, what was done for the person, and what changes the provider is making. Both go through the "My Reportable Incidents" area of the portal.
Five business days is shorter than it sounds. An incident on a Friday evening is due as a full report by the following Friday, with a weekend, the Immediate Notification and the start of an investigation inside it.
Providers who also deliver aged care carry a second scheme with different clocks. Under the Serious Incident Response Scheme (SIRS), Priority 1 incidents are reported to the Aged Care Quality and Safety Commission within 24 hours and Priority 2 incidents within 30 days (source). A multi-sector provider's workflow has to know which scheme a record belongs to before it can run the right clock.
The Record Has to Contain More Than a Description
The Rules require every registered provider to keep an incident management system that records and manages all incidents, reportable or not. The Commission's Incident Management Systems Detailed Guidance sets out what a compliant record captures. In practice an incident record needs, at minimum:
- A description of the incident, and whether it is a reportable incident
- The time, date and place it occurred, and the time and date it was identified
- The names and contact details of the people involved and any witnesses
- The impact on the person with disability
- How the incident was dealt with, including any support provided to the person and whether they, or their family or guardian, were told
- Any assessment undertaken: the cause, how it was managed, and whether anything could prevent it recurring
- Actions taken, by whom and when
- The name of the person who made the record
Records are kept for seven years. Every item on that list is a field a form can require, which is the whole argument for structured capture: a free-text note written at the end of a shift will reliably miss two or three of them, and the person filling in the 5 Day form discovers which ones on day four.
Where Providers Lose the Five Days
Across the providers we work with, late or thin reports almost never come from a worker hiding an incident. They come from four ordinary failures.
The detail is scattered. The shift note is in one document, the photo on a worker's phone, the manager's conversation with the family in an email, the police event number on a sticky note. Assembling them is a day's work, done by the person who also has to run the service.
The record is incomplete at capture. A free-text note says what happened but not the impact, not who was told, not the time it was identified. Each missing field is a phone call to a worker who has since finished a shift and started another.
Classification happens late. Nobody with authority looked at the record until the Monday meeting, so the 24-hour Immediate Notification was already overdue before the question of reportability was asked.
Nobody owns the follow-up. The investigation, the actions and the 5 Day form each wait for someone to remember them. Without a visible clock and a named owner for each step, day five arrives as a surprise.
What a Compliant Workflow Looks Like, End to End
1. Capture at the Point
The worker records the incident on their phone within the shift, in a form whose required fields match the list above. Timestamp and author are automatic; photos attach. The record cannot be submitted incomplete.
2. Classify the Same Day
The record lands in a queue for the person authorised to decide reportability. They classify it against the six categories, and if it is reportable the workflow starts the 24-hour and five-business-day timers from the moment of awareness.
3. Notify Within 24 Hours
The Immediate Notification is lodged in the NDIS Commission Portal from the completed record. The workflow records who lodged it and when, and attaches the Commission's reference.
4. Investigate and Act
Interviews, support offered to the person, family contact, changes to the support plan and any police involvement are recorded as actions on the same record, each attributed and timed, so the 5 Day form is written from what is already there.
5. Report Within Five Business Days
The 5 Day form is lodged. Reminders have gone to the owner at day two and day four; anything overdue is flagged to the service manager before the deadline, not after.
6. Review Across the Service
Incidents are reported across homes and programs: categories, times, restrictive-practice patterns, repeat locations. The review is the part of the Rules most providers meet least well, because it needs structured records to be possible at all.
How Conpago Handles It
Conpago does not lodge anything with the Commission; the provider does, through the portal. What Conpago does is the record and the clock. Capture puts the incident form on the worker's phone with the provider's required fields, timestamp and attribution. Workflow Studio runs classification, the 24-hour and five-day timers, the reminders and the audit trail, configured to the provider's own procedure rather than a generic one. Conpago AI can help a manager find and summarise related records; it suggests, it does not decide, and nothing is lodged without a person. Records are held in Australian data centres on an ISO 27001 certified platform, and sector detail is on Care.
Sources
- https://beta.ndiscommission.gov.au/providers/complaints-and-incidents/notify-us-about-reportable-incident
- https://www.ndiscommission.gov.au/sites/default/files/2024-09/detailed-guidance-incident-management-systems-detailed-guidance-regi-20240926.pdf
- https://www.agedcarequality.gov.au/older-australians/safety-care/serious-incidents
Treat the 24-hour clock as running while you decide. Record the incident in full immediately, escalate to the person authorised to classify it the same day, and contact the Commission for advice if the category is still unclear after that. A record that was complete from the first hour can be notified late in the day; a late decision with a thin record cannot be repaired.
Seven years from the date the record is made, under the NDIS (Incident Management and Reportable Incidents) Rules 2018. In practice that means the record, its attachments, the classification decision, the notifications and the actions taken all need to stay retrievable for seven years, which is one reason paper and scattered documents struggle at audit.
Yes, and they should, because the detail is freshest at the point of capture. In Conpago, the incident form on the worker's phone carries the fields the provider sets as required, with a timestamp, the worker's name and photo evidence attached, so the record is complete when it is lodged rather than rebuilt in the office later.
No. The Immediate Notification and the 5 Day form are lodged by the provider through the NDIS Commission Portal. What software does is keep the record complete, keep the clock visible, remind the person whose step is waiting and hold the evidence, so the portal forms are filled from a finished record rather than assembled from documents.
See an incident captured, clocked and reported.
Bring your incident procedure to a demo and we will run it in Conpago, from the worker's phone to the 5 Day form.
Book a DemoBuilt on a foundation you can trust.
Enterprise ready: Conpago is ISO 27001 certified and Australian owned, with every record held in AU data centres. Security is audited annually, not assumed.
ISO 27001 Certified
Externally audited information-security management. Controls reviewed annually.
Data Sovereignty
Australian owned and Australian based. All data held in AU data centres and covered by the Privacy Act 1988.
ISO 42001 (AI)
Certification underway. AI governance held to the same external standard as our security.