NDIS Incident Management Process: From Report to Closure
Incidents will happen in NDIS work. The difference between providers who pass audit and those who fail is process - not luck. We've reported incidents at Enrichment Care and refined our workflow each time. Here's the process that satisfies Module 2 audit and the NDIS Commission.
What Counts as a Reportable Incident
Reportable incidents must be lodged with the NDIS Commission within 24 hours via the Provider Portal. Categories: death of a participant, serious injury, abuse or neglect of a participant, unlawful sexual or physical contact, sexual misconduct, unauthorised use of restrictive practice. Other incidents (minor injuries, near-misses, complaints) are tracked internally but not reported externally. Distinction matters - over-reporting wastes Commission time, under-reporting risks compliance notices. From our experience - if in doubt, consult the NDIS Commission's reportable incidents factsheet before deciding.
The Immediate Response Workflow
When an incident occurs: 1) Stabilise the situation and ensure participant safety. 2) Call emergency services if required (000). 3) Worker reports to manager immediately by phone, not email. 4) Manager assesses if reportable. 5) If reportable - notify NDIS Commission within 24 hours via Provider Portal. 6) Notify family/guardian as appropriate. 7) Document everything in your incident register. Speed matters. Late notification to the Commission is a major audit fail. We have a one-page incident response card on every worker phone listing the steps.
The Investigation and Root Cause Analysis
Within 5 business days of a reportable incident, submit a full investigation report to the Commission. The investigation must cover: what happened (factual sequence), why it happened (root cause analysis using techniques like 5 Whys or Fishbone), what's been done in immediate response, what changes will prevent recurrence, who's accountable for follow-up. We use a structured template that takes 2-3 hours to complete properly. Treat this as continuous improvement, not punishment - the goal is better systems, not blame.
The Incident Register That Passes Module 2 Audit
Module 2 audit will request your incident register. It must show: every incident logged (reportable AND non-reportable), date, participant involved, brief description, response actions, current status, root cause findings, preventive measures implemented. Empty registers fail audit instantly. Registers that show incidents being actioned and prevented pass strongly. We log even minor incidents at Enrichment Care because the trend data is valuable. Auditors love seeing trend analysis showing fewer similar incidents over time.
Action Items to Bulletproof Your Incident Process
This week: 1) Confirm every staff member knows the difference between incident and reportable incident (15-minute training). 2) Create or refresh your incident register if it's empty or outdated. 3) Set up the NDIS Commission Provider Portal access if not already done. 4) Build a 1-page incident response card for worker phones. 5) Hold monthly incident reviews to identify patterns. Provider Scale's $999 registration package includes incident management policy and register templates. Module 2 fails are 80% process gaps - this is fixable in a quarter.