Why Documentation Is Your First Line of Defence
For SIL providers and registered disability support organisations, an allegation of abuse or neglect is one of the most serious incidents you will face. Under the NDIS (Incident Management and Reportable Incidents) Rules 2018 and the NDIS Practice Standards, the way you document an allegation from the very first moment it is raised determines whether your organisation can demonstrate that it responded appropriately — to a quality auditor, to the NDIS Commission, and if necessary, to a court.
Poor or incomplete documentation is one of the most common non-conformances found during NDIS audits. This guide walks you through the required steps, what your written record must include, and provides a template structure you can adapt immediately.
What Counts as an Allegation You Must Document
Under the strengthened NDIS Practice Standards framework, the following are treated as reportable incidents that trigger mandatory documentation and notification obligations:
- Alleged, suspected, or actual abuse of a person with disability (including physical, sexual, psychological, financial, and emotional abuse)
- Alleged, suspected, or actual neglect of a person with disability
- Unlawful physical or sexual contact or assault
- Inappropriate use of restrictive practices
An allegation alone — even if unsubstantiated — triggers your documentation and notification obligations. You do not wait for an investigation outcome before lodging an incident report with the NDIS Commission.
Step-by-Step: How to Document an Abuse or Neglect Allegation
Step 1 — Ensure Immediate Safety First
Before reaching for a form, ensure the participant is safe. If there is an immediate risk of harm, contact emergency services. Safeguarding the person takes priority over paperwork, but your first documentation act should follow within minutes of the situation being stabilised.
Step 2 — Create a Contemporaneous Record
Write your initial record as soon as possible after the allegation is raised — ideally within the same shift. Courts and auditors give significantly more weight to records made at the time than those reconstructed hours or days later. Use plain, objective language. Do not include your personal opinion about whether the allegation is credible.
Step 3 — Capture the Required Information
Your incident record must contain, at minimum, the following fields:
| Field | What to Record |
|---|---|
| Date and time of the incident | When the alleged abuse or neglect occurred (if known) and when the allegation was made |
| Date and time of this record | When you are writing the record |
| Participant details | Full name, NDIS number, date of birth |
| Person making the allegation | Name and relationship to the participant (support worker, family member, participant themselves, another person) |
| Alleged perpetrator | Name, role, relationship — record what was alleged, not your conclusion about guilt |
| Nature of the allegation | A factual description using the person's own words where possible, in quotation marks |
| Location | Where the alleged incident occurred |
| Witnesses | Names and contact details of any witnesses |
| Immediate actions taken | What you did to safeguard the participant |
| Evidence preserved | Any physical evidence, CCTV footage, written communications retained |
| Person completing the record | Full name, role, signature |
Step 4 — Preserve Evidence
Do not clean, move, or alter anything at the scene of an alleged incident before police or your incident manager has assessed it. Preserve any digital evidence — text messages, rosters, medication records, shift notes, CCTV recordings. Note in your record exactly what evidence exists and where it has been stored.
Step 5 — Notify Internally Without Delay
Your Incident Management System (required under the NDIS Practice Standards) should specify your internal escalation chain. Typically this means notifying your team leader or manager, then your key personnel (registered provider's responsible person), within the timeframe set in your policy. Do not discuss the allegation with workers beyond those who need to know — this protects both the investigation and the participant's privacy.
Step 6 — Lodge Your Reportable Incident Notification with the NDIS Commission
Allegations of abuse and neglect are defined as reportable incidents under the NDIS (Incident Management and Reportable Incidents) Rules 2018. Registered providers must notify the NDIS Commission via the myNDIS provider portal. The notification must be lodged within the required timeframe after the provider becomes aware of the incident — consult the current Rules for the applicable period for your incident type, as the Commission has strengthened these requirements as part of the 2026 registration reforms.
Your initial notification can be a preliminary report; a full written report follows within the timeframe specified in the Rules.
Step 7 — Separate Your Documentation Streams
Keep three distinct document sets:
- The incident record — objective facts recorded at the time
- The investigation file — notes, interviews, evidence gathered during any internal investigation (kept separate so they cannot be confused with the primary factual record)
- The Commission correspondence file — all notifications, responses, and Commission correspondence
Mixing these sets is a frequent audit non-conformance. An auditor needs to see a clear chain: allegation made → documented → notified → investigated → outcome recorded → learnings implemented.
Step 8 — Document the Outcome and Learnings
Once any investigation is complete, record the outcome in your incident register — including what was found, any actions taken (for example, performance management, referral to police, changes to a participant's support plan), and what systemic improvements were made. The NDIS Commission expects to see a closed loop: organisations that cannot demonstrate they acted on incident findings are at risk of non-conformance against the Practice Standards Quality Indicator on continuous improvement.
Template: Allegation Documentation Record (Structure)
Use the following structure for your own organisation's template. Adapt field names to your case management system, but retain all fields.
NDIS ALLEGATION OF ABUSE / NEGLECT — INCIDENT RECORD
Record ID: ___________ Date of this record: ___/___/______
Time of this record: ___:___ Completed by (name + role): ___________
PARTICIPANT
Full name: ___________ NDIS number: ___________
Date of birth: ___/___/______ Primary support location: ___________
ALLEGATION DETAILS
Date/time alleged incident occurred: ___/___/______ at ___:___
Date/time allegation was raised: ___/___/______ at ___:___
Person raising the allegation: ___________ (relationship: _________)
Nature of allegation (circle): Physical / Sexual / Psychological / Financial /
Emotional / Neglect / Other: ___________
Description (use person's own words where possible; do NOT interpret):
___________________________________________________________________
___________________________________________________________________
Alleged perpetrator name and role: ___________
Witnesses (name, contact): ___________
IMMEDIATE ACTIONS
Participant made safe? Yes / No — actions taken: ___________
Police notified? Yes / No — crime ref. number if applicable: ___________
Emergency services contacted? Yes / No
Evidence preserved (describe what and where stored): ___________
INTERNAL NOTIFICATIONS
Team leader notified: ___/___/______ at ___:___ Name: ___________
Key personnel notified: ___/___/______ at ___:___ Name: ___________
NDIS COMMISSION NOTIFICATION
Notification lodged: ___/___/______ Portal reference: ___________
Signature: ___________ Date: ___/___/______
Common Documentation Mistakes to Avoid
- Recording opinions, not facts. Write "Participant stated…" not "Participant was clearly upset about…"
- Delaying the record. Memory fades and records written after the fact are challenged in investigations.
- Notifying the Commission late. The Rules set mandatory timeframes; missing them is a compliance breach independent of the underlying incident.
- Using the same document for the incident record and the investigation. Keep these separate.
- Failing to close the loop. An incident record with no outcome or learnings entry is incomplete under the Practice Standards.
Record Retention and Privacy
Incident records involving allegations of abuse or neglect must be retained securely and in accordance with your obligations under the Privacy Act 1988 (Cth) and any applicable state/territory requirements. The NDIS Practice Standards require registered providers to have policies governing secure storage, access controls, and retention periods for sensitive records. Ensure only authorised personnel can access the allegation file.
If your organisation is preparing for initial or renewal registration under the 2026 strengthened framework, having a compliant, auditable incident management system — including a completed template library — is one of the core things an approved quality auditor will assess. The ndiscompliant.com.au 74-document SIL compliance kit includes a ready-to-use allegation documentation template, an incident register, and the full suite of policies auditors look for, if you need a faster path to audit readiness.
Important: This article provides general guidance about NDIS compliance requirements. It is not legal or professional advice. Requirements may change as the NDIS Commission updates its policies and Practice Standards. Always verify current requirements with the NDIS Quality and Safeguards Commission or a registered NDIS consultant before making compliance decisions.