How to Document a Reportable Incident in NDIS (Template + Steps)

Why Getting Incident Documentation Right Matters

Under the NDIS Quality and Safeguards Commission, every registered provider is required to have a robust incident management system as a condition of registration. The obligations come from two sources working together: the NDIS (Incident Management and Reportable Incidents) Rules 2018 and the NDIS Practice Standards (specifically the core module on Incident Management).

Poor documentation is one of the most common findings in Commission audits. It is not enough to respond well to an incident — you must be able to demonstrate, on paper, that you responded correctly. This guide is for Supported Independent Living (SIL) and other NDIS providers who want audit-ready documentation, not just a tick-box approach.

This article is general information only and does not constitute legal or compliance advice. Always check current Commission guidance and seek qualified advice for your specific circumstances.

What Is a Reportable Incident?

Not every incident needs to be reported to the Commission — but many do. Under the Rules, reportable incidents include:

• The death of an NDIS participant
• Serious injury of a participant (requiring medical treatment beyond first aid)
• Abuse or neglect of a participant
• Unlawful sexual or physical contact with, or assault of, a participant
• Use of a restrictive practice not authorised under the participant's plan or by the relevant state/territory authority
• Unauthorised use of a restrictive practice
• Any incident involving a participant that you are required to report under applicable law (e.g., mandatory reporting to police or child protection)

Internal incidents — falls, near-misses, medication errors that do not cause serious injury — still need to be recorded in your internal incident register and reviewed under your incident management system, even if they do not require Commission notification. A good documentation practice covers both categories.

The Two-Stage Notification Obligation

The Rules establish a two-stage process for reportable incidents:

Both timeframes run from when the provider becomes aware of the incident, not necessarily when it occurred. Training your staff to escalate immediately is therefore a compliance requirement, not just good practice.

Step-by-Step: How to Document the Incident

Step 1 — Secure the scene and support the person

Before any paperwork: ensure the participant is safe and receives any medical attention needed. Call emergency services if required. Only once immediate safety is addressed should documentation begin.

Step 2 — Complete your internal incident record within hours

Every provider's incident management system should include a contemporaneous record completed as close to the event as possible. The staff member present should complete this — not a manager working from a phone call the next day. Delays weaken the record's credibility at audit.

Your internal incident record should capture at minimum:

• Date, time, and precise location of the incident
• Name of the participant(s) affected (use their NDIS number, not just a first name)
• Name(s) of staff present and any witnesses
• A factual, jargon-free narrative of what happened (what was observed, not interpreted)
• Immediate actions taken (first aid, emergency services called, participant's support network notified)
• Whether a restrictive practice was involved and if so, whether it was authorised
• Notification made to participant's nominated support person / guardian / plan nominee, where appropriate
• Name of the staff member completing the record and time of completion

Step 3 — Notify your incident management lead and escalate

Your organisation's designated incident management lead (often a compliance manager or service manager) must be notified promptly. They are responsible for determining whether the incident is a reportable incident and for submitting the Commission notification within 24 hours.

Step 4 — Submit the initial notification to the NDIS Commission

Log into the NDIS Commission Portal and submit an initial notification under the incident management section. You will need:

• Participant's name and NDIS number
• Type of reportable incident (select from the Commission's categories)
• Brief factual summary (a few sentences — this is not your full report)
• Immediate actions taken
• Whether police, emergency services, or mandatory reporting obligations were triggered

Step 5 — Conduct an internal review or investigation

Between the initial notification and the 5-business-day written report, your team needs to review what happened. For serious incidents, this may be a formal investigation. For less complex incidents, a structured team debrief documented in writing is often sufficient. The review should consider:

• What contributed to the incident occurring?
• Were existing policies and procedures followed?
• Were there any gaps in training, staffing, or the environment?
• What corrective actions will prevent recurrence?

Step 6 — Submit the 5-business-day written report

This is the substantive report. It should be coherent, factual, and demonstrate that your organisation took the incident seriously. Include:

• Full narrative of the incident (expanded from the initial notification)
• Findings from your internal review
• Actions already taken
• Corrective actions planned, with responsible person and target date
• Any notifications made to police, mandatory reporting authorities, or the participant's support network

Step 7 — File and retain all records

The Rules require providers to retain incident records for a prescribed period. Records must be stored securely and must be accessible for Commission inspection. In practice, this means your incident register, all supporting documentation (contemporaneous notes, photos if relevant, witness statements, medical clearances), and evidence that corrective actions were completed.

Worked Example: Incident Record Template Snippet

Below is an illustrative template structure for an internal incident record. Adapt it to your organisation's system.

What an Auditor Looks For

When a Commission auditor reviews your incident management system, they are looking for evidence of a functioning system, not just a policy document. Common audit findings include:

• Gaps in the contemporaneous record — entries completed days later, or by someone not present at the incident
• Missing or late Commission notifications — no evidence the portal submission was made within 24 hours
• Incomplete corrective action tracking — actions identified but no evidence they were completed or reviewed
• Participant and family not notified — no record that the participant's support network was informed
• Inconsistency between the incident register and Commission reports — incidents appearing in internal records that were never notified to the Commission
• Restrictive practice incidents not cross-referenced to authorisations — a common SIL-specific finding

A well-run incident management system has a closed loop: every internal incident is logged, every reportable incident is notified, every notification has a corresponding written report, every review has documented corrective actions, and every corrective action has evidence of completion.

Get Your Incident Management Checklist

If you are preparing for your NDIS audit or setting up a SIL house for the first time, the free SIL Readiness Pack includes a plain-English checklist of what the Commission expects from your incident management system — covering documentation, notification timelines, staff training records, and the Practice Standards core module requirements. Download it to use as a self-audit tool before your certification or verification audit.