Is an Abuse or Neglect Allegation Reportable to the NDIS Commission?

The short answer: yes — and it is mandatory

If a worker, another participant, or anyone else in your service environment is alleged to have abused or neglected an NDIS participant, that allegation must be reported to the NDIS Quality and Safeguards Commission. This is not discretionary. Under the National Disability Insurance Scheme (Incident Management and Reportable Incidents) Rules 2018, abuse and neglect sit within the category of reportable incidents, and the obligation to notify arises from the moment your organisation becomes aware — regardless of whether the allegation has been substantiated.

For Supported Independent Living (SIL) providers and other registered disability support organisations, understanding this obligation precisely is critical. Non-compliance can result in regulatory action, suspension of registration, or civil penalties.

What counts as a reportable incident in this context?

The NDIS Commission defines reportable incidents as specific serious events or allegations involving NDIS participants. Abuse and neglect are explicitly included. The Rules identify the following categories of reportable incidents that are directly relevant to allegations of abuse or neglect:

• The abuse or neglect of an NDIS participant.
• Unlawful physical or sexual contact with, or assault of, an NDIS participant.
• Sexual misconduct committed against, or in the presence of, an NDIS participant, including grooming of a participant for sexual activity.
• Ill-treatment or psychological harm of an NDIS participant.

Critically, the obligation to report is triggered by an allegation, not a proven finding. You do not need to have conducted an investigation or formed a conclusion about whether the conduct occurred. The allegation itself is what triggers the reportable incident notification.

Neglect can include acts of omission — for example, a worker failing to provide a participant with adequate food, medication, supervision, or personal care when required. Abuse encompasses physical, emotional, sexual, and financial abuse. Both categories are clearly within scope.

Who must report?

The obligation falls on the registered NDIS provider. This means your organisation — not the individual worker — carries the legal responsibility to notify the NDIS Commission. Within your organisation, you should have a nominated Incident Management Officer or equivalent role with clear authority to lodge notifications.

Key obligations apply to:

• Registered NDIS providers delivering any supports or services to participants, including SIL providers.
• Providers where the alleged perpetrator is a worker, a volunteer, or another person associated with the provider.
• Providers where the allegation relates to conduct that occurred during the delivery of NDIS supports — even if the support was subcontracted.

Unregistered providers do not have the same formal notification obligations to the NDIS Commission, but they remain subject to the NDIS Code of Conduct and may face separate consequences.

Timeframes you cannot miss

The NDIS Incident Management Rules set out a two-stage notification process for reportable incidents:

1. Initial notification — within 24 hours. As soon as a registered provider becomes aware of a reportable incident (including an allegation of abuse or neglect), it must notify the NDIS Commission. This initial report does not need to include full details, but it must record the nature of the incident, who was involved, and what immediate action has been taken.
2. Full written report — within five business days. A comprehensive report must follow, outlining the circumstances of the alleged incident, the provider's investigation steps, the outcome (if known at that point), and the corrective or preventive actions being taken.

These timeframes are non-negotiable. If your organisation becomes aware on a Friday afternoon, the 24-hour clock still starts ticking. Build your on-call incident management processes to account for nights, weekends, and public holidays.

What should your report include?

When lodging both the initial and full reports through the NDIS Commission's online portal (My NDIS Commission Portal), be prepared to provide:

• The name and NDIS number of the participant involved (where known).
• The date, time, and location of the alleged incident.
• A factual description of the allegation — what was reported, by whom, and when your organisation first became aware.
• The names or roles of any workers involved (you may use position titles if the matter is under investigation).
• Immediate actions taken to safeguard the participant, including any separation of the worker from duties involving participants.
• Whether the matter has been reported to police or other relevant authorities (mandatory in some jurisdictions for certain conduct).
• Your planned investigation steps and expected timeframe.

Avoid speculating about guilt or outcomes in the initial report. Stick to what you know factually, and update the Commission as the investigation progresses.

The duty to act — not just report

Reporting is necessary but not sufficient. The NDIS Practice Standards require registered providers to have an operational incident management system. On becoming aware of an allegation of abuse or neglect, providers must also:

• Take immediate steps to protect the safety of the participant and other people at risk.
• Consider whether the worker should be stood down or redeployed away from direct participant contact pending investigation.
• Preserve any evidence relevant to the allegation.
• Inform the participant and, where appropriate, their nominee or guardian, in a way that is supportive and trauma-informed.
• Conduct or commission a thorough investigation, and document findings.
• Report to state or territory police where the conduct may constitute a criminal offence.
• In some states and territories, comply with mandatory reporting obligations under child protection or other legislation.

Under the strengthened NDIS Practice Standards framework — phased in from 2024 and continuing through 2026 — providers face heightened scrutiny of their incident management cultures. Approved quality auditors will specifically examine whether allegations were identified promptly, whether reporting timelines were met, and whether post-incident actions were documented and effective.

Consequences of failing to report

Failing to notify the NDIS Commission of a reportable incident is a breach of the provider's obligations under the NDIS Act 2013 and the Incident Management Rules. Consequences can include:

• Formal compliance notices issued by the NDIS Commission.
• Banning orders against workers or responsible persons within the provider organisation.
• Suspension or cancellation of NDIS registration.
• Civil penalty proceedings, which can result in significant financial penalties.
• Reputational damage and loss of participant trust.

Providers who attempt to manage allegations internally without notifying the Commission — even with good intentions — are at high risk of these consequences. The obligation is clear: report first, investigate in parallel.

How this fits within your broader compliance framework

An allegation of abuse or neglect does not sit in isolation. It intersects with your obligations under:

SIL providers in particular face complex multi-resident environments where allegations may arise between participants or involve multiple workers. Your incident policy must be explicit about how allegations are triaged, who is notified internally, and how the Commission is kept informed as investigations evolve.

If your organisation is preparing for a registration renewal audit or building out its compliance documentation, the 74-document audit-ready SIL compliance kit available at ndiscompliant.com.au includes incident management policy templates, reportable incident registers, and worker guidance aligned to the current Practice Standards.

Summary: what to do when an allegation arises

1. Secure the participant's immediate safety.
2. Document what was alleged, by whom, and when you first became aware.
3. Notify the NDIS Commission within 24 hours via the My NDIS Commission Portal.
4. Consider whether the worker should be stood down from participant-facing duties.
5. Notify police if the conduct may be criminal.
6. Conduct a documented investigation.
7. Submit a full written report within five business days.
8. Implement corrective actions and record outcomes.