Restrictive Practice Authorisation for SIL Providers: What It Is, When It's Required, and the Evidence Auditors Want

Restrictive practices sit at the sharp end of NDIS regulation because they involve limiting a person's rights and freedom of movement. For a SIL provider — where you may be supporting someone 24/7 in their own home — the chance of a regulated practice quietly being part of daily routine is higher than in most service types. That's exactly why it's a high-scrutiny audit area, and why getting the paperwork right is non-negotiable.

The single most expensive misunderstanding I see in small providers is the belief that "we don't do restraints, so this doesn't apply to us." Restrictive practices are defined by their effect and purpose, not by whether they look dramatic. A locked cupboard, a gate the participant can't open, or a sedating medication given to settle behaviour can all be regulated practices. So the first job is not to write a policy — it's to honestly work out what's happening in your houses.

What "restrictive practice authorisation" actually means

A restrictive practice is any practice or intervention that has the effect of restricting the rights or freedom of movement of a person with disability. A regulated restrictive practice is one of five specific categories the NDIS Commission oversees (set out below). When a regulated restrictive practice is used, a set of safeguards has to be in place — and "authorisation" is the part of that safeguard system where an external decision-maker formally approves the use of the practice for a specific person.

Here's the part that trips providers up: the NDIS Commission does not authorise restrictive practices. Authorisation is the responsibility of the state or territory where the participant lives, and every jurisdiction runs its own framework, forms and decision-makers. The Commission's role is different — it sets the behaviour support and reporting rules, registers behaviour support practitioners, receives lodged behaviour support plans, and takes the monthly and incident reports. So "getting authorisation" means going to the right state or territory body, not to the Commission.

The governing law is the National Disability Insurance Scheme (Restrictive Practices and Behaviour Support) Rules 2018, which sits alongside the NDIS Practice Standards. The Practice Standards then test, at audit, whether your service is meeting those obligations in practice.

The five regulated practices hiding in ordinary SIL houses

There are five types of regulated restrictive practice. For each, I've flagged how it tends to show up — often unrecognised — in a supported living home:

Notice how many of these are environmental. The locked external door "for safety," the cupboard the participant isn't given a key to, the snacks kept behind a lock — these are the practices small providers most often run without realising they're regulated. The test is always purpose and effect: is this restricting the person's rights or freedom, and is it being done to manage behaviour? If yes, treat it as regulated and work the process, rather than hoping it's exempt.

When a SIL provider needs authorisation

You need to deal with authorisation whenever a regulated restrictive practice is, or may be, used in your service. In practice, the trigger sequence looks like this:

1. Identify whether any regulated practice is happening (or being proposed) for a participant — using the five-category test above, not a gut feeling about whether it "looks like a restraint."
2. Get a behaviour support plan. A regulated restrictive practice should only be used in accordance with a behaviour support plan developed by a registered NDIS behaviour support practitioner, with a clear plan to reduce and eventually eliminate the practice.
3. Obtain state/territory authorisation where the relevant jurisdiction requires it, before the practice is used routinely.
4. Lodge the plan with the NDIS Commission — even if your state or territory does not require authorisation.
5. Report the use monthly, and report any unauthorised use as a reportable incident.

The NDIS Commission's position is firm: a behaviour support plan that authorises a restrictive practice without a documented reduction and elimination plan does not meet the requirements. Authorisation is never a licence to keep a practice indefinitely — it comes with an obligation to work toward not needing it.

Emergency use

Genuine emergencies — where there's an immediate, serious risk of harm to the participant or others — are treated differently. Emergency use of a regulated restrictive practice is not automatically prohibited, but it must be the minimum necessary response, it must be documented and reported, and it must trigger an urgent review of (or the creation of) a behaviour support plan. Emergency use is not a workaround for skipping authorisation; it's a narrow, accountable exception that itself generates paperwork.

The two obligations people confuse: authorisation vs lodgement

This is the distinction worth reading twice, because getting it wrong is a common — and avoidable — non-conformance.

So a provider in a jurisdiction that doesn't require authorisation for a particular practice can still be non-compliant if it hasn't lodged the plan with the Commission. And a provider that lodged the plan but never obtained the required state authorisation is also non-compliant. They are two locks on the same door; you need both keys where both apply. When you're unsure which applies in your state, the safest move is to confirm directly with your state or territory's senior practitioner / authorisation body and with the NDIS Commission.

Who does what: implementing provider vs behaviour support provider

SIL providers are almost always the implementing provider — the organisation delivering the day-to-day support in which the practice is used. That role is distinct from the specialist behaviour support provider, which employs the registered practitioner who writes the plan.

You generally cannot write your own authorising behaviour support plan. A plan that authorises a regulated restrictive practice must be developed by a practitioner registered with the NDIS Commission as a suitable NDIS behaviour support practitioner. A plan written by an unregistered person is not a valid authorising document — which means relying on it leaves the practice unauthorised. As the implementing provider, your responsibilities are to:

• Implement the plan faithfully — use the practice only as the plan specifies, and ensure staff are trained on that specific participant's plan.
• Keep the records — log every use in your restrictive practices register, and maintain consent, review and incident records.
• Report — submit monthly reports to the Commission, and report unauthorised use as a reportable incident.
• Feed back — tell the specialist behaviour support provider when something happens that means the plan needs reviewing (a change in the participant's situation, escalation, or a practice being used more than the plan anticipated).

If you're working out which Practice Standards modules and obligations attach to your service overall, our Practice Standards mapping guide shows how restrictive practices fit alongside the Core Module and the behaviour support supplementary module.

Reporting timeframes you cannot miss

Reporting is where good intentions fail an audit, because it's time-bound and the Commission can see exactly whether you've done it. There are two clocks:

The nil-report point catches people out. If a participant has an authorised plan, you still owe a monthly report even in a month where the practice wasn't used — silence isn't compliance. And note that an unauthorised regulated restrictive practice is, by definition, a reportable incident: using a regulated practice without the BSP and the required authorisation isn't just a process gap, it's an event you must self-report. Because these timeframes can change, always reconfirm them on the NDIS Commission website before relying on them.

The evidence auditors actually sample

This is the question every provider really wants answered: when the assessor reaches restrictive practices, what do they ask to see? Based on the Practice Standards and the Commission's guidance for implementing providers, expect them to sample some or all of the following — and to cross-check them against each other:

The thread running through all of it: consistency. An auditor will pull your register, then your monthly reports, then your incident records, then ask a worker what the plan says — and look for the same story in each. A register entry with no matching monthly report, or a worker who can't describe the plan they're implementing, is the kind of gap that turns into a non-conformance. For the wider picture of how an assessor moves through a SIL service, see what auditors check for SIL providers.

If you genuinely use none: how to prove it

Plenty of small SIL services don't use any regulated restrictive practice — and "none used" is a completely legitimate, audit-passing answer. But it's only credible if you can show how you know. An auditor won't accept "we just don't"; they want to see the system that would catch a regulated practice if one crept in. To evidence a clean position:

• Have the policy anyway. A Restrictive Practices Policy that defines the five types and the identification process shows you'd recognise one if it occurred.
• Screen routinely. Build a check into your support-planning and shift-review process — locked areas, behaviour-management PRN medication, movement-limiting devices — so environmental and chemical restraints don't slip through unnoticed.
• Keep an empty (but live) register with a documented "nil" position and a date, rather than no register at all.
• Train staff to recognise and escalate a potential regulated practice, and record that training.

The honest "none used, and here's our safeguard" answer is often stronger evidence of a well-run service than a thick file of authorisations. What fails audits is the silent gap — a locked door no one flagged, recorded nowhere.

A pre-audit checklist for SIL providers

If you're preparing for registration ahead of the 2026 deadlines, work this sequence now rather than the week before your assessment:

1. Audit your own houses against the five regulated types. Walk each property; ask staff what's locked, what PRN medication is used and why, what happens during escalation. Write down what you find.
2. For each regulated practice you identify, confirm there's a current behaviour support plan from a registered practitioner, the required state/territory authorisation, and a lodgement record.
3. Stand up the register and the reporting rhythm — monthly submission within five business days of month end, including nil reports.
4. Check your consent and review records are current and name the right decision-maker.
5. Train and document. Make sure workers can describe the plan they're implementing, and keep the training records to prove it.
6. Write (or refresh) the policy so it matches what actually happens in your service — not a generic template that contradicts your practice.

This is precisely the documentation layer the SIL Rescue Kit is built to give you a head start on — editable, Practice-Standards-mapped templates you tailor to your service, instead of writing the Restrictive Practices Policy, register and consent forms from scratch while running a roster. And if you'd like a fast read on where you stand across every audit domain — not just restrictive practices — run the free SIL readiness scorecard before you spend a dollar.

Frequently asked questions