NDIS incident reporting: the 24-hour rule, explained properly

The reportable categories

Under the NDIS incident management and reportable incidents rules, these incidents — occurring in connection with delivering supports — must be notified to the NDIS Commission:

• the death of a person with disability
• serious injury of a person with disability
• abuse or neglect of a person with disability
• unlawful sexual or physical contact with, or assault of, a person with disability
• sexual misconduct committed against, or in the presence of, a person with disability — including grooming
• unauthorised use of a restrictive practice

24 hours vs 5 business days: the two clocks

The unauthorised-restrictive-practice carve-out is the one providers get wrong most: a worker locking a fridge without authorisation is a 5-business-day notification — unless someone was harmed or put at risk, in which case it's back to 24 hours. When in doubt, treat it as 24 hours.

When the clock starts: "became aware"

The clock starts when your key personnel (the people responsible for the service) become aware of the incident — not when the incident happened, and not when the paperwork is finished. Three practical consequences:

• Weekend incidents aren't Monday problems. If a manager is told Saturday night, the 24-hour clock runs through Sunday.
• Your escalation path is part of compliance. If a support worker witnesses an incident on shift but no one senior hears about it for three days, the notification is late no matter how fast you move afterwards. Workers must know to escalate immediately — that's what auditors test in interviews.
• Notify first, complete later. The initial notification is what stops the clock — you don't need the full picture on day one.

Follow-up reports

For incidents notified within 24 hours, the Commission requires a more detailed follow-up report within 5 business days of becoming aware — covering what happened, who was involved, the impact on the participant, what you did in response, and what you're changing. The Commission can also require further information or reports after that. Build the 5-day follow-up into your process rather than treating the 24-hour notification as the finish line.

Your internal register duty

Reportable incidents are the visible tip. Every registered provider must run an incident management system and record all incidents — including ones that aren't reportable — with what happened, the response, and follow-up actions. In an audit, the incident register is reconciled against shift notes: an incident described in a note that never reached the register is a classic non-conformity. Near misses belong in the register too — they're your cheapest learning.

"Is it reportable?" — plain-language checks

Work down this list; the first "yes" tells you the pathway:

1. Has someone died, or been seriously injured? (Think: hospital treatment, not a band-aid.) → Reportable, 24 hours.
2. Is there any allegation or suspicion of abuse, neglect, assault, unlawful contact or sexual misconduct? Allegation is enough — you don't investigate first and report later. → Reportable, 24 hours.
3. Was a restrictive practice used without authorisation (or outside a behaviour support plan)? → Reportable: 24 hours if it caused harm or risk of harm, otherwise 5 business days.
4. None of the above? → Not reportable to the Commission, but it still goes in your incident register with response and follow-up.

One more distinction worth writing into your policy: an incident between two participants in a shared home can be reportable (e.g. assault) even though the "other party" is also a participant — the test is what happened to a person with disability in connection with supports, not who did it.

SILReady's incident tools categorise incidents against these rules and flag the 24-hour / 5-business-day deadlines automatically, so nothing sits unnoticed in a drafts pile.