NDIS Incident Register: What Auditors Look For in 2026

Why the Incident Register Is a Priority Audit Document

For Supported Independent Living (SIL) providers and registered NDIS organisations, the incident register is one of the first documents an approved quality auditor requests. It functions as the primary evidence base for your organisation's commitment to participant safety, transparent reporting, and continuous improvement — all of which sit at the heart of the NDIS Practice Standards and the strengthened 2026 registration framework.

An incomplete or poorly maintained register does not just create an audit finding. It signals systemic risk to participants, which auditors treat as a significant non-conformance under the Core Module on Incident Management.

What the NDIS Practice Standards Require

The NDIS Practice Standards (Quality Indicators) require registered providers to maintain a documented incident management system. For SIL and other higher-risk registration groups, this includes:

• A written incident management policy and procedure
• A register that captures all incidents — both reportable incidents (notified to the NDIS Commission) and internal incidents
• Timely internal reporting, escalation pathways, and investigation processes
• Evidence that corrective and preventive actions were implemented and closed out
• Regular management review of incident trends

The strengthened Practice Standards framework, progressively implemented from 2024–2026, places heightened emphasis on participant outcomes and demonstrable safety culture. Auditors now look beyond procedural compliance toward evidence that the system actually drives improvement.

Exactly What Auditors Examine: Field by Field

When an approved quality auditor opens your incident register, they work through a structured checklist. The following are the specific elements auditors verify against the Practice Standards quality indicators.

1. Incident Identification Fields

• Unique incident reference number — each record must be individually identifiable
• Date and time of the incident
• Date and time the incident was first reported internally — auditors calculate whether internal reporting met your own policy timeframe
• Location — site, address, or "in community"
• Participant identifier (de-identified or initials where the register is a shared document)
• Category of incident — e.g. injury, medication error, missing person, unauthorised restrictive practice
• Incident description — factual narrative of what happened, not conclusions

2. Reportable Incident Classification

Auditors cross-reference the register against your NDIS Commission portal submissions. They verify that every incident classified as a reportable incident under section 73Z of the National Disability Insurance Scheme Act 2013 (including death, serious injury, abuse, neglect, or unauthorised use of a restrictive practice) was notified to the NDIS Commission within the required timeframes — an initial notification within 24 hours for the most serious incidents, with a detailed written report to follow.

A common audit finding is where the register shows an incident that meets the definition of a reportable incident, but no corresponding Commission notification exists. This is treated as a direct non-conformance.

3. Investigation Documentation

• Who conducted the investigation and their role
• Date the investigation commenced and concluded
• Root cause or contributing factors identified
• Whether the participant (and their nominated representative) was informed and involved
• Whether police, safeguarding, or other external bodies were notified where applicable

4. Corrective and Preventive Actions (CAPAs)

This is where many SIL providers lose points. Auditors look for:

1. Specific actions assigned — not generic statements like "staff will be reminded"
2. Named responsible person for each action
3. Due date
4. Completion date and evidence of closure (e.g. training record, policy update, supervision note)
5. Whether the CAPA was reviewed to confirm it was effective

5. Management Review and Trend Analysis

Auditors look for evidence that management regularly reviews aggregated incident data — typically through meeting minutes, quality committee reports, or documented management reviews. The register should feed a visible improvement loop, not sit as a static log. Providers operating SIL houses should be able to show analysis by incident type, location, support worker, time of day, or participant — demonstrating the organisation is using data to prevent recurrence.

Common Non-Conformances Found During NDIS Audits

Restrictive Practices: A Register Within a Register

For SIL providers, any unauthorised or unplanned use of a restrictive practice must be captured as a reportable incident. Auditors specifically look for a clear trail from the incident record through to Behaviour Support Plan (BSP) review, NDIS Commission notification, and — where the practice is regulated — confirmation that the required consent or authorisation exists. The absence of a separate restrictive-practice column or sub-register is a recurring audit gap.

Sample Register Fields: A Practical Template Structure

The following fields represent a minimum-viable incident register structure that maps to the Practice Standards quality indicators. Your register may be digital (spreadsheet, incident management software) or paper-based, but must be retrievable and auditable.

1. Incident ID
2. Date/time of incident
3. Date/time of internal report
4. Participant identifier
5. Site/location
6. Category (injury / medication / missing person / abuse / neglect / RP / other)
7. Reportable incident? (Yes / No / Under review)
8. NDIS Commission notification date (if applicable)
9. Description of incident
10. Immediate actions taken
11. Investigating officer and date assigned
12. Investigation completion date
13. Root cause / contributing factors
14. Participant / representative notified (date)
15. CAPA 1, 2, 3 — action / responsible person / due date / completion date / evidence
16. Closed date and authorising manager
17. Management review date

Preparing Your Register for Audit

In the weeks before a certification or verification audit, run an internal audit of your incident register using the same lens an approved quality auditor would apply:

1. Pull every incident from the past 12 months and check for completeness against each field above
2. Cross-reference reportable incidents against Commission portal submissions — verify dates and incident IDs match
3. Confirm every open CAPA has a due date and responsible person
4. Collect evidence documents for closed CAPAs and attach them to the record
5. Print or export management review minutes that reference incident data
6. Confirm staff training records show incident management induction for all support workers

If your organisation uses the ndiscompliant.com.au 136-document SIL compliance kit, the incident register template and accompanying CAPA tracker are pre-formatted to these exact auditor expectations — saving significant setup time.

What Happens When Auditors Find Gaps

Non-conformances in incident management are graded by severity. A missing field on a low-risk internal incident may be a minor finding with a corrective action timeframe. Failure to notify the NDIS Commission of a reportable incident, or evidence of a pattern of missed notifications, can escalate to a major non-conformance, potentially triggering conditions on your registration or referral to the NDIS Commission's compliance team. Under the strengthened 2026 framework, the Commission has increased its focus on proactive compliance monitoring, meaning gaps that once passed unnoticed are now more likely to be identified.