Incident reports that survive auditor sampling: NDIS and aged care SIRS
Short answer: incident reports come up incomplete because they are written under pressure, the reportability decision is never recorded, and the incident lives in a shift note but not in an incident record. A record that holds up when sampled shows when you became aware, what happened, what was done, who decided whether it was reportable and why, when the regulator was told, and what changed afterwards.
Key takeaways
- The NDIS Commission describes auditors tracing a reported incident from the first report through to notification, so every link in the record is visible.
- Timeframes run from when the provider becomes aware: 24 hours for most NDIS reportable incidents and 5 business days for an unauthorised restrictive practice.
- In aged care, Priority 1 incidents are due within 24 hours and Priority 2 within 30 days of becoming aware, and suspected or alleged incidents are reportable.
- The decision that an incident is not reportable needs a record too: who decided, when and why.
- Classifying an incident and notifying the regulator stay the provider’s responsibility. Software supports the record, not the decision.
Why are incident reports often incomplete when the auditor samples them?
Because the record is made in the worst moment and not checked afterwards. These are NoteGate’s observations of the common patterns, not Commission findings:
- The incident lives in a shift note only. It is described, but never opened as an incident record, so there is no category, no clock and no notification.
- Awareness is not recorded. Both regulators count timeframes from awareness, so a record with no awareness time cannot show the clock was met.
- The reportability decision is missing. The record says a supervisor was told, but not what was decided or why.
- No follow-up. The record stops at the event. There is no investigation outcome, no change to the plan and no learning.
- Records disagree. The shift note, the incident record and the notification give three different versions of the time or the injury.
The NDIS Commission’s case study of a certification audit describes the auditor tracing a reported incident from the initial report through to notification (types of audits). A gap at any link is visible.
What must an incident report contain for NDIS and for SIRS?
The two regulators set the timeframes and the notification process. They do not publish a list of fields that an auditor will accept in your own record. This table is NoteGate’s view of what a record should hold so that it can answer an auditor’s questions. It is not a Commission form.
| What the record should hold | Why it matters |
|---|---|
| When and where it happened, and who was involved | Identifies the event and the people affected, using reference codes when shared |
| When and how you became aware | Both regulators count timeframes from awareness |
| What happened, in facts | An objective account can be relied on later |
| Immediate response and who was told | Shows the person was supported straight away |
| Category (NDIS) or incident type and priority (SIRS) | Sets the clock that applies |
| The reportability decision, who made it and why | A decision not to report is as important to record as a report |
| Notification: form, time and reference | Shows the timeframe was met |
| Investigation, outcome and learnings | Shows the incident was managed and learned from |
| Links to the shift notes, risk and care plan | Lets an auditor follow the evidence chain |
The timeframes themselves come from the regulators:
| Regime | What is reportable | Timeframe, from becoming aware |
|---|---|---|
| NDIS Commission | Death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, sexual misconduct | 24 hours |
| NDIS Commission | Use of a restrictive practice that is unauthorised or does not follow a behaviour support plan | 5 business days |
| Aged care SIRS | Eight reportable incident types, including suspected or alleged incidents. Priority 1 incidents | 24 hours |
| Aged care SIRS | Priority 2 incidents | 30 days |
Source pages: NDIS Commission reportable incidents and SIRS about reportable incidents. The NDIS Commission says failing to report within the timeframes might result in an infringement notice or other compliance actions.
Is it reportable? Five steps to decide and record
- Make the person safe. Everything else follows.
- Record when and how you became aware. This starts the clock.
- Classify it. Which NDIS category, or which SIRS type and priority? If unsure, escalate to the person responsible in your procedure.
- Record the decision. Reportable or not, who decided, at what time and why.
- Notify and keep the evidence. NDIS reportable incidents go through the NDIS Commission Portal with the Immediate Notification Form and then the 5 Day Form. SIRS incidents are notified through the My Aged Care provider portal. Keep the confirmation with the record.
For the NDIS workflow in full, see reportable incident triage and the NDIS reportable incidents guide. For aged care, see SIRS incident documentation.
What does an incomplete incident record look like next to a complete one?
Fictional example. No real participant data.
P-01 fell in the kitchen. Bruise on arm. Told supervisor.
Aware 2.15 pm when I saw P-01 slip in the kitchen while reaching for a cup. Bruise about 5 cm on the left forearm, no other injury visible, P-01 alert. First aid given 2.18 pm. Supervisor phoned 2.25 pm and assessed at 2.40 pm: not a serious injury, not reportable, reason recorded. Linked to today’s shift note and to the falls risk entry. Plan review requested to check the kitchen routine.
What should the notification log show?
A notification log shows each notification made for an incident: to whom, when, by whom and the reference given. For an NDIS reportable incident that includes the Immediate Notification Form and the 5 Day Form. It should also record other people told, such as the participant’s family or nominee, where that applies. Keep it with the incident record, not in a separate place, so that an auditor can follow one record from awareness to closure.
How does NoteGate help?
NoteGate Incident Reporting gives workers a structured way to record an incident, links it to the shift notes around the event, keeps a timestamped notification log and an approval step, and keeps the history. It supports the provider’s documentation. Classifying the incident and notifying the Commission remain the provider’s responsibility, and NoteGate never writes incident reports for workers. See NDIS incident reporting software.
Frequently asked questions
When does the incident reporting clock start?
When the provider becomes aware of the incident, not when it happened. Both the NDIS Commission and the Aged Care Quality and Safety Commission count timeframes from awareness, so record when and how you became aware.
Do I need to report an incident I only suspect?
Under SIRS, yes: suspected or alleged reportable incidents must be reported. The NDIS Commission also defines a reportable incident as an act or event that has happened or is alleged to have happened.
Do I need to record an incident that is not reportable?
Yes. Record it in your own incident management system with the reason it was not reportable. The Commission expects registered providers to have an incident management system.
How long must incident records be kept?
Under the Incident Management and Reportable Incidents Rules 2018, an incident record is kept for 7 years from the day it is made, and a reportable incident record for 7 years from the day the Commission is notified.
Does NoteGate decide whether an incident is reportable?
No. The provider classifies and notifies. NoteGate supports the record and does not determine compliance.
Sources
- Reportable incidents (NDIS Quality and Safeguards Commission, retrieved 25 September 2026)
- About reportable incidents (SIRS) (Aged Care Quality and Safety Commission, retrieved 28 September 2026)
- NDIS (Incident Management and Reportable Incidents) Rules 2018 (Federal Register of Legislation, retrieved 25 September 2026)
- Types of audits (NDIS Quality and Safeguards Commission, retrieved 28 September 2026)
Related
Record an incident so the timeline holds up
See how NoteGate Incident Reporting links an incident to the shift note. Book a 20-minute walkthrough, or choose a plan.
Book a 20-minute walkthroughChoose a plan