Running a National Disability Insurance Scheme (NDIS) service comes with significant responsibility. You are entrusted with supporting some of Australia’s most vulnerable people, and with that comes an obligation to proactively manage the risks that can jeopardise participant safety, organisational integrity, and your registration status. Yet, too many NDIS providers wait for something to go wrong before building a formal risk management framework.
This guide explores what effective NDIS risk management looks like, why it matters, what the NDIS Commission expects under the National Disability Insurance Scheme (Provider Registration and Practice Standards) Rules 2018, and how to build a solid NDIS risk management plan before issues arise — not after.
| Key Takeaway A strong NDIS risk management plan is not just a compliance requirement — it is the foundation of safe, high-quality disability support. Providers who invest in risk management proactively protect participants, staff, and their organisation from harm. |
What Is NDIS Risk Management?
NDIS risk management refers to the systematic process of identifying, assessing, treating, and monitoring risks that could affect participants, workers, or the organisation as a whole. For NDIS providers, risk is everywhere — in the delivery of supports, in the environment where care is provided, in the behaviour of workers, in technology systems, and in organisational governance.
Effective NDIS provider risk management means taking a comprehensive view — one that covers clinical and personal care risks, workplace health and safety, financial risks, reputational risks, and compliance risks. It is an ongoing process, not a one-time document.
Why Risk Management Matters Under the NDIS Framework
The NDIS Quality and Safeguards Commission sets clear expectations for registered providers. Under the National Disability Insurance Scheme (Provider Registration and Practice Standards) Rules 2018, and the associated NDIS (Quality Indicators) Guidelines 2018, providers must demonstrate robust risk management systems across their operations.
It is important to note that the pathway you follow depends on the types of supports you deliver. Providers delivering lower-risk, lower-complexity supports are assessed under the Verification Module, which requires risk management systems but with a simpler evidence threshold. Providers delivering higher-risk or more complex supports are assessed under the Certification pathway (Core Module), which carries more extensive requirements. This blog primarily addresses the Core Module requirements, which represent the higher bar.
Under the Core Module’s Risk Management standard, the outcome is clear: risks to participants, workers and the provider are identified and managed. To meet this outcome, providers must demonstrate the following quality indicators:
- Risks to the organisation — including risks to participants, financial and work health and safety risks, and risks associated with provision of supports — are identified, analysed, prioritised and treated.
- A documented risk management system that effectively manages identified risks is in place, and is relevant and proportionate to the size and scale of the provider and the scope and complexity of supports provided.
- The risk management system covers all eight mandated domains (see below).
- Where relevant, the risk management system includes measures for the prevention and control of infections and outbreaks.
- Supports and services are provided in a way that is consistent with the risk management system.
- Appropriate insurance is in place, including professional indemnity, public liability and accident insurance.
Failure to meet these requirements can result in conditions on your registration, suspension, or deregistration. More importantly, poor risk management directly contributes to participant harm — the very outcome the NDIS is designed to prevent.
The Eight Mandated Domains of Your Risk Management System
One of the most commonly missed requirements in NDIS risk management is that the Practice Standards do not leave the scope of risk management to provider discretion. The Quality Indicators explicitly require that your risk management system covers each of the following eight domains:
- Incident management
- Complaints management and resolution
- Financial management
- Governance and operational management
- Human resource management
- Information management
- Work health and safety
- Emergency and disaster management
Additionally, where relevant to your service context, your system must also include measures for infection prevention and control. This requirement was introduced following the November 2021 amendments to the Practice Standards and reflects lessons learned during the COVID-19 pandemic. Many providers still overlook this domain — auditors do not.
Understanding NDIS Risk Management Guidelines
The NDIS risk management guidelines draw from the Practice Standards Rules and Quality Indicators Guidelines, as well as broader Australian risk management standards such as ISO 31000:2018 (Risk Management – Guidelines). Together, these frameworks outline a consistent approach to risk that providers should embed into their daily operations.
Key principles of the NDIS risk management guidelines include:
- Person-centred risk and dignity of risk: Under the NDIS Practice Standards, ‘dignity of risk’ is a defined term meaning the right of the individual to choose to take some risk in engaging in life experiences. Risk management must balance participant safety with their right to make autonomous decisions. Overly restrictive approaches can infringe on participant rights — this is itself a compliance issue.
- Proportionality: Your risk management system must be relevant and proportionate to the size and scale of your organisation and the scope and complexity of the supports you deliver. A sole trader providing community access supports will have a different system to a large residential care provider.
- Participant collaboration: Risk assessments must not be done to participants — they must be done with them. The Practice Standards require that risk assessments are regularly undertaken and documented in collaboration with each participant, and that strategies to treat known risks are planned and implemented together.
- Continuous improvement: Risk management is not static. Providers must regularly review and update their risk registers and risk management plans, and ensure findings feed into quality improvement cycles.
- Incident learning: Near misses and incidents must feed back into the risk management process. The Practice Standards require demonstrated continuous improvement in incident management, with outcomes incorporated throughout the organisation.
Core Elements of an NDIS Risk Management Plan
Whether you are starting from scratch or reviewing an existing framework, every NDIS risk management plan template should include the following core elements:
1. Risk Context and Scope
Define the internal and external context in which your organisation operates. This includes your service types, participant cohorts, geographic area, organisational size, and any specific vulnerabilities of the people you support. Your scope must explicitly address all eight mandated domains. Generic templates that do not map to each domain will not satisfy an auditor.
2. Risk Identification
Systematically identify all risks relevant to your operations. Consider participant safety risks (falls, medication errors, abuse), staff risks (burnout, conduct issues, inadequate supervision), organisational risks (funding instability, technology failure, staff turnover), and compliance risks (breaches of the NDIS rules, reporting failures, insurance lapses). Use workshops, incident data, staff feedback, and — critically — participant input to ensure you capture a comprehensive picture.
3. Risk Assessment
For each identified risk, assess both likelihood (how probable is this risk occurring?) and consequence (what would the impact be if it did?). Use a risk matrix to assign a risk rating — typically Low, Medium, High, or Extreme. This prioritises your risk treatment efforts and resources toward the most significant exposures.
4. Risk Treatment and Controls
Document the controls you have in place to reduce each risk, and identify any gaps. Risk treatment options include: eliminating the risk, substituting a safer alternative, implementing engineering or administrative controls, or accepting the residual risk with monitoring in place. Every high or extreme risk should have a clear treatment plan with an assigned owner and timeline.
5. Insurance
Your risk management plan must confirm that appropriate insurance coverage is in place. The Practice Standards specifically require professional indemnity insurance, public liability insurance, and accident insurance. Gaps in any of these can constitute a compliance breach. Review coverage annually and whenever your service scope changes significantly.
6. Roles and Responsibilities
Your NDIS risk management policy must clearly articulate who is responsible for each aspect of risk management. This includes the Board or governing body (strategic oversight and sign-off of the risk management framework), management (operational risk management), frontline staff (daily risk identification and reporting), and participants (where applicable, as co-designers of their individual risk strategies).
7. Monitoring, Review, and Reporting
A risk register without a review process is a compliance document, not a management tool. Specify how often risks will be reviewed (quarterly is common for high risks), what triggers an immediate review (e.g., a serious incident), and how risk information is reported to governance. Auditors will look for evidence that your risk management plan template is a living document — board minutes, review schedules, and updated risk registers are key evidence.
8. Incident, Complaint, and Infection Control Integration
Link your incident management, complaints processes, and infection prevention and control procedures to your risk register. Trends in incidents or complaints are early warning signs of emerging risks. Where your services involve direct physical contact with participants, your risk management system must include infection prevention measures compliant with current public health guidance.
Participant-Level Risk Planning: A Frequently Missed Requirement
Many providers focus so heavily on organisational risk that they overlook a distinct and equally important requirement: participant-level risk planning. The NDIS Practice Standards (Support Planning section) require that, in collaboration with each participant:
- Risk assessments are regularly undertaken and documented in their support plans.
- Appropriate strategies are planned and implemented to treat known risks.
- Risk assessments consider the degree to which participants rely on the provider’s services to meet their daily living needs, and the extent to which the health and safety of participants would be affected if those services were disrupted.
- Periodic reviews of the effectiveness of risk management strategies are undertaken with each participant to ensure risks are being adequately addressed, and changes are made when required.
This is not optional. Auditors will expect to see evidence that participant risk planning is individualised, collaborative, and regularly reviewed — not a generic template applied uniformly across all participants.
| Important: Dignity of Risk Participants have the right to make decisions that involve some risk. ‘Dignity of risk’ is a defined term in the NDIS Practice Standards. Providers must support informed decision-making and must not withdraw access to supports solely on the basis of a dignity of risk choice made by a participant. Overly restrictive risk management that limits participant autonomy is itself a compliance risk. |
NDIS Risk Management Rules: What Providers Often Miss
Many providers understand the broad requirements but underestimate some of the specific NDIS risk management rules that auditors focus on. Common gaps include:
- Insurance documentation: Many risk management plans do not reference the provider’s insurance policies at all. Ensure your plan or policy explicitly confirms professional indemnity, public liability, and accident insurance are in place and current.
- Infection prevention and control: The 2021 amendments to the Practice Standards introduced a specific requirement for infection prevention measures within the risk management system. If your services involve any direct contact with participants, this domain must be addressed.
- Emergency and disaster management: Your risk management system must explicitly address emergency and disaster planning. Since January 2022, this is a standalone Practice Standard requiring governing body involvement, participant consultation, tested plans, and worker training.
- Restrictive practices documentation: If your service supports participants with behaviours of concern, you must have specific risk plans that align with your state or territory’s Positive Behaviour Support framework and the NDIS (Restrictive Practices and Behaviour Support) Rules 2018.
- Worker screening compliance: Ensuring all workers have valid NDIS Worker Screening Checks is both a risk management and compliance obligation under the NDIS Practice Standards Rules.
- Subcontractor risk: If you engage third-party providers or contractors, your risk management obligations extend to ensuring they also meet NDIS standards.
Building a Risk-Aware Culture
No NDIS risk management template, however well designed, will be effective without a risk-aware organisational culture. Leaders must model risk-conscious behaviour, staff must feel safe to raise concerns without fear of blame, and participants must be empowered to speak up when something does not feel right.
Regular staff training on risk identification, incident reporting, and safeguarding is essential. The NDIS Practice Standards require that all workers are aware of, trained in, and comply with incident management and complaints handling procedures. Including staff and participants in the risk identification process also improves the quality of your risk register, since frontline workers and the people receiving supports often identify risks that management does not see.
Using an NDIS Risk Management Template Effectively
A good NDIS risk management template provides a structured starting point, but it is not a substitute for genuine organisational engagement with risk. When using a template, ensure it explicitly maps to all eight mandated domains, references your insurance requirements, and includes a participant-level risk planning component. Generic content that does not reflect your organisation’s actual risk profile will not satisfy auditors and, more critically, will not protect the people in your care.
At Effective Policy, our NDIS risk management policy and template documents are designed to be practical, audit-ready, and fully aligned with the current NDIS Practice Standards (Version 4, November 2021). They include a risk register, risk matrix, all eight mandated domain sections, an insurance register, a participant risk planning framework, and a review schedule — everything you need to build a robust, compliant risk management system without starting from scratch.
Final Thoughts
NDIS risk management is not a box-ticking exercise. It is a core organisational capability that underpins your ability to deliver safe, high-quality supports. The providers who do it well are not those who have the thickest policy folders — they are the ones who have built risk thinking into how they operate every day, involve participants in risk decisions, and treat their risk management system as a living tool rather than a static document.
Start by reviewing your current NDIS risk management plan against the eight mandated domains in the NDIS Practice Standards. Check your insurance documentation is referenced. Confirm that participant risk planning is collaborative and individualised. Engage your team, and commit to a regular review cycle. Whether you are a sole trader or a large multi-site provider, the principles are the same: understand your risks, treat them proportionately, involve participants, and keep improving.
If you need support building or reviewing your NDIS risk management policy and plan, Effective Policy is here to help. Explore our suite of NDIS-compliant templates and policy documents, or get in touch to discuss a tailored solution for your organisation.
