NDIS Risk Management Guidelines: How to Build a Compliant Risk Register

For NDIS providers, effective risk management is more than keeping a spreadsheet of things that could go wrong. The NDIS risk management guidelines, set out in the Practice Standards and their quality indicators, explain how providers can identify, analyse, prioritise and treat risks relevant to participants, workers and the organisation.

A well-maintained risk register provides a practical way to document those risks, assess their potential impact, record controls and assign responsibility for ongoing monitoring.

This guide explains what the NDIS Practice Standards require, what to include in a risk register, how to rate risks, and how to keep your risk management system useful and audit ready.

NDIS Provider Risk Management: What the Practice Standards Require

The NDIS Commission defines the risk management outcome as:

“Risks to participants, workers and the provider are identified and managed.” - NDIS Quality and Safeguards Commission, Core Module: Provider Governance and Operational Management

In practice, this means providers need a risk management system that identifies relevant risks, assesses their significance, puts appropriate controls in place and monitors whether those controls remain effective.

The risk management system should address relevant risk areas, including:

The NDIS Commission expects risk management systems to be proportionate to the provider's size, scale and scope. A registered NDIS provider should be able to demonstrate that its approach reflects the risks associated with its services and operations and meets relevant NDIS expectations.

A small provider does not necessarily need the same volume of documentation as a large organisation, but it still needs a functioning system appropriate to its actual operations.

You can review the current NDIS Quality Indicators for NDIS Practice Standards Guidelines and the NDIS Provider Registration and Practice Standards Rules, along with the Commission's Core Module: Provider Governance and Operational Management.

For a broader explanation of the Practice Standards and quality indicators, see What Are the NDIS Practice Standards and Why Do They Matter?.

The Verification Module also contains risk management requirements. Rather than reproducing the distinction here, providers unsure about their registration pathway can see NDIS Certification vs Verification: Which Path Is Right for You?.

The important point is that risk management should operate throughout the year, not become a document prepared immediately before an audit.

Risk Register vs Risk Assessment vs Risk Management Plan: What Is the Difference?

A risk register, risk assessment and risk management plan serve different purposes. Keeping them separate helps prevent gaps and conflicting information.

The risk register works primarily at an organisational level. It should not replace participant-specific risk assessments or assessments of particular activities.

For example, a provider may identify medication management as an organisational risk. An individual participant may separately require a risk assessment because of their specific medication support needs.

A risk-assessed role is also a separate issue. It concerns worker screening requirements associated with particular duties.

What Should an NDIS Risk Register Include?

A useful risk register should show what the risk is, how it has been assessed, what controls are in place, who is responsible for managing risks and whether further action is required.

A practical risk register should capture:

An NDIS risk management plan template or risk register template can provide a useful starting point. However, providers should adapt their documentation to their services, participants, registration requirements and operating environment.

Describe the risk clearly

Avoid broad descriptions such as "staffing" or "participant safety". Instead, describe the potential event and its possible consequence.

For example:

• Risk: An insufficiently trained worker is allocated to supports requiring specific competencies.
• Existing controls: Competency checks, training and supervision.

This makes it easier to determine whether the controls actually address the risk.

Distinguish risks from controls

A risk describes something that could cause harm, loss, disruption or another unwanted outcome. A control is a measure used to prevent the event or reduce its likelihood or consequence.

Keeping the two separate helps management determine whether existing controls are adequate.

Consider inherent and residual risk

Some providers distinguish between inherent risk and residual risk.

• Inherent risk is the level of risk before controls are considered.
• Residual risk is the level remaining after controls are applied.

This distinction can help management determine whether controls have reduced the risk sufficiently. Not every provider needs separate fields for both; the important point is that the approach is consistent with the organisation's documented methodology.

Connect the register to the wider system

A risk register should not become a standalone spreadsheet updated only before an audit.

Risk information can come from incidents, complaints, audit findings, participant feedback, worker feedback, near misses, environmental changes and changes to service delivery.

For example, an incident may reveal a new risk or demonstrate that an existing control is not effective. That information should feed back into the risk management process and be discussed at board or management meetings.

Risk management is also an ongoing part of compliance, not something that only needs attention when an audit is approaching. Provider+’s NDIS ongoing compliance support can help providers maintain their compliance processes throughout the year.

Having appropriate supporting documentation also matters. Provider+ offers NDIS policies, forms & procedures to help providers structure their compliance documentation.

As the policy library grows, document control becomes increasingly important. Our PQM Pro can help providers manage controlled documents and policy updates.

How Do You Rate a Risk? Likelihood, Consequence and the Risk Matrix

Risk rating should provide a consistent way to decide which risks require greater attention.

Two basic concepts are likelihood and consequence:

• Likelihood asks how likely the event is to occur.
• Consequence asks how serious the impact would be if it occurred.

A provider can use a risk matrix to combine these factors.

Example 5 × 5 risk matrix

For this illustrative matrix:

• 1–4: Low
• 5–9: Moderate
• 10–16: High
• 17–25: Extreme

High and Extreme risks require immediate action under this illustrative methodology, with the organisation following its own documented escalation and treatment process.

The likelihood scale should be defined in your organisation's risk procedure. For example:

The consequence scale should also be defined. For example:

The numbers themselves are not the important part. What matters is that the methodology is documented, understood by relevant workers and consistently applied.

How to Build an NDIS Risk Register Step by Step

A useful register starts with actual organisational risks rather than generic examples. The process should identify risks, assess them, document controls and keep them under review.

1. Identify the risks

Consider risks involving:

• participant safety and support delivery
• worker safety and WHS
• medication and manual handling
• restrictive practices
• emergency and disaster events
• infection risks
• information and privacy
• complaints and incidents
• workforce capability
• financial management
• service continuity
• participant choice and independence
• risks specific to the participant's environment.

Consult workers and relevant people about what happens in day-to-day operations. Do not rely only on incidents that have already occurred. Near misses, feedback, environmental changes and new services can also reveal risks.

For further information about workplace risks, see SafeWork NSW's WHS guidance for NDIS providers.

2. Assess the likelihood

Use the organisation's approved likelihood scale.

Consider available evidence such as incidents, complaints, audit findings, near misses and service data. Do not automatically rate a risk as unlikely simply because the organisation has not experienced the event before.

3. Assess the consequence

Consider the potential effect on participants, workers and the organisation.

For participant-related risks, consider individual needs, circumstances, lived experience, preferences and reliance on supports. Support workers should understand how agreed strategies apply in practice.

4. Calculate the risk rating

Combine likelihood and consequence using the provider's documented methodology.

The rating should help management prioritise treatment. It should not replace professional judgement or cause a provider to ignore a risk simply because its numerical score is low.

5. Record the controls

Document each risk control that is actually implemented. Where relevant, apply the hierarchy of controls:

1. Elimination
2. Substitution
3. Isolation
4. Engineering controls
5. Administrative controls
6. Personal protective equipment (PPE)

Controls should reduce harm while allowing supports to be delivered safely and without unnecessary restrictions.

Participant choice and independence should also be considered. A control that restricts a person's rights or freedom of movement may involve separate NDIS requirements and should not simply be treated as an ordinary risk control.

6. Check whether controls are effective

A control can exist on paper and still be ineffective. Effective controls play an important role in preventing incidents and reducing the likelihood or impact of identified risks.

Evidence of effectiveness may include:

• incident and near-miss trends
• complaints and feedback
• audit results
• worker observations
• training and competency records
• supervision
• participant feedback
• corrective actions.

If controls are ineffective, consider whether additional action or a revised risk rating is required.

7. Assign responsibility

Each active risk should have a clearly identified responsible person or role.

Depending on the organisation, this might be an Operations Manager, Quality Manager, SIL Manager, WHS Officer or Director.

The responsible person should ensure actions are followed through and the risk remains monitored.

8. Set the review date

Set a review date appropriate to the seriousness and nature of the risk.

Do not wait for the scheduled review after a significant incident, complaint, service change, new participant need, environmental change, legislative change or evidence that a control is ineffective.

For providers delivering Supported Independent Living (SIL), understanding how risk management fits within the broader compliance system is particularly important. The 1 October 2026 registration deadline has now passed, and the NDIS Commission has begun targeted compliance and enforcement action against providers that have not met the new requirements.

NDIS Risk Register Example: Five Completed Rows

The risk patterns reflected in these examples are based on common risk areas identified through NDIS compliance and audit work, including patterns observed in risk registers reviewed by our former lead auditors. The examples are illustrative and do not reproduce any individual provider’s risk register or confidential information.

Providers should apply their own documented risk methodology and consider their actual services, participants and operating environment.

These examples show how the risk, assessment, controls, ownership and review status can be brought together.

How Often Should an NDIS Risk Register Be Reviewed?

There is no single review interval suitable for every risk. The approach should be proportionate to the provider's size, scale, scope and complexity, while responding to changes that affect risk.

At minimum, establish a documented review schedule and define triggers for earlier review.

Review the register when:

• a significant incident occurs
• a complaint identifies a new or changing risk
• a participant's needs or circumstances change
• a new service or support is introduced
• the provider enters a new environment
• there is a significant workforce change
• a control is found to be ineffective
• an audit identifies a gap
• legislation or regulatory requirements change
• an emergency or disruption occurs
• trend data indicates an emerging risk.

A review does not necessarily mean rewriting every entry. Stable risks may simply need confirmation that the existing controls, strategies and rating remain appropriate. Changing risks may require new controls, actions, ratings or review dates.

Risk review should also form part of governance and continuous improvement. An internal audit can test whether the controls recorded in the register actually exist and operate in practice. See Top 5 Reasons to Conduct an Internal Audit for Your NDIS Provider Business.

Smaller providers should not assume that fewer workers mean risk management can be informal. For example, a sole trader delivering SIL still needs to understand the requirements applicable to their services. See Sole Trader Delivering SIL? What Mandatory Registration Means for You.

NDIS Risk Management Rules: What Do Auditors Check in Your Risk Register?

Auditors are not simply looking for a spreadsheet containing a long list of risks. They need to see evidence that the system is being implemented and can help the provider demonstrate compliance in practice. The more important question is whether the register forms part of a functioning risk management system.

Your documentation should make it reasonably clear:

• how risks are identified
• how likelihood and consequence are assessed
• how ratings are determined
• what controls are implemented
• who is responsible
• how control effectiveness is evaluated
• when risks are reviewed
• what happens when a control is ineffective
• how risk information feeds into continuous improvement.

The evidence does not all have to sit inside the register. A risk register can link to policies, procedures, training records, incident records, audits and other supporting evidence.

For example, if worker competency is identified as a risk, supporting evidence could include induction records, competency assessments, training and supervision. If emergency preparedness is a risk, evidence could include emergency plans, testing records and corrective actions.

Common Risk Register Problems We See

Through our work helping NDIS providers prepare for audits, we regularly see a few recurring issues with risk registers.

The register is too generic

We often see broad descriptions such as "participant safety" or "staffing risk" without identifying what could actually happen.

A useful risk description should identify the potential event and its consequences, making it easier to assess the risk and determine whether the controls are appropriate.

Controls are listed but not evidenced

Listing "training provided" or "staff supervision" as a control does not necessarily demonstrate that the control is effective.

Where relevant, providers should be able to show supporting evidence such as competency assessments, supervision records, observations, training records or audit findings.

The register does not match current practice

Risk registers can become outdated when a provider's services, workforce, participants or operating environment change.

If the register describes controls or processes that are no longer reflected in day-to-day operations, it may not accurately demonstrate how risks are currently managed.

Incidents and complaints are disconnected

Incidents, complaints and feedback can identify emerging risks. If recurring issues appear in these records but the risk register never changes, providers may be missing an opportunity to strengthen controls and demonstrate continuous improvement.

The register is reviewed only before an audit

A risk register should be a working management tool, not a document updated only when an audit is approaching.

Review risks when circumstances change, controls are found to be ineffective, or incidents, complaints, audits or other information indicate that the risk has changed.

For a broader audit preparation guide, see Essential Guide: Preparing for NDIS Audit with Top Tips and Checklist.

Ultimately, the register should be a working management tool. It should help the organisation understand where risks exist, what controls are in place and where further action is required.

Final Thoughts

A useful risk register is not necessarily the longest one. It should identify meaningful risks, assess them consistently, document appropriate controls and show that those controls are being monitored and reviewed.

Keep the register connected to your policies, procedures, incidents, complaints, audits, training and governance activities. Review it when circumstances change rather than waiting for the next audit.

Provider+ helps registered NDIS providers build and review their risk management system as part of ongoing compliance support. Book a call with our team.

We strive to keep our content accurate and up to date; however, NDIS Commission rules and requirements can change. For the latest information, visit the NDIS Quality and Safeguards Commission website or contact our team.