Risk Management: NDIS Provider Governance and Operational Management

Providers of National Disability Insurance Scheme (NDIS) services must ensure that a risk management system is in place to protect NDIS participants, workers, the general public, and the organisation itself from harm (NDIS Commission 2024; NDIS Commission 2021).

The NDIS Code of Conduct requires providers to deliver supports and services in a safe and competent manner, with care and skill, and to promptly act on concerns about matters that may affect the quality and safety of supports provided to people with disability. Providers must have risk management systems that meet the standards applicable to their registration (NDIS Commission 2026a; NDIS Commission 2021).

What is Risk Management?

Risk management is the process of identifying, assessing, managing and reviewing risks (NSW Treasury 2025). It is a proactive and ongoing process that helps prevent harm, respond to changing circumstances and improve the safety and quality of supports. In NDIS service delivery, risks can affect participants, workers, service delivery and the provider itself.

Effective risk management can help to:

• Protect the safety and wellbeing of participants, workers, and others
• Identify and address risks before they result in harm
• Reduce the likelihood or consequence of incidents and adverse events
• Support participant choice, independence and dignity of risk
• Maintain safe support environments
• Reduce disruption to essential supports
• Enhance confidence in the provider's services
• Reduce the risk of legal action being taken against the provider.

(Safe Work Australia 2024; NDIS Commission 2021)

Risk Management in the NDIS Practice Standards

Within the Core Module: Provider governance and operational management, registered providers are required to have systems to identify and manage risks to participants, workers, service delivery, and the organisation.

Risk management operates at both an:

• Organisational level: the systems, processes and governance that the provider puts in place as a whole.
• Individual participant level: the assessment and planning that occurs within each participant's support plan.

At the organisational level, providers must maintain a documented risk management system that is appropriate to their size and complexity.

For registered providers subject to the Core Module of the NDIS Practice Standards, the provider's risk management system must cover:

• Incident management
• Complaints management and resolution
• Work health and safety
• Human resource management
• Financial management
• Information management
• Governance and operational management
• Emergency and disaster management
• Where relevant, the system must also include measures to prevent and control infections and outbreaks.

(NDIS Commission 2024; NDIS Commission 2021).

Providers must also ensure they hold appropriate insurance (professional indemnity, public liability and accident insurance) and that supports are delivered consistently with their risk management system (NDIS Commission 2024).

Under the Support Planning Practice Standard (Core Module: Provision of supports), providers must regularly undertake risk assessments in collaboration with participants, document identified risks in support plans, implement appropriate risk management strategies, and periodically review whether those strategies remain effective (NDIS Commission 2024).

Shared Responsibility: Roles and Expectations

Risk management is not the responsibility of one person or role; it is shared across the organisation. However, what each level of the organisation is responsible for differs.

Support Workers

Support workers are often the first to recognise changes in a participant's circumstances or new risks that may emerge (NDIS Commission 2026a). Their key responsibilities are to:

• Recognise and report new or changing risks to their manager or supervisor
• Follow the participant's support plan and the organisation's established procedures
• Work within their role and competence, do not undertake tasks or decisions outside their training, authority or competence
• Escalate concerns promptly when something doesn't feel right or when a participant's needs have changed.

(NDIS Commission 2024; NDIS Commission 2026a; NDIS Commission 2026b)

Managers and Supervisors

Managers and supervisors hold a key role in translating organisational risk management systems into daily practice. They are responsible for:

• Ensuring that risks identified by support workers are appropriately escalated and acted upon
• Providing supervision that is timely, supportive and focused on quality and safety
• Ensuring that workers receive the information, training, and resources they need to deliver support safely and according to the participant's support plan
• Maintaining communication with support workers about risks, procedures and any changes to processes
• Monitoring the effectiveness of risk management practices within their team.

Effective supervision is where managers and supervisors actively listen, provide feedback, and ensure workers feel supported. It is essential in embedding a strong safety culture within the organisation (NDIS Commission 2024; NDIS Commission 2026a; NDIS Commission 2026b).

Providers and Governing Bodies

The governing body and senior management are ultimately responsible for ensuring that the organisation has effective risk management systems in place and that these systems actually work in practice (NDIS Commission 2026b; NDIS Commission 2024; NDIS Commission 2021).

Specifically, they must:

• Establish and maintain effective and proportionate risk management systems
• Define who is responsible for what, and ensure clear lines of accountability
• Monitor quality and safeguarding risks, using data from incidents, complaints, and audits to identify patterns and drive improvement
• Ensure that organisational risks are considered in strategic planning and day-to-day decision-making
• Ensure that risk management systems are reviewed and updated as needed.

Without strong governance and oversight from the top, risk management systems can become processes on paper rather than lived practices that actually protect participants and workers (NDIS Commission 2024; NDIS Commission 2026a; NDIS Commission 2026b).

The Risk Management Process

There are four steps in the risk management process:

1. Identify hazards
2. Assess risks
3. Control risks
4. Review control measures

(Safe Work Australia 2024)

This process is useful for identifying and managing work health and safety hazards. In NDIS service delivery, it should be applied alongside participant-centred risk assessment, support planning, organisational risk management processes and the participant's right to choice and dignity of risk (NDIS Commission 2024).

1. Identify Hazards

A hazard is something that has the potential to cause harm. Risk considers the likelihood that harm will occur and how serious the consequences could be (Safe Work Australia 2024).

Risks in NDIS service delivery can arise in many different areas. They can affect the participant, the worker, the delivery of supports or the provider as an organisation.

Examples include:

• Hazardous manual tasks
• Occupational violence and aggression
• Slips, trips, and falls
• Participant dissatisfaction or complaints that may indicate problems with service quality or safety
• Loss of government funding or changes to financial or funding affecting service sustainability or continuity
• Equipment (e.g., wheelchairs or lifting hoists)
• Inadequate allocation of human, physical, financial, or other resources
• Failure to comply with legislation
• Confidentiality breaches
• Service disruption or closure
• Lack of staff
• Lack of or poor work health and safety training
• Driving-related hazards
• Hazards in the home, such as a lack of handrails and poorly designed areas.

(Jepsen et al. 2025; WorkSafe Victoria 2022)

2. Assess Risks

Once a hazard has been identified, the next step is to conduct a risk assessment. This will help you determine the overall severity of the risk, whether existing control measures are effective, whether you need to take any further action, and how urgently any further action should be taken (NSW Treasury 2025; Safe Work Australia 2024).

A support worker may identify a new or changing risk without being responsible for completing the provider's formal risk assessment. Workers should follow their organisation's procedures for reporting and escalating identified risks and work within their role, training and competence.

Ask the following three questions:

1. How severe would the potential harm be?

• What harm could occur as a result of the hazard? (e.g., injury, illness, death)
• Are there any other factors that could influence the severity of potential harm? (e.g., the distance of a fall)
• How many people could be harmed?
• Are there any situations that could increase the severity of an accident?
• Are there individual circumstances or support needs that could affect the consequence for the participant?

2. How could harm occur?

• What sequence of events could lead to harm occurring?
• Can one or more of the events in the sequence be stopped or changed?
• What controls or strategies are already documented in the participant's support plan?

3. What is the likelihood of harm occurring?

• Is it certain, very likely, likely, unlikely, or rare?
• How often does the hazard have the potential to cause harm?
• How effective are current control measures (if any) in reducing the risk?
• Could differences in operating conditions increase the risk?
• Does the working environment increase the risk?
• If harm occurs, how long would people be exposed to it?
• Could actions, communication, environmental conditions or changes in support affect the likelihood of harm?
• Are there individual circumstances, health needs, support needs or environmental factors that affect the likelihood of harm?

(NSW Treasury 2025; Safe Work Australia 2024)

Note: When assessing a risk involving a participant, consider both the potential for harm and the participant's goals, preferences and choices. Risk assessment should inform how a participant can be safely supported; it should not automatically result in the removal of an activity or the restriction of the participant's choices.

3. Control Risks

The next step is to determine appropriate strategies for managing the identified risk. Generally, for work health and safety risks, the most effective approach is to eliminate the hazard where practicable. However, where elimination is not reasonably practicable, the risk should be minimised using appropriate measures (Safe Work Australia 2024).

When managing risks associated with a participant's supports, choices, or activities, the aim is not necessarily to eliminate the activity. Risk-management strategies should be developed with the participant and should support their rights, preferences, independence and dignity of risk while reducing the likelihood or consequence of harm.

For example, a worker may need to assist a participant with a transfer. The need for physical assistance cannot necessarily be eliminated, but the risks associated with the task can be reduced, for example, through assessment, equipment, environmental controls, worker training, and adherence to the support plan. In these cases, the next best option is to minimise the risk as much as reasonably practicable (Safe Work Australia 2024).

The process of determining appropriate control measures involves the following:

1. Identifying the appropriate options for control measures
2. Deciding the option(s) most suitable for eliminating or reducing the risk effectively
3. Implementing the chosen control measure(s).

(NSW Treasury 2025; Safe Work Australia 2024)

The Hierarchy of Control Measures

The hierarchy of control measures ranks ways of controlling work health and safety risks from the highest level of protection and reliability to the lowest. You should always aim for elimination, as it offers the highest level of protection and is most effective in reducing the risk of harm. However, if elimination is not feasible, you should work your way down the hierarchy until you find the next best option (Safe Work Australia 2024).

Keep in mind that the lower levels of the hierarchy, such as administrative controls and PPE, are generally less reliable. This is because they do not remove the hazard at its source and instead rely more heavily on people to consistently follow procedures (Safe Work Australia 2024).

In NDIS service delivery, the hierarchy is particularly useful for managing environmental, equipment and work health safety hazards. When a risk is associated with a participant's choices, goals, or everyday activities, risk management should also consider the participant's preferences, independence, and the dignity of risk. Risk should not automatically be managed by removing the activity or restricting the participant's choice.

Elimination

Elimination involves completely removing the hazard and its associated risks. This can be achieved through:

• Not introducing the hazard in the first place
• Removing the hazard (e.g. disposing of a hazardous object, removing faulty or unsafe equipment from use until it's repaired or replaced).

(Safe Work Australia 2024)

Substitution, Isolation or Engineering Controls

The next best option is to either:

• Substitute the hazard with a safer alternative
• Physically isolate the hazard from people
• Implement an engineering control (a mechanical device or process) to reduce risk (e.g., a trolley for moving heavy objects).

Any alternative equipment or support method used with an NDIS participant must be appropriate for that participant and used within the worker's role, training and competence (Safe Work Australia 2024; NDIS Commission 2026).

Administrative Controls

Administrative controls are work methods or procedures that aim to minimise exposure to the hazard and provide appropriate information, training, and instruction to staff (Safe Work Australia 2024). Examples may include policies and procedures, staff training, escalation processes, support plans, warning signs and supervision.

Personal Protective Equipment (PPE)

PPE may be used to reduce any remaining exposure to a hazard where appropriate. Because PPE does not eliminate the hazard and relies on correct selection and use, it is generally considered a lower-order control (Safe Work Australia 2024).

4. Review Control Measures

The final stage of the risk management process is to regularly check that control measures are working effectively. Control measures should be reviewed:

• When they are not working effectively
• Before changes that may cause new or different risks to arise
• When new hazards or risks emerge
• When a review is indicated or requested.

Where risk management strategies relate to a participant, the review should occur with the participant and consider whether the strategies remain effective, appropriate, and consistent with their current needs, preferences, and goals. Changes in the participant's needs or circumstances may also require their support plan and risk assessment to be reviewed (NDIS Commission 2024).

Workers should report new risks, changes or controls that are not working through their provider's reporting and escalation processes (Safe Work Australia 2024).

The Risk Management Process in Practice

Scenario: Shelley is an NDIS support worker for Tim, who uses a walking frame. When Shelley arrives at Tim's home this morning, she realises that one of the wheels on Tim's walking frame isn't working properly.

1. Identify Hazard

In this case, the hazard is the faulty wheel on Tim's walking frame.

2. Assess Risk

In order to assess the risk, Shelley now needs to ask the following questions:

3. Control Risk

Using the hierarchy of control, Shelley should now determine her options for helping manage this risk.

4. Review Control Measures

Shelley should ensure that the faulty frame is no longer used, report the issue, and confirm that Tim has a safe interim plan. Any alternative mobility or transfer method must be appropriate for Tim and within Shelley's training and competence, in accordance with her provider's policies and procedures.

If Tim's needs cannot be safely met, Shelley should escalate the issue. The provider should review whether Tim's risk assessment or support plan needs updating and confirm that the repair or replacement has resolved the risk.

Conclusion

Effective risk management is an ongoing part of safe, quality NDIS service delivery. It involves managing hazards and organisational risks while respecting each participant's choices, goals and dignity of risk. Support workers play an important role by recognising and reporting risks and following agreed support strategies, while providers and managers are responsible for ensuring that appropriate systems, resources, oversight, and review are in place.

For more information, consult the NDIS Practice Standards and the NDIS Code of Conduct.