Guides

Registers

What registers does a small NDIS provider need to maintain?

For small providers building an incident, complaint, risk and worker control system.

Short answer: Start with three registers: incidents, complaints and risk. Link them to your worker records and one evidence index. Give every record an owner, a review date, a closeout status and a link to the evidence. See the source.

The fields below are our way to make records usable. Check what you need against your scope, the standards and any auditor request.

Start with five records

Your incident register holds the event ID, date, service or site and the action you took. Add the escalation or notification question, owner, status, review date, closeout and learning. Keep descriptions to the minimum needed.

Your complaint register holds the complaint ID, date received, channel, issue, owner, acknowledgement, response, escalation, investigation, outcome, closeout and any improvement. Never use "closed" instead of saying what you did.

Your risk register holds the risk, the part of the service it affects, current controls, rating method, owner, treatment action, due date, review date and status.

Your worker matrix holds screening, expiry dates, induction, training, competency and supervision for each worker.

Your evidence index holds file IDs, title, owner, date, version, handling limits, location and the policy or control each file shows.

Make a spreadsheet usable

A spreadsheet works fine. Here is the test. Can someone see who owns an open item, what the review date is, and what was escalated and why? Is the closeout backed by a record, and can they tell which register is current?

Email notes and informal records are useful raw material. Move them into a controlled register only when you can keep the original facts, source, date and owner. Do not rewrite history to make a new register look tidy.

What to set up this week

1. Give each register one owner and one backup.
2. Write the fields before you fill in records. Include status, due date, review date and closeout.
3. Set a review schedule that fits your week. Record the review even when nothing new came in.
4. Link each register to its policy and to your evidence index. Name files clearly and note handling limits.
5. Test one redacted example from start to closeout. Where a field is missing, record that. Do not invent it.

Common mistakes

• Keeping incidents, complaints and risks in one list with no separate fields.
• Leaving an open action or risk with no owner, due date or next review.
• Using an empty template as proof that you have run the control.

Sources

• NDIS Quality and Safeguards Commission, Core module: provider governance and operational management, checked 8 September 2026. This covers risk management, information management, incident management, complaints management and human resource management; the record fields above are Clearharbour practical guidance.