Chapter 10: Compliance & Incident Management

10.1 Compliance Module Overview

The Compliance module is accessed via the Compliance item in the main sidebar navigation. The module is organised into a tabbed interface with three primary views: Incidents, Audits, and Reports. Each tab provides access to specialised functionality for managing that aspect of the organisation's compliance program.

Compliance Hub Layout

Summary Metric Cards

Access Permissions

10.2 Incident Reporting

Incident reporting is the cornerstone of the Compliance module. Every staff member in NDSS CRM has the ability to report an incident, and the organisation should foster a culture where incident reporting is encouraged rather than punitive. The incident report form captures all necessary details for initial assessment, investigation, and regulatory reporting. The form is designed to be comprehensive while remaining accessible to frontline support workers who may need to file reports quickly.

Incident Report Form

Incident Type Definitions

10.3 Incident Severity Classification

Every incident is classified with a severity level that determines the urgency of response, notification requirements, and investigation depth. The severity classification drives the escalation workflow and ensures that critical incidents receive immediate executive attention while minor incidents are managed through standard processes.

Severity Level Matrix

Severity Auto-Detection

NDSS CRM provides preliminary severity suggestions based on the incident type selected. However, the reporting staff member can override the suggested severity. The following rules apply:

• Death incidents are always pre-set to Critical severity and cannot be downgraded.
• Abuse / Neglect / Violence incidents default to Major severity with an option to escalate to Critical.
• Unauthorised Restrictive Practice defaults to Major severity.
• Medication Error defaults to Moderate but can be escalated based on impact.
• Near Miss defaults to Minor but can be escalated if the potential consequence was significant.
• When a severity is manually changed from the system suggestion, the reason for the change is recorded in the incident audit trail.

10.4 Incident Status Workflow

Every incident follows a defined workflow from initial report through to closure. The workflow ensures that incidents are properly triaged, investigated, resolved, and reviewed before being marked as complete. The workflow also includes escalation procedures for incidents that are not progressing within expected timeframes.

Status Flow Diagram

Status Transition Rules

Escalation Procedures

NDSS CRM automatically monitors incident progress and triggers escalation notifications when incidents are not progressing within expected timeframes:

10.5 Incident Investigation

For incidents classified as Moderate, Major, or Critical, a formal investigation process is required. The investigation module within NDSS CRM provides structured tools for conducting thorough investigations, documenting root causes, and developing corrective action plans. The investigation record becomes part of the permanent incident file and is available for audit purposes.

Investigation Procedures

1. Investigation Initiation - A Compliance Officer or Manager assigns an investigator and creates an investigation plan. The plan includes scope, methodology, timeline, and resources required.
2. Evidence Collection - The investigator gathers all relevant evidence including:
   • Statements from the reporter, people involved, and witnesses
   • Review of relevant documentation (care plans, risk assessments, incident history)
   • Photographs or physical evidence
   • CCTV footage review (if applicable and authorised)
   • Relevant policies and procedures
   • Training records for staff involved
3. Root Cause Analysis - The investigator conducts a root cause analysis using one or more of the following methodologies:
   • 5 Whys Analysis - Iteratively asking "why" to drill down to the fundamental cause
   • Fishbone (Ishikawa) Diagram - Categorising potential causes across People, Process, Environment, Equipment, Materials, and Management
   • Contributing Factors Analysis - Identifying all factors that contributed to the incident, even if not the direct cause
4. Findings and Recommendations - The investigator documents findings, identifies root causes and contributing factors, and recommends corrective and preventive actions.
5. Investigation Report - A formal investigation report is prepared and attached to the incident record. The report template includes sections for: Executive Summary, Background, Methodology, Findings, Root Cause Analysis, Recommendations, and Appendices.

Corrective Action Plan

10.6 Audit Management

The Audit Management function within NDSS CRM supports the scheduling, execution, and tracking of internal and external audits. Regular auditing is a cornerstone of the NDIS Quality and Safeguards Framework, and NDSS CRM provides the tools to manage the full audit lifecycle from planning through to findings resolution.

Audit Types

Audit Dashboard

Audit Checklists

NDSS CRM includes configurable audit checklists that can be customised for each audit type. Checklists are organised by NDIS Practice Standard area:

• Rights and Responsibilities - Participant rights documentation, complaints process accessibility, advocacy access
• Governance and Operational Management - Organisational governance, risk management, quality management, information management
• Provision of Supports - Service agreements, support plans, transitions, safe environments
• Support Provision Environment - Safe environment, participant money and property, medication management
• Verification Module Standards - Human resource management, continuity of supports, emergency and disaster management

10.7 Compliance Reports

The Reports tab within the Compliance module provides access to a range of pre-built compliance reports and dashboards. These reports are designed to give the Compliance Officer and executive team visibility into the organisation's compliance posture, incident trends, and audit findings.

Available Reports

10.8 NDIS Quality & Safeguards

NDSS CRM is built with the NDIS Quality and Safeguards Framework at its core. This section outlines how the platform supports compliance with the NDIS Practice Standards and the reporting obligations to the NDIS Quality and Safeguards Commission.

NDIS Practice Standards Coverage

Reportable Incident Requirements

Under the NDIS (Incident Management and Reportable Incidents) Rules, the following incidents must be reported to the NDIS Commission:

• Death of a participant
• Serious injury of a participant
• Abuse or neglect of a participant (including alleged)
• Unlawful sexual or physical contact with, or assault of, a participant
• Sexual misconduct committed against, or in the presence of, a participant
• Unauthorised use of a restrictive practice in relation to a participant

NDSS CRM automatically identifies potentially reportable incidents based on the incident type and severity classification. When a reportable incident is detected, the system displays a prominent banner reminding the user of the reporting obligation and timeframes. The Compliance Officer receives an immediate notification.

10.9 Risk Management

The Risk Management function in NDSS CRM provides a centralised risk register for identifying, assessing, mitigating, and monitoring organisational risks. The risk register is a living document that should be reviewed regularly and updated as new risks emerge or existing risks change in nature or likelihood.

Risk Assessment Matrix

Risk Register Fields

10.10 Document Compliance

Document compliance ensures that all organisational policies, procedures, and critical documents are current, reviewed on schedule, and acknowledged by relevant staff. NDSS CRM provides a document management system within the Compliance module that tracks document lifecycle from creation through review, approval, distribution, and staff acknowledgment.

Policy Management

• Document Register - A central register of all policies and procedures with version history, approval status, and next review date.
• Version Control - Every document maintains a version history. When a document is updated, the previous version is archived (not deleted) and the new version is published. Staff are notified of updates to documents relevant to their role.
• Review Scheduling - Each document has a review cycle (typically annual). The system generates review reminders 30 days before the review due date. Overdue reviews are flagged on the Compliance Hub.
• Approval Workflow - New and updated documents require approval before publication. The approval workflow routes the document to the designated approver (typically the Compliance Officer or a Director) for review and sign-off.

Staff Acknowledgment Tracking

When a policy or procedure is published or updated, NDSS CRM can require staff to acknowledge that they have read and understood the document. The acknowledgment system provides:

• Targeted Distribution - Documents can be distributed to all staff or to specific roles/teams. Only staff in the distribution group are required to acknowledge.
• Acknowledgment Record - Each acknowledgment is time-stamped and recorded against the staff member's profile. This creates an auditable record of staff awareness.
• Reminder Notifications - Staff who have not acknowledged within the specified timeframe (default: 14 days) receive reminder notifications. Persistent non-acknowledgment is escalated to the staff member's manager.
• Compliance Dashboard - The document compliance dashboard shows acknowledgment rates per document, overdue acknowledgments, and staff compliance percentages.