The Dual Reporting Trap

A support worker is assaulted by a resident in an aged care facility on a Friday afternoon. By Monday morning, the provider needs to have notified two separate regulators, potentially more, under two different legal frameworks, on two different timeframes, with different content requirements, through two different portals.

Miss one, and the failure to notify is a standalone criminal or civil offence with its own penalty structure. Miss both, and the penalties stack. And neither regulator is satisfied by the other's notification, each requires its own submission, on its own form, assessed under its own framework.

This is the dual reporting trap. It catches providers in aged care, disability services, early childhood education and care, and community and allied health, organisations that are simultaneously subject to the general WHS framework and a sector-specific regulatory regime. For these providers, a single incident can simultaneously trigger obligations to the WHS regulator and to the sector regulator, with different definitions of what must be reported, different timeframes for reporting it, different content requirements, different record retention obligations, and different penalty consequences if either obligation is missed.

Most providers know about one of these frameworks. The compliance risk is in not knowing, or not acting on, both at once.

• 4 sectors: Most commonly caught in the dual reporting trap: aged care (SIRS), NDIS, early childhood education and care (NQF), and community/allied health, each with sector obligations running parallel to WHS
• 2 penalties: A failure to notify can produce two separate penalty consequences, one from the WHS regulator, one from the sector regulator, for the same underlying incident, with neither discharge satisfying the other

Why the Two Frameworks Don't Talk to Each Other

The WHS framework and each sector regulatory framework exist for different purposes, were established under different legislation, and are administered by different regulators with different mandates. They were not designed to interact. The fact that a single event can trigger both simultaneously is a consequence of how the regulatory landscape has evolved, not a deliberate coordination mechanism.

The WHS framework is administered by state and territory WHS regulators (SafeWork NSW, WorkSafe Victoria, SafeWork SA, and equivalents). Its primary concern is the health, safety and welfare of workers, and, more broadly, persons affected by the conduct of a business. The December 2025 model amendments will extend notification obligations significantly once each jurisdiction adopts them (as covered in Blog 29 of this series), but the framework's focus remains on whether the organisation's safety systems protected people from harm.

Sector regulatory frameworks are administered by Commonwealth agencies in most cases, the Aged Care Quality and Safety Commission (ACQSC) for aged care, the NDIS Quality and Safeguards Commission for disability services, and state/territory educational authorities through ACECQA for early childhood education. Their focus is on the quality of care and support delivered to clients, consumers, and children, not the safety of workers. An incident that triggers one framework may or may not trigger the other, depending on who was harmed, where, and by whom.

The result is a compliance matrix that most providers have never fully mapped: which incidents trigger WHS notification only, which trigger sector notification only, which trigger both, and which trigger neither, but must still be recorded internally.

Getting this wrong is not merely a technical compliance failure. Regulators have made clear that notification failures in regulated industries are treated with heightened seriousness precisely because the populations being served, older Australians, people with disability, young children, are among the most vulnerable in the community. The regulatory expectation is not just that incidents are reported: it is that providers understand exactly what to report, to whom, and by when.

Neither regulator is satisfied by the other's notification. Each requires its own submission, on its own form, assessed under its own framework. Miss one and the failure is its own standalone offence.

The Four Sectors Most Commonly Caught in the Trap, and What Each Requires

Each of the four sectors below has a distinct sector notification framework that runs in parallel with WHS obligations. The following maps the key reporting requirements and how they intersect with the WHS obligation, noting where the December 2025 model WHS amendments will change them once adopted.

Sector 1: Aged Care, SIRS and the New Aged Care Act 2024

The Serious Incident Response Scheme (SIRS) is the aged care sector's mandatory incident notification framework. As of 1 November 2025, it operates under the new Aged Care Act 2024 (Cth) and the Aged Care Rules 2025, replacing the predecessor framework under the Aged Care Act 1997.

SIRS applies to all approved aged care providers delivering residential care, home care, flexible care, and (from December 2022) home services. It is administered by the Aged Care Quality and Safety Commission (ACQSC). Under SIRS, all reportable incidents must be classified as either Priority 1 (requiring notification within 24 hours of the provider becoming aware) or Priority 2 (requiring notification within 30 days). The ACQSC receives notifications through the My Aged Care provider portal.

Priority 1 incidents include any incident where there are reasonable grounds to report to police, as well as the most serious categories of harm: unreasonable use of force resulting in serious injury or death; sexual assault or suspected sexual assault; unlawful sexual contact; assault causing serious injury; death where there are reasonable grounds to believe it may not be from natural causes; and unexpected or unexplained serious injury. Priority 2 incidents cover the remaining categories of harm including medication errors, unexplained deterioration, emotional or psychological abuse, neglect, and financial abuse.

Notification to the ACQSC under SIRS does not discharge the obligation to notify the WHS regulator. Where the same incident also constitutes a notifiable incident under the model WHS Act, for example, a worker assaulted by a resident (a notifiable “violent incident” once your jurisdiction adopts the December 2025 model amendments), or a death or serious injury, both notifications must be made. The ACQSC receives information about the incident as a care quality matter; the WHS regulator receives information about it as a worker safety matter. Both regulators may investigate. Both may take enforcement action.

Under the Aged Care Act 2024, civil penalties for responsible persons (officers) failing to exercise due diligence in ensuring SIRS compliance reach 500 penalty units (currently $165,000) where the conduct results in death, serious injury or illness. For providers, penalties for systematic failure can reach $82,500 per contravention (250 penalty units) with significant additional consequences including suspension, revocation of registration, and banning orders for individuals.

Sector 2: NDIS, Registered Providers and the NDIS Commission

Registered NDIS providers must notify the NDIS Quality and Safeguards Commission of all reportable incidents connected to the delivery of NDIS supports or services. This obligation applies to incidents involving participants, people with disability receiving NDIS-funded support, not to incidents involving workers alone. An incident where a worker is harmed by a participant is reportable to the NDIS Commission only if the worker's harm creates risk or harm to the participant; worker-only harm is a WHS matter.

Reportable incidents under the NDIS framework include: death of a participant; serious injury of a participant; abuse or neglect of a participant; unlawful sexual or physical contact with a participant; sexual misconduct against or in the presence of a participant (including grooming); and unauthorised use of restrictive practices. Most categories require notification to the NDIS Commission within 24 hours of key personnel becoming aware. The single exception is unauthorised use of restrictive practices not resulting in harm, which must be notified within 5 business days.

Following the 24-hour notification, a detailed 5-day report must be submitted through the NDIS Commission Portal. The Commission may require a final report at a later date. Internal records must be retained for a minimum of 7 years.

For providers who deliver both NDIS services and aged care services, a common configuration for larger disability providers as the sector ages, a single incident involving a participant who is also an aged care consumer may trigger obligations under both SIRS and the NDIS framework simultaneously, in addition to any WHS notification obligation. The frameworks have different definitions, different portals, different timeframes, and different content requirements. There is no coordinated single-entry mechanism.

The NDIS Amendment (Integrity and Safeguarding) Act 2026, introduced as a Bill in November 2025 and since passed, significantly expands NDIS Commission powers, including new criminal offences carrying up to five years’ imprisonment, broader banning powers, and civil penalties for providers of more than $15 million where a participant is hurt or injured under the provider’s care.

Sector 3: Early Childhood Education and Care, National Quality Framework

Approved providers under the Education and Care Services National Law (National Law) are subject to notification obligations administered by state and territory regulatory authorities, overseen nationally by ACECQA. These obligations sit entirely separately from WHS requirements.

Under the National Law and National Regulations, approved providers must notify their regulatory authority within 24 hours of becoming aware of: the death of a child while at the service; any serious injury or trauma to a child requiring or reasonably requiring urgent medical attention; any serious illness of a child requiring hospital attendance; any emergency for which emergency services attended; a child appearing to be missing; a child being taken from the service in contravention of the National Regulations; and a child being mistakenly locked in or out of the service premises.

From 1 September 2025, the notification timeframe for allegations or incidents of physical or sexual abuse to a child while at the service was reduced from 7 days to 24 hours, a significant tightening that many services operating on the old timeline are now out of compliance with.

Incident, injury, trauma and illness records for children must be kept until the child is 25 years old, a retention period substantially longer than the 5-year WHS minimum, and one that creates specific obligations around records management as services change ownership, close, or restructure.

Where a worker at an early childhood service is injured, whether by a child, a parent, a colleague, or a workplace condition, the WHS notification obligation applies to the WHS regulator, not ACECQA. Where the incident involves a child's wellbeing, ACECQA and the state regulatory authority must be notified. Where the incident involves both, for example, a child harmed and a worker also harmed in the same event, both sets of notifications are required simultaneously.

Sector 4: Community and Allied Health, A More Complex Landscape

Health service organisations face the most fragmented notification landscape of any sector. Depending on the nature of the organisation, its registration status, and the type of incident, a single event may engage WHS obligations, obligations under state health legislation, obligations to the Australian Health Practitioner Regulation Agency (AHPRA) where a registered health practitioner is involved, and potentially obligations to the relevant state health department or quality and safety commission.

AHPRA requires notifications where a registered health practitioner has behaved in a way that constitutes notifiable conduct, including practising while impaired, sexual misconduct with a patient, placing patients at serious risk due to intoxication or significant deviation from professional standards. Mandatory notifications to AHPRA come from both employers and fellow practitioners. These notifications are separate from any WHS or sector regulatory obligation, arise under the Health Practitioner Regulation National Law, and operate on their own timeframes and requirements.

State health quality and safety frameworks add further layers. In NSW, for example, serious adverse patient events are reportable to the Clinical Excellence Commission through the incident information management system. In Victoria, sentinel events must be reported to the Department of Health. In most jurisdictions, healthcare providers also operate under accreditation frameworks (the National Safety and Quality Health Service Standards, administered by the Australian Commission on Safety and Quality in Health Care) that require internal incident management systems meeting specific standards.

For a community health organisation that is also an NDIS provider, a common configuration, the landscape compounds: WHS notification to the state WHS regulator, NDIS Commission notification for participant-related incidents, AHPRA notification where a practitioner is involved, and potentially state health department notification. Each framework has its own clock running from when key personnel become aware.

The Dual Reporting Matrix: What Triggers What, to Whom, and When

The table below maps the key notification triggers, regulators, and timeframes for the four main regulated sectors. WHS notification obligations (to the state/territory WHS regulator) run in addition to all sector-specific obligations shown.

The Three Most Common Dual Reporting Failures, and Their Consequences

Failure Mode 1: Notifying one regulator and assuming the obligation is met

The most common failure is the cleanest to describe: the provider notifies the ACQSC under SIRS, records the notification, and considers the matter handled, without separately notifying the WHS regulator for the worker harm dimension of the same event. Or the inverse: the WHS regulator is notified of a worker injury, and the provider assumes this discharges the obligation to the NDIS Commission for the participant-safety dimension.

Neither discharge works. The WHS regulator is not a party to SIRS. The NDIS Commission does not receive copies of WHS notifications. Each regulator assesses its own notification obligation independently. A provider with a clean SIRS record but no WHS notification for a violent incident involving a worker is simultaneously compliant with one framework and in breach of another. The WHS notification failure does not become less serious because the SIRS notification was made.

The practical consequence is that providers can accumulate WHS notification failures that are entirely invisible to their sector compliance function, and vice versa. Because the two compliance streams are often managed by different people (a quality and compliance manager for SIRS/NDIS; an HR manager or operations manager for WHS), incidents that clearly trigger both may be handled by one stream without the other stream being activated.

Failure Mode 2: Different timeframes running simultaneously on the same event

A residential aged care facility becomes aware of a serious assault on a resident by a staff member at 3pm on a Thursday, and the resident is admitted to hospital. The SIRS Priority 1 clock has started: notification to the ACQSC is due by 3pm Friday. The WHS notification clock has also started: notification to the state WHS regulator is due immediately, not by end of business, not by the following day, but now. There is no overlap between these obligations. Both must be met. Both are running at the same time.

The 24-hour NDIS clock and the 'immediately' WHS clock are the most common collision point. A provider that has trained its team on the NDIS 24-hour rule may interpret this as the universal reporting window, and notify the WHS regulator 18 hours after the event, believing this to be timely. For the NDIS notification, 18 hours is timely. For the WHS notification, 18 hours is a late notification that is itself an offence.

The fix is not a single reporting timeframe. It is a decision framework that, at the moment an incident occurs, runs through both sets of obligations simultaneously and identifies the most restrictive applicable timeframe, then acts on that first.

Failure Mode 3: Managing the incident through workers' compensation without activating either notification

A care worker at a home care service develops a significant psychological injury attributable to cumulative trauma from client behaviour. The injury progresses to a workers' compensation claim. The employer's response is channelled entirely through the workers' comp insurer: medical management, return to work planning, claim documentation. No WHS notification is made. No sector notification is considered.

Under the December 2025 model WHS amendments, once adopted in your jurisdiction, a worker absent 15 or more consecutive days, where the absence is reasonably attributable to physical or psychological injury or illness arising from the conduct of the business, will trigger a notifiable extended absence obligation to the WHS regulator within 14 days. Workers' compensation case management does not substitute for this. The WHS regulator does not receive copies of workers' comp claims.

In aged care and NDIS settings, where the line between worker harm and client harm is often thin, a burned-out, traumatised, or unwell worker may present elevated risk to the people they care for, the failure to activate WHS notification for worker harm can also be the event that precipitates a care quality incident that then triggers a sector notification. The two frameworks are not only parallel: in regulated care settings, they are often causally connected.

The 'One System to Rule Them All' Trap

Many providers in regulated industries have built their incident management systems around their sector regulatory framework, SIRS, the NDIS practice standards, or the NQF, because that is where the most immediate compliance scrutiny has historically come from. The result is an internal system that captures and routes care-related incidents well, but does not activate the WHS notification pathway for worker harm events. Following the December 2025 model WHS amendments, which materially expanded what worker harm events are notifiable, providers whose systems were built around sector frameworks alone now have a structural WHS compliance gap that audits will find.

A Single Incident, Mapped Across All Obligations

The following scenario illustrates how a single event triggers multiple simultaneous obligations, each running on its own clock, to a different regulator, with different content.

The scenario: At a residential aged care facility run by a provider that is also a registered NDIS provider, a resident with a documented history of aggressive behaviour assaults another resident in a shared lounge at 7pm on a Wednesday. A support worker who intervenes is struck and admitted to hospital with a fractured wrist. The injured resident is both an aged care consumer and an NDIS participant.

Notifications triggered, all running simultaneously from 7pm Wednesday

WHS regulator (state/territory)

• Trigger: Serious injury, the worker is admitted to hospital as an in-patient, which is a notifiable serious injury under current WHS law. Once your jurisdiction adopts the December 2025 model amendments, the assault will also be a notifiable “violent incident” in its own right.
• Timeframe: Immediately, not after end of shift, not after management is informed, but as soon as person responsible for notification becomes aware
• Content: Nature of incident, persons involved, location, immediate response taken
• Portal: State/territory WHS regulator phone line (then written if requested)
• Note: WHS notification covers any person harmed by the conduct of the business, not only workers, so the assault on the resident is also notifiable to the WHS regulator if it results in death or hospital admission

ACQSC via My Aged Care portal (SIRS)

• Trigger: Priority 1 reportable incident, unreasonable use of force against a consumer (here, by another resident) that caused injury, or where there are reasonable grounds to report to police
• Timeframe: Within 24 hours of provider key personnel becoming aware, by 7pm Thursday
• Content: SIRS Priority 1 notification via My Aged Care portal, incident details, actions taken, persons involved
• Note: Does not discharge WHS obligation. Both must be made.

Additional obligations for the same incident

NDIS Quality and Safeguards Commission

• Trigger: The injured resident is an NDIS participant, assault of a person with disability in connection with the delivery of NDIS supports
• Timeframe: Within 24 hours of key personnel becoming aware
• Content: Immediate Notification Form via NDIS Commission Portal, then 5-day detailed report
• Note: Separate from SIRS. Two separate portal submissions. Different forms. Different case references.

Internal obligations (not external notification)

• Contemporaneous incident report completed as soon as practicable
• Site and evidence preservation activated immediately, CCTV secured, witnesses recorded
• Root cause investigation commenced
• Return-to-work planning initiated for the injured worker
• Worker consented to trauma/psychological support offered
• Board/officer-level WHS reporting updated

This single incident has generated at minimum three simultaneous external notification obligations, to the WHS regulator (immediately), the ACQSC (within 24 hours), and the NDIS Commission (within 24 hours), and a full set of internal documentation obligations running alongside all of them. The compliance function managing this event must run all three external processes in parallel, not sequentially. And once your jurisdiction adopts the December 2025 model amendments, a worker absence of 15 or more consecutive days will add a fourth obligation, a notifiable extended absence notification to the WHS regulator within 14 days.

• 3+: Separate regulators a single care sector incident can simultaneously require notification to, WHS regulator, ACQSC, NDIS Commission, each with its own portal, form, and timeframe
• 24 hrs: The effective master timeframe in most regulated sector incidents, the most restrictive applicable window across WHS ('immediately') and sector frameworks (24 hours for most categories)
• 7 yrs: NDIS minimum record retention period, longer than the WHS 5-year minimum, but shorter than the NQF requirement to keep child incident records until the child turns 25, meaning providers must track which retention period governs each record

Building a Compliance System That Handles Both Frameworks, Simultaneously

The providers that manage dual reporting obligations well share one structural feature: their incident management system does not sort incidents before activating the notification pathway. It activates the notification pathway first, and sorts afterwards.

The sorting problem, assessing whether an incident is a WHS matter, a SIRS matter, an NDIS matter, or all three, is a natural management instinct. It feels like due diligence. In the compliance context, it is a trap. While the incident is being assessed, the clocks are running. A notification that takes 26 hours because the team spent four hours determining which framework applied has still missed the WHS 'immediately' window and may have missed the NDIS 24-hour window.

The operational principle for regulated sector providers is: act on the most restrictive applicable timeframe first, then sort. In practice, this means the default response to any incident involving harm, to a worker or to a client, is to activate WHS notification (immediately) and sector notification (within 24 hours) simultaneously, and to let the subsequent investigation determine whether both were strictly required. A notification that turns out to be unnecessary carries no penalty. A notification that should have been made and wasn't carries criminal or civil liability.

The Four Structural Requirements for a Dual-Framework Incident System

• A single incident triage standard that asks, at the moment of awareness, two questions simultaneously: (1) does this involve worker harm or near-miss? (WHS) and (2) does this involve client/consumer/participant/child harm or risk? (sector framework). Both can be true. Both can require action. The assessment does not need to be sequential.
• Designated notification responsibility for both frameworks, the person responsible for WHS notification and the person responsible for sector notification must be identified, must know they carry that responsibility, and must be able to act without waiting for management sign-off. In small organisations these may be the same person. In larger organisations they are often in different teams. Either way, the activation must be simultaneous.
• A dual-framework incident record that captures the information required by both notification systems, incident date/time/location, persons involved, nature of harm or risk, immediate response, notification made, in a single contemporaneous record that can generate submissions to both portals without duplication or inconsistency.
• Retention policy mapped to the most restrictive applicable period. NDIS records: 7 years minimum. NQF child records: until the child is 25. WHS notifiable incident records: 5 years. Where multiple frameworks apply to the same incident, the most restrictive retention period governs the whole record.

The Foundation Layer: Making Sure Incidents Surface in the First Place

Dual reporting compliance assumes that incidents reach the people with notification responsibility before the clock expires. In regulated care settings, that assumption is frequently wrong.

Aged care workers, disability support workers, early childhood educators, and healthcare workers often work in settings where reporting incidents to management feels unsafe, where the path to reporting is unclear, or where the culture implicitly discourages disclosure of worker harm. A support worker who does not feel safe reporting an assault, because they fear blame, because they worry about the resident's outcomes, because previous reports went nowhere, is a worker whose experience does not enter the notification system at all. The regulator sees a clean incident register. The ACQSC sees a clean SIRS record. The NDIS Commission sees nothing. All three frameworks are technically compliant. None of them reflect what is actually happening.

The reporting channel is not a back-office compliance tool. In regulated industries, where the dual reporting obligation can trigger enforcement action by multiple regulators simultaneously, the integrity of the entire compliance architecture depends on whether workers feel safe enough to report incidents when they occur. A confidential, accessible, out-of-hours reporting mechanism that workers actually trust is not a supplement to the notification system. It is what makes the notification system real.

For compliance officers and quality managers navigating dual reporting obligations: the sophistication of your notification system matters less than the reliability of your reporting culture. A business with a complex dual-framework incident management system and a workforce that doesn't report is not compliant. It is legally exposed and unaware.

Act on the most restrictive applicable timeframe first, then sort. In regulated care settings, the default response to any incident involving harm, to a worker or to a client, is to activate both WHS and sector notifications simultaneously.

The Bottom Line for Regulated Sector Providers

The dual reporting trap is not a theoretical compliance risk. It is a daily operational reality for every approved aged care provider, registered NDIS provider, NQF-approved childcare service, and community health organisation in Australia. The December 2025 model WHS amendments will expand the WHS notification obligation to include violent incidents, notifiable extended absences, and notifiable suicides, events that are common in care settings and that were not previously notifiable under WHS, as each jurisdiction adopts them. The Aged Care Act 2024 commenced on 1 November 2025, introducing a strengthened SIRS framework. The NQF abuse notification timeframe tightened to 24 hours from 1 September 2025.

All of these changes were made within the same few months. Providers that have not reviewed their incident notification systems against all applicable frameworks since August 2025 are operating with outdated systems against a materially changed regulatory landscape, and should track when their own jurisdiction adopts the model WHS amendments.

The compliance question for every regulated sector provider is not which framework to prioritise. It is how to build a system that handles both, simultaneously, accurately, and on the most restrictive applicable timeframe, every time.

Dual Reporting Compliance Self-Assessment for Regulated Sector Providers

• Does your incident management system ask, at the point of incident awareness, both whether the incident triggers WHS notification AND whether it triggers sector notification? Or does it route incidents to one framework first and assess the other later?
• Is there a named person responsible for WHS notification and a named person responsible for sector notification, and do both know they can act without waiting for management sign-off?
• Has your notification decision framework been updated since August 2025 to reflect the November 2025 Aged Care Act changes, and are you tracking when your jurisdiction adopts the December 2025 model WHS amendments (violent incidents, notifiable extended absences, notifiable suicides)?
• Do your records capture the information required by both frameworks in a single contemporaneous document, or do your WHS incident records and your SIRS/NDIS records use different formats, different language, and different classification systems that create inconsistencies if both regulators request information about the same event?
• Does your record retention policy identify the most restrictive applicable period for each record type, including the NDIS 7-year minimum and the NQF obligation to retain child records until age 25?
• Can your workers report incidents, including worker harm events like violence and assault, through a channel that is confidential, accessible outside business hours, and not dependent on raising the matter with the manager who may be the subject of the concern?
• When did your compliance team last map the specific incidents that trigger both WHS notification and sector notification simultaneously, and confirm that your internal triage process activates both pathways?

Key Sources

Aged Care Quality and Safety Commission: Reportable Incidents and SIRS, Quick Guide to Changes from 1 November 2025 (ACQSC, 2025) | Aged Care Quality and Safety Commission: About Reportable Incidents (ACQSC, 2025) | MinterEllison: NDIS and Aged Care Compliance Shift, Penalties, Bans and Fines (MinterEllison, December 2025) | NDIS Quality and Safeguards Commission: Notify Us About a Reportable Incident (NDIS Commission, 2024/2025) | NDIS Quality and Safeguards Commission: Reportable Incidents | ACECQA: NQF Child Safety Changes from 1 September 2025 and 1 January 2026 (ACECQA, November 2025) | ACECQA: Notification Types and Timeframes (ACECQA, September 2025) | ACECQA: Reporting Requirements About Children | Safe Work Australia: Model Work Health and Safety Legislation Amendment (Incident Notification) 2025 (December 2025) | Aged Care Act 2024 (Cth) and Aged Care Rules 2025 (commenced 1 November 2025) | National Disability Insurance Scheme Act 2013 (Cth) ss.73J, 73V | National Disability Insurance Scheme Amendment (Integrity and Safeguarding) Bill 2025 | Education and Care Services National Law ss.174, 174A; National Regulations rr.176, 87 | Model Work Health and Safety Act 2011 ss.38, 39 (incident notification) | QUASR: Navigating NDIS and SIRS Reporting under the New Act (2025)

This article provides general information only and does not constitute legal advice. Notification obligations in regulated sectors are subject to ongoing change. Providers should seek independent legal advice in relation to their specific registration status, sector obligations, and jurisdictional requirements, and should monitor developments across all applicable regulatory frameworks.