The Friday Resignation
She had been with you four years. She knew that one participant will not get in the car if the radio is on, that another’s mother prefers a text before a call, that the Tuesday transport booking has to be made by Thursday or it slips. None of that is in a system. It is in her head, and on Friday at five it leaves the building.
Every provider in this sector knows that feeling. Turnover in disability support is a fact of operating life, and it produces two distinct problems that are usually discussed separately when they are really the same problem.
The first is continuity of support: the next worker starts from a lower base, and the participant experiences that as a service getting worse. The second is compliance: at your next audit, the conversations that only ever existed verbally cannot be produced, and an auditor cannot distinguish between “we consulted the family carefully” and “we say we did”.
Both problems have the same fix. Not more paperwork — the sector already drowns in it, and asking a stretched workforce to type more is a plan that fails on contact with reality. The fix is to make the systems people already use produce the record as a by-product of the work.
What “Evidence” Means to an Auditor
NDIS certification and mid-term audits are not assessments of whether your service is good. They are assessments of whether your service can be shown to be good, using artefacts that existed before the auditor arrived.
That distinction is worth sitting with, because providers routinely take it personally. It is not personal. An auditor has no instrument for measuring care. They have documents, timestamps, logs and registers, and they reason from those to a conclusion about your systems.
An artefact, not an account
“We always ring the family” is an account. A call log showing eleven calls to that family over six months is an artefact. Only one of them is evidence.
A timestamp, not a recollection
When something was known, and when it was acted on, is often the whole question. Systems record that automatically; people reconstruct it badly.
A chain, not a snapshot
Concern raised → assessed → actioned → person informed → outcome reviewed. Auditors follow sequences. A single form in isolation proves very little.
Outcomes, increasingly
The Commission’s focus has been shifting towards outcomes-based evidence rather than documentation compliance alone. Good news for real services, harder for paper ones.
In 2026 that scrutiny has intensified rather than eased, with more auditor capacity in the system and a visibly more active enforcement posture from the NDIS Quality and Safeguards Commission. The practical read for a provider is simple: assume you will be asked to produce a chain of evidence for a specific participant on a specific issue, and work backwards from whether you could.
The Obligations, in One Table
| Requirement | The rule | Where providers slip |
|---|---|---|
| Information management | Practice Standard Outcome 2.4. Records must be accurate, complete, stored securely, accessible to those who need them and protected from those who do not. Assessed at every certification and mid-term audit. | Records exist but are scattered across five systems, so producing a single participant history takes half a day. |
| Contemporaneous | Created at the time of the event or immediately after it. | Batch write-ups on Friday afternoon covering the whole week. The timestamps make it obvious. |
| Seven-year retention | Minimum seven years for records, including incident notifications and their supporting documentation. | Retention living in someone’s head rather than being enforced by the system. |
| Under-18 participants | Records kept until the person turns 25 — which for a ten-year-old is fifteen years. | Choosing platforms with no realistic export path, so the obligation outlives the software. |
| Incident management | Record all incidents, not just reportable ones: what happened, what was done, how it resolved. | Near-misses and minor incidents never captured, so trends are invisible until they are not. |
| Complaints | Recorded, actioned and closed with a trail — including verbal complaints. | A register with three entries a year, which tells an auditor about your capture rate rather than your quality. |
The pattern hiding in that table
Look at where each obligation is triggered. An incident is usually first reported by a worker ringing someone. A complaint usually arrives as a call from a family member who never says the word complaint. A plan change is discussed before it is documented. Written records are downstream of conversations — and the conversation is the part almost nobody captures.
The Blind Spot: Telephone Contact
Try this with your leadership team. Choose a participant. List every interaction from the last month that exists as a durable record. Then list the phone calls about that person: the coordinator’s three calls to arrange transport, the mother who rang twice about the same worker, the GP’s receptionist, the plan manager chasing a claim, the Saturday call from a worker who wasn’t sure what to do.
In most services the second list is longer and almost entirely undocumented. Four specific patterns cause it.
| Pattern | What it costs you |
|---|---|
| Personal mobiles for participant contact | The worst of the four. No log, no recording, no organisational access. The number belongs to the worker, so when they resign the participant keeps ringing a phone your service does not control — and participant details sit on a device you cannot manage. |
| After-hours diverted to a manager’s handset | The most operationally significant calls you take are the least visible. And the 24-hour reportable incident clock starts on one of them. |
| One general number for everything | Intake, complaints, rosters and sales all in one undifferentiated log, so the log cannot evidence anything specific. |
| Notes typed later, if at all | Not contemporaneous, less accurate than the writer believes, and the first thing to be skipped when the day runs long. |
None of this is anybody’s fault. It is what happens when the phone is treated as a utility — a thing like electricity that either works or doesn’t — rather than as part of the record system. Once you reclassify it, the fixes are obvious and mostly configuration rather than culture change.
The On-Call Line and the 24-Hour Clock
Of everything in this article, this is the piece with the sharpest consequences, so it deserves its own section.
24 hrs
To notify the Commission of a reportable incident, from when you become aware
5 days
Business days for the full written report after the initial notification
7 yrs
Minimum retention for notifications and supporting documentation
6
Reportable categories — unauthorised restrictive practices report on 5 business days
The six categories are death, serious injury, abuse or neglect, unlawful sexual or physical contact, sexual misconduct, and the use of an unauthorised restrictive practice.
“When did the provider become aware?”
That is the question, and the answer is rarely an email. It is a support worker ringing the on-call number at 9:40 on a Saturday night. If that call happened on a personal mobile with no log, your organisation cannot evidence when awareness began — and you will be reconstructing your own timeline in front of a regulator. A properly configured on-call line with a rota, escalation, voicemail-to-text and a complete call log answers the question before it is asked.
A real on-call service also solves a workforce problem that sits alongside the compliance one. Rotating the after-hours number across a roster, with clear escalation and no expectation that one manager is permanently reachable, is how you run genuine cover without burning people out — and it intersects with obligations covered in the right to disconnect and your phone system.
Recording Calls Lawfully in Australia
Recording conversations in Australia sits under a patchwork of law: Commonwealth legislation covers interception of communications passing over a network, and every state and territory has its own surveillance devices or listening devices legislation covering private conversations. The rules differ between jurisdictions, so a provider operating across borders is subject to more than one set. What follows describes standard sector practice, not legal advice — get your own, especially if you work in multiple states.
Announce it, every time
An automated message at the start of the call stating that calls may be recorded and why. This is the mechanism that makes continuing the call informed. It takes minutes to configure.
Honour an objection
A caller who does not want to be recorded should be able to say so and keep talking. Pause and resume controls exist for exactly this moment.
Put it in the service agreement
People should learn about recording at sign-up, in plain language, with the purpose stated: accuracy, safeguarding, training.
Record narrowly
Intake, complaints and the on-call line cover most of the evidentiary value. Recording every conversation in the building is harder to justify and more expensive to store.
Pause for payment details
Card numbers must never end up in an audio file. Pause, take the detail, resume.
Lock down who can listen
Role-based access and an access log. “Anyone in the office can play any call” is a finding waiting to be written.
Done this way, recording is a safeguarding control rather than a liability. It protects participants when something goes wrong and it protects workers from allegations that would otherwise be unresolvable. It is also, incidentally, the best coaching material a service will ever have — reviewing how a difficult intake call was actually handled teaches more than any policy document, an approach set out in AI call scoring and quality assurance.
Turning Talk Into Records Automatically
A recording is evidence, but it is awkward evidence. Nobody wants to scrub through fourteen minutes of audio to find what was agreed, and an archive of unlistened audio files is not a record system.
What changes the economics is automatic transcription and summarisation. The call ends; within moments there is a searchable transcript, a short structured summary of what was discussed, and the actions that came out of it — written into the participant’s record with the timestamp intact.
| Before | After |
|---|---|
| Coordinator finishes a call, intends to write it up, gets another call. | Transcript and summary land in the participant record automatically, timestamped to the minute. |
| “Did anyone tell the family about the transport change?” — nobody is sure. | Search the participant’s call history for “transport” and read the answer in seconds. |
| Worker resigns; four years of context leaves with them. | The context is in the record, searchable by the person who replaces them. |
| Complaints register understates reality because verbal complaints were never classified. | Calls on the complaints line are captured, summarised and routed into the register by default. |
Two limits to write into your policy
First, an AI summary is a draft, not a professional record. The accountable person reads and confirms it. Second, transcription accuracy varies with audio quality, accents, background noise and speech differences — which matters acutely in a sector supporting people with communication disabilities. Use it to remove the typing, never the judgement. How it works end to end is in AI call transcription, summaries and CRM notes.
Seven Years Is an Architecture Problem
Seven years is longer than most software relationships. Fifteen years — the life of a record for a participant supported at ten — is longer than many companies. That makes retention a procurement question you answer before signing, not a filing question you answer later.
| Ask before you sign | Why it matters |
|---|---|
| Which country is the data stored in? | Many phone platforms sold in Australia are resold badges on overseas infrastructure, so participant conversations may leave the country. Know the answer before it is asked of you — see who actually owns the network your calls run on. |
| Can we export everything, in an open format? | Call logs, recordings and transcripts you can carry elsewhere. If you cannot export, you have handed your compliance obligation to a company that does not share it. |
| Is access role-based and logged? | Who listened to which recording, and when, is itself a record you may need. |
| Does deletion run automatically? | Retention rules per record type, with the under-18 rule applied where relevant. Manual deletion never happens. |
| How fast can we answer an access request? | People have a right to their own information. Producing it quickly is both a legal obligation and an act of respect. |
The Ten-Minute Audit Rehearsal
This is the single most useful exercise in this article, and it costs nothing.
Once a quarter, pick a participant at random. Give yourself ten minutes to produce their complete contact history for the last six months: every call in and out, who from, when, what was discussed, what came of it, and every incident, complaint or plan change linked to those conversations.
What you will find
Almost every provider discovers the same shape: shift notes are good, service agreements are filed, and telephone contact is a void. That is a genuinely useful result, because it tells you exactly where to spend your effort — and you found it yourself, four months before an auditor would have.
Do it with the leadership team in the room, not delegated to a quality officer. The value is in senior people experiencing the gap directly rather than reading about it in a report.
A Thirty-Day Plan
| Week | Do this | Result |
|---|---|---|
| Week 1 | Run the rehearsal. Map every number in use, including personal mobiles staff have given to participants and families. Write down which calls currently leave a trace. | An honest inventory. Most providers are surprised by how many numbers are circulating. |
| Week 2 | Move participant contact onto the organisation’s system via apps on staff devices, so calls go out from your number and are logged centrally. Split intake, complaints and on-call onto their own numbers. | The log becomes meaningful and the workforce keeps their private numbers private. |
| Week 3 | Write the recording policy — scope, announcement wording, opt-out, access control, retention, deletion — and take advice for the states you operate in. Then switch recording on for the scoped lines only. | A defensible, documented control rather than an ad hoc practice. |
| Week 4 | Turn on transcription and summaries, and connect the phone system to your client management or rostering platform so activity attaches to the participant automatically. | Contemporaneous notes by default, and the end of double entry. |
Thirty days is realistic because none of it is a technology project in the old sense — there is no on-premise equipment, no cabling and nothing to install on a server. It is configuration, policy and a fortnight of getting the team used to answering on an app. The compounding benefit arrives later: the next time somebody resigns on a Friday, what they knew is still in the system on Monday.
Frequently Asked Questions
How long must NDIS providers keep participant records?
A minimum of seven years is the baseline, covering participant records, incident notifications and the documentation supporting them. There is a longer rule that catches providers out: for a participant who is under 18, records must be kept until that person turns 25. A child supported at age ten therefore generates a record with a fifteen-year life. The practical consequence is that retention is a software procurement question rather than a filing question, because fifteen years is longer than most platforms survive in their current form and longer than many vendors last. Before choosing any system that holds participant information, confirm you can export everything in an open, readable format and carry it elsewhere, because the obligation follows the provider and not the supplier. It is also worth having deletion run automatically on a schedule per record type - keeping everything forever feels cautious but simply accumulates risk, storage cost and exposure in the event of a breach.
What counts as a contemporaneous record?
One created at the time of the event or immediately afterwards, rather than reconstructed later from memory. It is assessed under Practice Standard Outcome 2.4 covering information management, and because systems timestamp everything, a batch of notes written on Friday afternoon about events spread across the week is plainly visible as what it is. The purpose of the standard is accuracy rather than bureaucracy: recall of a specific conversation degrades fast, and the details that matter later - exact wording, who was told, what time - are the first to fade. Telephone contact is where this bites hardest, because calls are the interactions least likely to be typed up promptly by people who are already busy. Automatic call logging with transcription and a structured summary produces a timestamped note within seconds of hanging up, which satisfies the definition without depending on anyone's memory or energy at the end of a long shift.
What are the NDIS reportable incident timeframes?
Registered providers must notify the NDIS Quality and Safeguards Commission within 24 hours of becoming aware of a reportable incident, then submit a full written report within five business days of that notification. Unauthorised restrictive practices are notified on a five-business-day basis instead of 24 hours. The six reportable categories are death, serious injury, abuse or neglect, unlawful sexual or physical contact, sexual misconduct, and the use of an unauthorised restrictive practice. Notifications and their supporting documentation must be retained for at least seven years. The wording that decides real cases is becoming aware, because awareness typically begins with a phone call from a support worker rather than a formal report to management. If that call went to a personal mobile with no log, there is no way to evidence when the clock started, and the provider ends up debating its own timeline with the regulator using nothing but recollection.
Is recording calls with participants and families legal in Australia?
It is done widely and lawfully, but the law is a patchwork and the details vary. Commonwealth legislation governs interception of communications passing over a network, while each state and territory has its own surveillance devices or listening devices legislation covering the recording of private conversations, and those laws are not identical. A provider operating across state borders is therefore subject to more than one regime and should take its own legal advice rather than rely on general guidance. Standard practice in the sector is consistent and defensible: an automated announcement at the start of every call saying calls may be recorded and why, the ability for a caller who objects to continue without recording, a clear explanation in service agreements so people learn about it at sign-up, role-based access control over who can retrieve a recording, pausing before any payment details are taken, and a documented retention and deletion schedule. Recording narrowly - typically intake, complaints and the on-call line - is easier to justify than recording everything.
Should support workers use personal mobiles to contact participants?
It is the most common record keeping weakness in disability services and the hardest to defend at audit. On a personal mobile there is no organisational call log, no recording, no transcript and no way to reconstruct what was discussed or when. The number belongs to the worker rather than the service, so continuity fails the moment they take leave or resign, and participants and families continue ringing a phone your organisation does not control. There are privacy exposures running both ways: participant information sits on a device you cannot manage or wipe, and the worker's private number is now circulating in the community, which creates its own after-hours pressure. The fix does not mean buying anyone a second handset. A cloud phone system places a business identity on the worker's own device through an app, so outbound calls show the organisation's number, every call is logged centrally against the participant, and the worker's personal number stays personal.
Can AI-generated notes be used as the official participant record?
No, and your policy should say so explicitly. An automatic transcript and summary is a powerful aid - it captures what was said, timestamps it within seconds, makes six months of conversation searchable and extracts the agreed actions - but it is a draft that the accountable person reviews and confirms rather than a professional record in its own right. Two limitations matter particularly in this sector. Transcription accuracy varies with audio quality, accents, background noise and speech differences, which is a serious consideration when supporting people with communication disabilities, and an inaccurate transcript treated as authoritative is worse than none at all. And a summary captures content but not professional judgement: how somebody presented, what concerned the worker and what they intend to do about it is exactly the material an auditor is most interested in, and no model produces it. Use the technology to remove the typing, not the thinking.
What is the highest-value change we can make before our next audit?
Get participant contact off personal mobiles and onto the organisation's phone system, and give the on-call line a proper existence with a rota, escalation, voicemail-to-text and a complete log. Those two changes together address the largest evidence gap in most services and the one with the sharpest regulatory consequence, because the on-call line is where the 24-hour reportable incident clock actually starts. After that, separate intake and complaints onto their own numbers so the call log can evidence something specific rather than being an undifferentiated stream, write the recording policy before switching recording on, and enable transcription so notes become contemporaneous without anyone having to remember. The sequence matters: numbers and logging first because they are pure configuration and immediately useful, policy next because it makes recording defensible, and integration last because it is the piece that benefits most from knowing how your calls actually flow.
