NDIS Commission Risk Engine

⁠⁠⁠Requirements

The Risk Engine will enable the NDIS Quality and Safeguards Commission to move to intelligence‑led, risk‑based regulation by identifying and prioritising the providers, workers, participants and networks that present the greatest risk of harm, unacceptable quality and safety, fraud or non‑compliance. It is a decision‑support capability that strengthens human judgement, not an automated enforcement system.

Benefits

• Earlier identification of risk before harm escalates
• More consistent and defensible decision‑making across the Commission
• Better prioritisation of regulatory resources, focusing effort where it matters most
• Improved visibility of the NDIS market, including linked providers and workers
• Explainable and auditable risk assessments that support legal, ethical and regulatory scrutiny
• Reduced reliance on manual triage and reactive processes

Expected Outcomes

• A single, continuously updated view of providers, workers and participants
• Automated, explainable risk scores and risk tiers aligned to the Commission’s prioritisation model
• Faster and more targeted complaint, reportable incidents triage, investigations and safeguarding responses
• Identification of systemic and network‑level risks across the sector
• Improved consistency, transparency and fairness in regulatory decision‑making
• Strong governance, privacy, bias‑mitigation and auditability controls

Expected Delivery Timeframe

Delivery will occur in phases:

Phase 1 (May 2026 – August 2026):

• Introductions, Core architecture re: data integration, entity resolution, provider and worker risk scoring, prioritisation and alerts (all Essential requirements delivered)

Phase 2 (Quarterly risk indicator cycles – see milestones. August 2026 – March 2027)

• Review previous quarters risk indicators and develop Implementation Plan (with business feedback testing) of quarters risk indicators
• Development of quarters risk indicators into the risk engine - Integration of external data, participant risk indicators, confidence scoring and expanded intelligence capabilities.

Phase 3 (January 2027 – May 2027)

• Handover, training, PIR + BAU maintenance and enhancement plan.

Phases will overlap where appropriate, with the system becoming operational early and progressively enhanced rather than delivered as a single “big bang”.