SIRS incident management in aged care means notifying reportable incidents through the My Aged Care Service and Support portal within strict timeframes: Priority 1 incidents within 24 hours, Priority 2 within 30 days. Executives need an incident management system that triggers automatically, a named incident manager for every Priority 1 event, and a clear line to police wherever reasonable grounds for a crime exist.
TL;DR:
- Most reportable incidents require notification within 24 hours for Priority 1 cases and within 30 days for Priority 2, regardless of proof or resident consent.
- A robust incident management system must include leadership, immediate response, accurate reporting, root cause analysis, concrete actions, and ongoing verification, with records retained for seven years.
- Cornerstone elements for compliance include nominated reporters, predefined workflows, structured documentation, and regular audits of incident handling and systemic themes.
- A near-miss example shows that addressing underlying causes like rostering and handover procedures can reduce recurrence to zero in subsequent reports.
- Boards should focus on oversight through evidence of system operation, monitoring of key metrics, and systemic trend analysis rather than day-to-day management or policy approval.
What counts as a reportable SIRS incident?
The Serious Incident Response Scheme defines eight reportable incident categories that apply across residential and home care services. Get the categories wrong and your triage falls apart before it starts.
- Unreasonable use of force
- Unlawful sexual contact or inappropriate sexual conduct
- Psychological or emotional abuse
- Neglect
- Unexpected death
- Stealing or financial coercion by a staff member
- Unexplained absence from care
- Inappropriate use of restrictive practices
Priority 1 covers incidents that have caused, or could reasonably cause, physical or psychological injury or trauma. Sexual assault, unexplained death, and unreasonable use of force typically sit here. Priority 2 covers the remaining reportable incidents that don't meet that threshold but still require formal notification within 30 days.
Here's where most providers stumble: the scheme requires notification even for alleged or suspected incidents. You do not need proof, and you do not need the consumer's consent to report. Waiting for certainty before you notify is itself a compliance failure. The regulator's guidance on reportable incidents is explicit on this point, and it's worth reading in full before you finalise your escalation policy. The SIRS decision support tool helps frontline staff and quality managers work through priority classification when a case sits in grey territory.
What does an effective incident management system need?
An incident management system (IMS) is more than a form and a filing cabinet. The Aged Care Quality and Safety Commission expect six essential elements working together, not sitting as separate compliance artefacts.
- Leadership and safety culture - staff feel safe raising concerns without fear of blame.
- Respond - immediate action to protect the person and preserve evidence.
- Record and report - accurate documentation and timely notification to the Commission.
- Analyse - understanding root cause, not just symptoms.
- Implement actions - concrete changes to prevent recurrence.
- Close the loop - verifying the action worked and reporting back to the board.
Record-keeping isn't optional or discretionary in timing. The Aged Care Rules 2025 require providers to retain incident records for seven years, and the Commissioner can request further information or a final report at any point in that window.
| IMS record field | Minimum requirement |
|---|---|
| Incident date and time | Exact, not approximate |
| Priority classification | Documented reasoning, not just the outcome |
| Notification timestamp | Matches portal submission record |
| Nominated incident manager | Named individual, not a team |
| Corrective actions | Linked to root cause analysis |
| Retention period | 7 years |
Every service needs nominated reporters who know their role before an incident occurs, not during one. Delegation without training is where good policy quietly fails in practice.
How do you run the notification workflow?
The first hour matters more than any document you'll write later. Protect the person, preserve evidence, and get basic facts down before memory drifts. From there, the workflow has clear stages.
- Lodge the initial Priority 1 notice through the My Aged Care Service and Support portal within 24 hours, even with incomplete information.
- Submit additional information as it becomes available, including any significant new information that changes the risk picture.
- Prepare and lodge the final report once the investigation closes.
- Call police within 24 hours wherever reasonable grounds exist to believe a crime occurred, independently of your SIRS notification.
A good notification isn't a copy of the progress notes. The Commission expects structured information that shows you've understood what happened and what you're doing about it, not just that something happened.
Pro Tip: Draft your Priority 1 notice template now, before you need it. A blank template you can populate in ten minutes beats a first draft written under pressure at 11pm.
What should boards demand for SIRS assurance?
Boards don't need to run the IMS. They need to know it works, and that's a different job entirely.
- Request evidence the IMS is operating, not just a policy document confirming it exists.
- Set a standing board report with counts by priority, average time to notify, and corrective action completion rates.
- Confirm delegated responsibilities and escalation pathways are documented and known to staff, not just written down somewhere.
- Track themes across incidents, not just individual case outcomes, to catch systemic risk early.
Testing the system matters more than trusting it. Ask your quality manager to bring one or two closed incidents to each quarterly audit for a spot check, and align that review with your existing audit calendar rather than running it as a separate exercise. Our governance obligations guide sets out a fuller board reporting template if your current dashboard doesn't yet capture time-to-notify.
How one provider turned a near-miss into a system fix
A residential provider identified an unexplained absence involving a resident with cognitive impairment. Staff located the resident within the hour, uninjured, but the incident met the Priority 1 threshold given the risk involved. The provider notified the Commission within four hours and documented the timeline in full.
The investigation found a gap in the door alarm monitoring roster during shift changeover, not a single staff error. The provider adjusted rostering, added a handover checklist item, and briefed all shift leads within a fortnight.
The board didn't ask why the incident happened once. It asked to see the same near-miss category tracked for the next two quarters, and it wanted the handover checklist audit result in the next board pack, not a verbal assurance that it had been actioned.
Recurrence in that incident category dropped to zero over the following two reporting periods.
What's the one leadership shift that actually improves compliance?
The gap I see most often isn't a missing policy. It's frontline staff quietly deciding an incident "probably doesn't count" because they're worried about being wrong or triggering unnecessary paperwork. That hesitation costs you hours you don't get back under a 24 hour clock.
The fix is governance, not training alone: name who reports, name who reviews every Priority 1 decision within 48 hours, and make that review visible to the board. Visibility changes behaviour faster than any policy update.
— Rachel
Get SIRS-ready assurance without building it alone
Most boards don't lack commitment to SIRS compliance. They lack the time to build and test an incident management system while running everything else on their plate. The Planning and Practice Hub works alongside boards and executives to close that gap: policy development for incident management, board reporting frameworks that surface the right metrics, and compliance calendars that keep notification deadlines and audit cycles aligned instead of competing for attention.
Our Practice Assurance service is built for exactly this problem: reviewing your current IMS against the Aged Care Rules 2025, identifying where reporting gaps sit, and helping your team design a system that holds up under Commission scrutiny. If your board needs a structured way to schedule statutory notifications and reporting cycles, our Compliance Calendar does that work for you. Book a call to walk through where your current IMS stands and what a stronger assurance model would look like for your organisation.
Where to check the rules yourself
The Aged Care Quality and Safety Commission incident reporting guidance sets out notification timeframes and police reporting duties in full. The Department of Health, Disability and Ageing's SIRS overview lists the eight reportable categories with worked examples. For the legal basis behind record retention and Commission powers, the Aged Care Rules instrument is the primary source. The Commission's SIRS provider resources page hosts the decision support tool and notice templates, and a broader external reference on reportable categories sits in this compliance guide for regulated sectors.
Sources
- Reporting incidents | Aged Care Quality and Safety Commission
- Serious Incident Response Scheme (SIRS) | Australian Government Department of Health, Disability and Ageing
- Aged Care Legislation Amendment (Serious Incident Response Scheme) Instrument 2021
FAQ
What is SIRS in aged care?
SIRS is the Serious Incident Response Scheme, the regulatory framework requiring aged care providers to identify, notify, investigate and prevent recurrence of eight defined categories of reportable incident.
What is the difference between Priority 1 and Priority 2 incidents?
Priority 1 incidents must be notified within 24 hours because they've caused or could cause serious harm; Priority 2 incidents have 30 days and cover less severe reportable events.
Do I need consent from the resident to report an incident?
No. The regulator's guidance confirms providers do not need permission from the person involved, and alleged or suspected incidents must still be notified.
How long must incident records be kept?
Providers must retain incident records for seven years under the Aged Care Rules 2025, alongside notification timestamps and evidence of corrective action.
Who helps boards implement a compliant incident management system?
The Planning and Practice Hub's Practice Assurance service supports boards and executives to design, test and evidence an IMS that meets SIRS and broader regulatory expectations.