The EFQC Enquirer: 16 February 2026

In this edition

EFQC Update

• EFQC Team Connect Day — Strengthening Support for the Sector
• Industry collaboration – Championing Women in Care: Supporting Cassie Day’s International Women’s Day Luncheon 27 February 2026.

Important Sector & Regulatory Updates

• Mandatory Registration Confirmed for SIL & Platform Providers – Update
• Cyber Vigilance: Why Every NDIS Provider Must Act Now
• Have Your Say: Improving Service Agreements
• Federal Court Penalty Sends Clear Warning to NDIS Providers

Ask the Experts

• The 5 Ps (PPPPP) “Practice not Policies Protects Providers and Participants” Sharon Floyd, Director, Engels Floyd Quality Consulting

EFQC Update

EFQC Team Connect Day — Strengthening Support for the Sector

Next week, the Engels Floyd Quality Consulting team and several of our national network of technical associates will come together in Melbourne and online for a dedicated planning and connection day.
 
This important session will focus on strengthening our shared approach, discussing emerging sector changes, and ensuring we continue to provide consistent, practical support to NDIS and human services providers across Australia.
 
By investing time in collaboration and planning, we are reinforcing our commitment to quality, ethical practice, and helping providers navigate an increasingly complex regulatory environment.
 
We look forward to sharing key insights from the day.

Industry collaboration – Championing Women in Care: Supporting Cassie Day’s International Women’s Day Luncheon in Adelaide on 27 February 2026.

We are proud to support Cassie Day’s International Women’s Day Luncheon, an event that celebrates, elevates, and champions women working across the disability, health, and human services sectors.
This inspiring luncheon brings together leaders, practitioners, and change-makers who are shaping the future of care. It provides a valuable opportunity to connect, reflect, and recognise the critical role women play in driving quality, compassion, and innovation across our sector.

At EFQC, collaboration and sector leadership are central to how we work. Supporting events like this aligns with our commitment to professional development, shared learning, and strengthening the systems that underpin safe, ethical, and high-quality services for the people we support.

We encourage colleagues and providers to attend and be part of this important conversation—celebrating women’s leadership, amplifying lived and professional experience, and continuing to build a stronger, more connected care sector.

Find out more and secure your ticket:
https://www.stickytickets.com.au/oil3m0/international_womens_day_2026_championing_women_in_care.aspx

Important Information

1. Mandatory Registration Confirmed for SIL & Platform Providers – Update

The NDIS Quality and Safeguards Commission’s February 2026 reform pathway confirms a significant regulatory shift for the sector — mandatory registration for Supported Independent Living (SIL) providers and platform providers is coming.

With 1 July 2026 now clearly on the horizon, the direction is unmistakable. Providers who prepare early will be in a far stronger position when transition arrangements commence.

What has been confirmed
From 1 July 2026, new registration requirements will apply to:

• Supported Independent Living (SIL) providers
• Platform-based providers
• Unregistered providers currently delivering SIL will need to begin registration under the amended framework, while existing registered providers will transition through new arrangements. The transition period at this stage is unknown.

A reminder that mandatory registration for Support Coordination has been paused for now.

SIL providers operating in an unregistered capacity will not necessarily need to be fully registered on 1 July 2026. However, action during the transition period to commence the registration application will be essential to remain in the NDIS market.

New SIL-specific Practice Standards
Alongside mandatory registration, the Commission is introducing SIL-specific Practice Standards, reflecting the complexity and risk profile of these supports.

According to the February roadmap:

• Standards are being developed through consultation and co-design
• Simulated audits are underway with a group of SIL providers
• Transition to the new standards is expected by mid-2026, though the exact timeframe is unclear.
• It appears that new applicants from 1 July 2026 may be assessed against these new standards, while existing providers will transition under defined arrangements.

What this means for providers
From our perspective, this represents a substantial uplift in expectations — not a minor compliance change.

• Unregistered SIL providers should now be preparing for full NDIS registration, including governance structures, policy frameworks, operational systems, and certification audit readiness.
• Already registered providers should anticipate new SIL-specific audit requirements and transitional compliance obligations.

The practical message: start now
If your organisation delivers SIL — or intends to — preparation should begin immediately.

Not when final rules are released.
Not weeks before the deadline.
Now.

Over the coming months, the providers best positioned for transition will be those who:

• Strengthen governance and accountability frameworks
• Review and align policies, procedures, and systems
• Ensure day-to-day practice reflects expected standards
• Approach registration as organisational capability-building

Early preparation will not only support compliance — it will strengthen service quality, safety, and sustainability.

How EFQC can support you

• Engels Floyd Quality Consulting has supported NDIS providers since 2012 and has trained nearly 1,600 NDIS auditors on behalf of the NDIS Commission.
• We support providers with:
• NDIS registration planning and applications
• System development and implementation
• Preparatory and internal audits
• Audit support and preparation
• Ongoing quality management coaching
• Training and development

2. Cyber Vigilance: Why Every NDIS Provider Must Act Now

Cybersecurity is no longer just an IT issue — it is a critical safeguarding responsibility for NDIS providers.

Every day, providers handle highly sensitive participant information including personal details, health records, behavioural supports, financial information, and service data. A cyber incident or data breach can compromise not only privacy, but also participant safety, trust, and organisational viability.

The NDIS Code of Conduct requires providers and workers to respect privacy and deliver services safely and competently. Strong cyber practices are therefore not optional — they are part of your core compliance obligations.

The threat landscape is escalating.

According to the Australian Cyber Security Centre, cybercrime and cyber security incidents continue to increase across Australia, with criminals deliberately targeting organisations that hold sensitive personal information — including human services providers.

For NDIS organisations, the consequences of an attack can include:
Exposure of participant personal and health information
Disruption to service delivery
Financial loss and reputational damage
Regulatory scrutiny and reporting obligations
Cyber incidents can quickly become participant safeguarding incidents.

Cyber risk is service delivery risk.

Cyber resilience should be treated as an organisational capability, not simply a technical function.
Providers should ensure:

• Staff understand phishing, scams, and social engineering risks
• Systems and devices are secure and regularly updated
• Access to sensitive data is controlled and monitored
• Incident response processes are clear and tested
• Privacy obligations are embedded in everyday practice
• Building cyber awareness across the workforce is one of the most effective risk reduction strategies.

A practical step providers can take now
To support providers, the NDIS Commission is promoting the Australian Government’s free Cyber Wardens course, designed specifically for small organisations.
Managing cyber risks in service delivery is directly relevant to NDIS providers and supports Practice Standards compliance by strengthening your organisation’s ability to protect participant information.

The short foundation course provides practical guidance on:

• Identifying the seven most common cyber red flags
• Recognising scams and suspicious activity
• Adopting safer online habits
• Reducing the risk of hacks and data breaches

This is a simple, accessible way to build cyber awareness across your team.

Take 10 minutes to complete the Australian Government’s free Cyber Wardens course and encourage your staff to do the same. Small actions can significantly reduce your organisation’s exposure to cyber threats.

3. Have Your Say: Improving Service Agreements to Plan Management Registration Requirements

The NDIA, together with the NDIS Quality and Safeguards Commission, is seeking feedback on how to make service agreements clearer, fairer, and easier to use. This is an important opportunity for NDIS providers to influence guidance that shapes one of the most critical documents in participant relationships.

Service agreements set expectations around supports, responsibilities, pricing, and cancellations. When they are unclear or overly complex, misunderstandings and disputes can occur — impacting both participants and providers.

Why provider input matters
Providers bring practical insight into what works in real service delivery. Your feedback will help develop guidance and resources that support fair, safe, and respectful relationships between participants, nominees, and providers.

Clear agreements are essential for:

• Participant understanding and informed choice
• Risk management and dispute prevention
• Compliance with the NDIS Practice Standards

Have your say

• The consultation closes 27 February 2026, with a summary of findings to be shared later in the year.
• Visit the Improving Service Agreements page on the NDIS website to participate.

This is a valuable opportunity to help shape clearer, more practical service agreement guidance for the sector — ensuring agreements support strong partnerships and quality service delivery.

4. Federal Court Penalty Sends Clear Warning to NDIS Providers

A recent Federal Court decision has delivered a strong message to the sector about participant safety and reporting obligations.

The Court imposed a $1.1 million penalty against Oak Tasmania for serious failures to keep NDIS participants safe and for failing to report hundreds of reportable incidents within required timeframes. The proceedings were initiated by the NDIS Quality and Safeguards Commission.

Oak Tasmania admitted to multiple breaches of the NDIS Practice Standards and Code of Conduct, as well as 474 contraventions of the Reportable Incidents Rules — one of the most significant enforcement outcomes seen in the sector to date.

The critical issue: systems existed — but were not implemented

Importantly, this case was not about a provider lacking policies or procedures.
It was about systems that existed on paper but failed in practice.

Evidence before the Court highlighted:

• Incidents occurring but not being recognised as reportable
• Staff responding inconsistently depending on who was on shift
• Incident records completed after the event rather than guiding action
• Escalation thresholds that were not understood
• The Code of Conduct treated as “values” rather than enforceable obligations

The provider had documentation. What was missing was consistent implementation.

The Court made it clear: policies do not protect providers — practice does.

Why this matters for every provider
The judgment reinforces that incident management is a safeguarding function, not an administrative task. Reporting delays were found to have compromised the Commission’s ability to protect participants and may have prevented timely treatment or responses.

It also underscores that governance cannot be passive. Leaders must ensure systems are understood, embedded, and actively monitored.

Compliance is not demonstrated by having documents available for audit. It is demonstrated by what happens in real time when something goes wrong.

What providers should reflect on now

This case is a timely reminder to ask:

• Do staff truly understand what constitutes a reportable incident?
• Are escalation processes clear and consistently applied?
• Do incident records drive immediate action and learning?
• Is the Code of Conduct embedded in everyday practice?
• Can leadership demonstrate oversight of incident management effectiveness?

If policies only come out when the auditor arrives, there is a significant risk gap.

Key takeaway
Compliance confidence comes from implementation, not intention. Strong systems must be lived, understood, and practiced across the organisation — every day, on every shift.

This decision is a powerful reminder that participant safety depends on what providers do, not just what they document.

Our Ask the Experts article below provides more detail on how to do this.

Ask the Experts

Ask the Experts — The 5 Ps (PPPPP) “Practice not Policies Protects Providers and Participants” Sharon Floyd, Director, Engels Floyd Quality Consulting

Q: Sharon, why is the message “Practice not Policies Protects Providers and Participants” so important right now?

A: Because we are seeing an increasing number of providers who appear compliant on paper but are not operating compliant systems in practice — and the consequences are serious as seen in the article above with Oaks Tasmania.

Many organisations have policies and procedures, often purchased from ‘reputable’ sources. On face value the documents may look comprehensive. But when auditors speak to staff, review records, or observe practice, the systems are not fully functioning. For example:

• Policies and procedures haven’t been tailored to the individual provider.
• Policies and procedures haven’t been implemented.
• There is minimal evidence of meaningful audits, continuous improvement, training needs analysis, appropriate governance oversight, risk assessments etc.

The result? Audits with Major Nonconformances, compliance notices, and an increasing number of providers facing the real risk of applications being refused and deregistration for existing providers, despite good intentions.

Q: Why aren’t policies enough for compliance?

A: Because policies and procedures are not compliance — implementation is.
The NDIS Practice Standards assess what is actually happening in your organisation, not what sits in a folder or on a shared drive. Regulators want evidence that systems are embedded, understood, and consistently applied.

If you cannot clearly demonstrate how your policies are implemented, reviewed, and improved, the regulator will not have confidence in your suitability to operate.

Documents alone do not protect providers or participants.

Q: How does the 5 Ps (PPPPP) framework fit into this?

A: The 5 Ps is a simple way to remember what truly safeguards organisations:

P — Practice
Systems must be embedded in everyday operations.

P — Policies
Policies provide the structure — but they only work when applied.

P — Protects
Effective implementation safeguards participants, staff, and the organisation.

P — Providers
Strong systems support provider capability, compliance, and sustainability.

P — Participants
The ultimate purpose — safe, high-quality supports and positive outcomes.

Practice not Policies Protects Providers and Participants!

Q: Are generic policies a risk?

A: They can be if they are not customised and implemented.

Policies must reflect your actual services, workforce capability, participant needs, and operational risks. If staff cannot recognise their day-to-day work in the procedures, they are unlikely to follow them — creating a gap between policy and practice where compliance risks emerge.

We have also heard the NDIS Commission are rejecting thousands of registration applications on the basis of generic policies and procedures that have not been individualised to the business systems and operations.

Auditors will always test implementation by speaking with staff and reviewing evidence of real practice.

Q: What are practical ways providers can ensure staff understand and apply policies?

A: Providers need implementation strategies, not just documents. Effective approaches include:

• Translating policies into accessible worker resources
• Structured induction and refresher training
• Scenario-based learning to apply procedures in real situations
• Internal audits focused on practice
• Active governance oversight of system effectiveness

At EFQC, we have been developing individualised worker handbooks that present providers’ essential policy and procedural information in a clear, easy-to-read format aligned to the NDIS Practice Standards.

Providers tell us these resources dramatically improve staff understanding and consistency. One client described her handbook as “gold in helping our workers understand practice.”

We are also delivering extensive individualised training tailored to each provider’s services, helping staff understand what is actually required of them under the Practice Standards — not just what the documents say.

When staff understand expectations, implementation becomes much more reliable.

Q: What warning signs indicate policies are not embedded?

A: Common indicators include:

• Staff responding differently depending on who is on shift, rather than following a consistent process
• Incidents not being recognised as reportable, escalated, or documented within required timeframes
• Records completed after the event for compliance purposes, rather than guiding real-time action and decision-making
• Staff unsure how to apply procedures in situations such as restrictive practices, medication support, complaints, or participant risks
• Inconsistent handovers, communication, or documentation across teams
• New staff not receiving structured induction on key policies and procedures
• Workers relying on verbal instructions or “how we usually do it” instead of documented processes
• Governance and leadership unable to demonstrate oversight of incidents, risks, or quality trends

These signs tell regulators that systems may exist on paper, but they are not operating effectively in day-to-day practice.

Q: What is your advice to providers reading this?

A: Don’t wait for a compliance notice to force change.

A proactive check-in now is far easier than trying to recover once regulatory action has begun. Providers who act early can strengthen systems, protect participants, and demonstrate capability before issues escalate.

Compliance isn’t tested at audit time. It’s tested on an ordinary day when something goes wrong.

My key message is that Practice not Policies Protects Providers and Participants

Real compliance lives in everyday practice. When staff understand expectations, leaders actively monitor implementation, and systems are consistently applied, participants are safer and organisations are stronger.

If you would like support to ensure your policies and procedures are genuinely embedded in day-to-day operations — through tailored training, worker handbooks, internal audits, or implementation support — EFQC is here to help.