The operational reasons NDIS compliance and risk registers drift out of date, and what closes the gap before an audit finds it.
Every NDIS provider has a compliance register. Incidents, complaints, risk assessments, worker screening, hazard reports, all of it. It's a core part of NDIS compliance and risk management, and every provider already knows they're meant to keep one.
The problem is never whether the register exists. It's whether it's current. An auditor doesn't ask if you have a risk register. They open it and check the last entry date. If that date doesn't line up with what's actually been happening in your business, that's the finding. Not "no register." Out-of-date register.
Here are five reasons that keep happening.
1. It only updates when someone remembers to
Most compliance registers don't update themselves. They update when a person opens the file, finds the right row, and types in what happened. That means the register is only ever as current as the last person who remembered it exists.
Nobody plans to skip a compliance entry. It just isn't the most urgent thing in a day full of urgent things. A shift needs covering, a participant needs a call back, an invoice is overdue. The register waits, because nothing tells anyone it can't wait. That's the real weakness in a manual register: the system has no memory of its own. It only has the memory of whoever's meant to be keeping it.
2. Getting one thing recorded takes several manual steps
Even when someone does remember, updating the register is rarely a one-step job. Something happens, a support worker writes it up somewhere, a manager reads that write-up, decides what it means for risk, then manually transfers the relevant details into a separate register.
That's several manual handoffs for one piece of information, and every handoff is a place for something to get lost, summarised badly, or just not make it across before the person moves on to the next thing. Risk register management built this way isn't really one process. It's a few small processes stitched together by whoever happened to be paying attention that day.
3. There's no line connecting the register to where the risk actually happens
The information a register needs almost never starts in the register. It starts in a case note, an incident form, a rostering conflict, a worker screening check, a complaint email. In most providers, none of that is connected to the register at all. It's a separate document sitting off to the side, waiting for someone to bridge the gap by hand.
Without that connection, the register can't reflect what's actually going on in real time. It only reflects whatever got manually copied across, whenever someone got around to it. Real NDIS provider compliance means the register moves when the business moves, not on a delay set by whoever's turn it was to update it.
4. There's nothing telling you what's due
A manual register doesn't flag anything for you. No prompt when a risk review is coming up. No alert when a worker screening check is about to lapse. No flag when an incident sat open for three weeks without being closed out. It just sits there, accurate or not, until someone happens to go and check.
That's the part that turns a paperwork gap into real exposure. Regulatory compliance isn't really about whether you did the thing, it's about whether you did it on time, and a system with no notifications has no way of telling you that until it's already too late. You find out the review was overdue when the auditor does.
5. A spreadsheet has no idea what's supposed to be in it
A lot of providers manage all of this in a spreadsheet, because it's on hand and feels flexible enough for the job. But a spreadsheet doesn't know a row is nine months old. It doesn't know two people are editing two different copies. It doesn't log who changed what, when, or why. If a formula breaks or a row gets deleted by accident, nothing tells you.
That's not a knock on whoever built it. It's just what a spreadsheet is: a grid, not a compliance monitoring system. Actual compliance monitoring means something is watching the data for gaps and staleness, not just storing whatever gets typed into it.
Where this leaves you
None of these five problems come down to anyone being careless. They're what happens when compliance depends on human memory, manual handoffs, and a document that has no way of watching itself. It works, mostly, right up until the week it doesn't, and that's usually the week an auditor is in the building.
It's the same gap covered in the incident register section of our piece on replacing manual NDIS workflows. In Astalty, the register isn't a separate document you update by hand. A support worker submits a form, the notification goes straight to the right team member, they run the investigation inside the same system, and it moves through to finalisation for approval. The record updates from where the risk actually happened, not from someone transcribing a case note into a spreadsheet a week later. And because it's a live system, there's a clear record of exactly what changed and when, which is the thing an auditor actually wants to see.
If your register is only ever as current as the last time someone remembered to open it, it's worth seeing what it looks like when it isn't. Book a demo.
