Originally based on our guide SIRS reporting criteria: Priority 1 and Priority 2 explained on rostery.com.au. This version is rewritten for the quality, compliance and admin staff who own the incident process day to day.
If you sit in the compliance or quality seat at an aged care provider, the Serious Incident Response Scheme (SIRS) is less about knowing the rules and more about running them reliably. A worker rings at 8pm. A family member mentions something during a review. A note on a shift record reads oddly. Each of those can start a legal clock, and the clock does not care whether the office is open.
This post lays out SIRS as a workflow you can write down, train people on and audit yourself against. The rules come from the Aged Care Act 2024 (section 16, the meaning of reportable incident), the Aged Care Rules 2025 (Part 2, Division 2 of Chapter 5, rules 165A-25 and 165A-30 in particular) and the Aged Care Quality and Safety Commission's provider pages. Where we say "the Commission", we mean the Aged Care Quality and Safety Commission.
General information only, not legal advice. The Act, the Rules and the Commission's guidance are the authority, and they change. Check them before you change your process.
The workflow in one line
Become aware, make people safe, decide reportability, decide priority, notify on time, follow up, and keep one record of all of it. Every step after "become aware" has a time limit hanging over it, which is why it pays to treat this as a pipeline rather than a judgement call made fresh each time.
Stage 1: capture the moment of awareness
Both SIRS deadlines are counted from the point your organisation became aware. Not from when the incident happened, and not from when someone senior has read the report or finished looking into it.
For a workflow, that means the very first field you capture is a timestamp: when did anyone in our organisation learn about this? Treat it as the anchor for everything that follows. A few practical points:
- Record awareness separately from occurrence. An incident might have happened last Tuesday and been disclosed today. The incident date and the awareness time are two different fields, and only one of them starts the clock.
- Don't let triage wait for a manager. If the frontline worker's report sits in an inbox overnight, the 24 hours has already been running.
- Make the after-hours path explicit. Someone has to be on call with access to the notification system, or with a clear way to reach the person who does.
The Commission also expects providers to assign roles for reporting and to train those staff. The Department's guide to the SIRS functions in the My Aged Care Service and Support Portal describes three SIRS roles: administrator, team leader and staff member, each of which can submit notices. Check who in your organisation actually holds those roles, and whether any of them work evenings or weekends.
Stage 2: the reportability test
Section 16 of the Act defines a reportable incident as one of eight kinds of incident that has occurred, is alleged to have occurred, or is suspected of having occurred, in connection with the delivery of funded aged care services to a person by a registered provider. The eight kinds are:
- unreasonable use of force against the person
- unlawful sexual contact, or inappropriate sexual conduct, inflicted on the person
- psychological or emotional abuse of the person
- unexpected death of the person
- stealing from, or financial coercion of, the person by an aged care worker of the provider
- neglect of the person
- use of a restrictive practice in relation to the person, other than in line with the requirements in the rules
- unexplained absence of the person in the course of the delivery of funded aged care services
Two conditions, then: it fits one of those types, and it occurred or is alleged or suspected to have occurred. For a workflow, write the test as two yes/no fields rather than one. That forces whoever triages to consider the "alleged or suspected" path explicitly, which is where most under-reporting starts.
The Commission is clear that you must notify alleged and suspected incidents, and incidents involving people with cognitive or mental impairment such as dementia. You don't need permission from the people involved to tell the Commission. Build those three statements into your triage guidance word for word, because they are the ones staff most often get wrong under pressure.
If an incident fails the test, it still goes into your incident management system. More on that in Stage 6.
Stage 3: the priority decision
Rule 165A-25 of the Aged Care Rules 2025 sets out what a Priority 1 reportable incident is. It's a reportable incident:
- that has caused a person physical or psychological injury or discomfort that requires medical or psychological treatment, or
- where there are reasonable grounds to report the incident to police, or
- of the unlawful sexual contact or inappropriate sexual conduct kind, or
- of the unexpected death or unexplained absence kind.
Everything else that is reportable is Priority 2 (rule 165A-30).
So three of the eight types are Priority 1 every time: sexual contact or conduct, unexpected death and unexplained absence. For the other five, two questions decide it: did it cause injury or discomfort that needs medical or psychological treatment, and are there reasonable grounds to go to police? A yes to either makes it Priority 1.
There is one more rule worth putting in your guidance. Where someone's impairment directly affects whether they can recognise or communicate that they've been hurt, rule 165A-25(3) says the provider must not treat that impairment as preventing or lessening the harm, and must consider that each person's experience is unique. In plain terms: "they didn't seem upset" is not a reason to downgrade.
If your team is unsure, the Commission publishes a SIRS decision support tool that walks through whether an incident is reportable and which priority applies. In a workflow, we'd record that it was used and what it suggested, alongside the human decision and the reason for it.
Stage 4: calculate the deadlines
Once priority is set, the dates follow mechanically, which makes this the easiest stage to automate. A minimal sketch:
from datetime import datetime, timedelta
def sirs_deadlines(aware_at: datetime, priority: int) -> dict:
"""Illustration only. Check the Aged Care Rules 2025 for the exact
wording of each period before relying on it."""
if priority == 1:
return {
"priority_1_notice": aware_at + timedelta(hours=24),
"police_if_grounds": aware_at + timedelta(hours=24),
# rule 165A-25(6): further notice within 5 days after the
# start of the 24 hours, unless the Commissioner sets another period
"additional_information": aware_at + timedelta(days=5),
}
return {"priority_2_notice": aware_at + timedelta(days=30)}
That snippet is deliberately small. It shows the shape of the logic, not a compliance tool. The point is that the deadline should be calculated from the awareness timestamp and shown to people, not worked out in someone's head.
On police: the Commission says that where there are reasonable grounds, providers must report to police, and that these incidents must also be reported to police within 24 hours of becoming aware. That applies whether the incident is alleged or suspected, and if there's doubt about whether it's criminal, the Commission's advice is to report it.
Stage 5: assemble the notice
Notifications are lodged in the My Aged Care Service and Support Portal, through the SIRS Notice tile. Rule 165A-25(4) lists what a Priority 1 notice must include. It's useful to turn that list into the structure of your internal incident form, so the information is already in one place when someone sits down to notify.
Two things make this stage less stressful than it looks:
- You don't need everything to notify. The Rules say you're not required to include information that isn't available within the 24 hours. Missing names or details go in the further notice.
- The further notice has its own date. For Priority 1, a second notice with the outstanding information is due within 5 days after the start of the 24 hours, or another period the Commissioner sets. Put it on the same record as a second deadline, not as a reminder in someone's calendar.
The Rules also cover notifying significant new information (rule 165A-40) and giving a final report where one is required (rule 165A-45). Treat both as open tasks on the incident until they are closed off.
Stage 6: the incident management system around it
SIRS is one part of a wider duty. The Commission expects providers to use their incident management system for all incidents, reportable or not: to assess each one, respond so people are safe, involve the right people, practise open disclosure, and use the data from past incidents to judge how well risk is being managed.
From an admin point of view, the test of your system is simple. Pick any incident from six months ago and see whether one record tells the whole story: what happened, when you became aware, the priority decision and why, when and how you notified, what follow-up happened, and what you changed. If that story is split across an email thread, a spreadsheet and a portal receipt, it will be hard to show at audit, and harder still to learn from.
Our dev.to post on building an NDIS audit evidence checklist for each Practice Standard area uses the same "one record per obligation" thinking for NDIS audits, and much of it carries across.
Stage 7: if you also deliver NDIS supports
Plenty of providers run aged care and NDIS services side by side. SIRS and NDIS reportable incidents are separate schemes with separate rules, regulators and portals, and one doesn't satisfy the other.
The NDIS Quality and Safeguards Commission's reportable incident categories cover death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, sexual misconduct including grooming, and unauthorised use of a restrictive practice. Most must be notified within 24 hours, followed by a 5-day report. Unauthorised restrictive practices are due within 5 business days, or 24 hours if the person was harmed. From 12 October 2026 the NDIS Commission asks providers to lodge new incidents in its new portal. Our guide to restrictive practices for NDIS providers covers that side in more detail.
For a mixed provider, the workflow should ask "which scheme?" before "which priority?". An incident involving someone receiving funded aged care follows SIRS. An incident in connection with NDIS supports follows the NDIS rules.
A weekly routine for the compliance seat
- Monday: list every open incident with a pending deadline: Priority 1 further notices due, Priority 2 notices due, final reports requested.
- Midweek: spot-check three incidents marked not reportable. Was "alleged or suspected" considered? Was cognitive impairment taken into account?
- Friday: confirm who is on call over the weekend and that they can get into the portal.
- Monthly: review incident data for patterns by type, site and time of day, and record what you changed.
Where Rostery fits
We built SIRS incident reporting in Rostery for this workflow. Each incident is recorded with its SIRS category, priority and whether it is reportable, along with the description, the immediate actions taken and who reported it. Rostery calculates the notification deadline from the priority and the incident date, tracks whether notification has happened, and shows open incidents and overdue notifications on the dashboard. Follow-up and investigation stay on the same record through to resolution.
Rostery doesn't lodge the notice for you. That's still done through the Commission's channels, and Rostery holds the record of what was notified and when. It also isn't the Commission's decision support tool. For NDIS incidents, NDIS incident reporting in Rostery handles reportability and the 24-hour deadline separately, so the two schemes don't get forced into one shape. If you want a quick refresher on the terms, our glossary entry on what SIRS is is a good starting point.
General information only. Sources: Aged Care Rules 2025, rules 165A-25 to 165A-45, and section 16 of the Aged Care Act 2024; Aged Care Quality and Safety Commission, About reportable incidents, Reporting incidents and SIRS in residential and home services; Department of Health, Disability and Ageing, Service and Support Portal user guide for SIRS; NDIS Quality and Safeguards Commission, Reportable incidents. Read 27 October 2026.
The Rostery team
Top comments (0)