Guide

How can a behaviour support practice keep track of restrictive-practice authorisations?

Last reviewed 2026-10-21 against the official sources cited on this page.

In short: Keep the behaviour support plan and the authorisation decision as separate, linked records. For each regulated restrictive practice, identify the applicable jurisdiction, the recorded decision and conditions, relevant dates, evidence location and the person following up unresolved items. NDPRO helps behaviour support practices keep restrictive-practice records, BSP references, recorded authorisation status and expiry information visible for review.

Start with one participant. Can the person reviewing the record establish which decision relates to which practice and plan, without reconstructing the history from emails?

The implementing provider obtains authorisation where required through the relevant state or territory process. Writing a BSP does not itself provide that authorisation. The Commission's implementing-provider guidance explains the responsibilities; check the current jurisdictional requirements for the participant and proposed use.

The fact everything else follows from

The NDIS Commission does not authorise restrictive practices. Authorisation is governed by the applicable state or territory process. The implementing provider obtains it where required, through the decision-maker specified by that process. When it has been obtained, evidence of the authorisation is uploaded to the Commission's portal under the schedule of restrictive practices. Since 12 October 2026 there are two portals. New and reviewed plans use the new portal; monthly reporting for plans lodged before that date stays in the existing portal, while reporting for plans lodged from that date uses the new one. Check the Commission's current portal instructions for the task and plan concerned.

Two consequences that practices routinely get wrong:

Responsibility for obtaining the required authorisation rests with the implementing provider. A specialist provider may assist with evidence and understanding the process; developing the plan does not itself authorise a practice. A practice that does both — writes plans and has staff implementing them — holds both, and needs to know which hat it is wearing for each participant.

A behaviour support plan is not an authorisation. A regulated restrictive practice being in a plan is a requirement, not a permission. The plan and the authorisation are two separate artefacts with two separate lifecycles, and a register that stores only the plan answers half the question.

One ambiguity worth knowing about

The Commission words the jurisdiction question in more than one way. In one place, authorisation comes from the state or territory body where the person with disability lives. In another, it is the responsibility of the state or territory in which the regulated restrictive practice is used.

Those are the same sentence for almost every participant, and a different sentence for a small number — someone living near a border, or receiving a support delivered in another jurisdiction. This is not a gap to resolve by picking whichever reading suits: it is a question for the authorising bodies involved, and a practice with a cross-border participant should ask rather than assume. It is flagged here because a register designed around only one of the two readings will not record the fact you later need.

Where the state has no process

This is the part most summaries leave out entirely.

Where a state or territory does not have an applicable authorisation process, the requirements under the NDIS Act and the Behaviour Support Rules still apply. The regulated restrictive practice must still be in a behaviour support plan, and the specialist behaviour support provider must still lodge that plan with the Commission — regardless of whether state or territory authorisation was required.

So "no authorisation needed here" never means "nothing to record". It means the record has a different shape, and a register with no way to express "authorisation: not applicable in this jurisdiction, and here is why" will show a blank that reads, to anyone auditing it, exactly like a missing authorisation.

What the register has to hold

The following fields are a suggested record design, not a mandatory universal database schema. Adapt them to the applicable process. (If you are comparing tools rather than designing the record, eight questions to ask a restrictive practice register software vendor applies the same test to the product.) For each regulated restrictive practice, for each participant:

• Which practice, in the Rules' own categories rather than in your words.
• Which participant, and which jurisdiction governs it — recorded explicitly, not inferred from an address field, because the inference is the thing the ambiguity above makes unsafe.
• The authorising body, by name. "Authorised" without a named authoriser is an assertion.
• Authorised from, and authorised until. The second date is the one that quietly passes.
• The conditions attached. Authorisations are commonly granted subject to conditions, and keeping them visible helps the team review whether they are being met.
• Where the evidence is, and confirmation it was uploaded to the Commission's portal.
• Which behaviour support plan it sits in, and that plan's own review date.
• Or: not applicable in this jurisdiction, as a positive state rather than an empty cell.

Why this is the hardest register to keep in a spreadsheet

Every other compliance record a practice keeps has one clock. A credential expires. A plan is reviewed. This one has four, and they run independently:

the authorisation's own expiry · the conditions attached to it · the plan's review date · and the participant's circumstances, which can change the practice being used at any time

A spreadsheet holds four dates perfectly well. What it cannot do is notice that the third one moved and the first one is now inconsistent with it, or that a practice was changed in the plan without anyone returning to the authorisation. Those are relationships between records, and a grid of cells has no way to express a relationship — only a person remembering to check both.

And the failure is asymmetric. A lapsed credential is a problem. Use of a regulated restrictive practice without required current authorisation can trigger reportable-incident obligations. Expiry alone does not establish that the practice was used. Record the actual use and circumstances, and apply the Incident Management and Reportable Incidents Rules 2018 separately from monthly reporting.

Use an exception record when something changes

A register is most useful when a change leads to a clear review action. The following synthetic NSW example shows a process to evaluate, not a legal conclusion about any particular practice.

An authorisation reference is on file, but a proposed plan change may alter the practice described. The review record should retain the existing decision reference, identify the changed plan version and state who will check the NSW authorisation requirements. It should not automatically mark the changed practice as authorised because a previous document exists.

The NSW restrictive-practices authorisation guidance and the Commission's current provider guidance should determine the real process. Provider responsibilities, state authorisation, plan lodgement, monthly reporting and incident reporting remain distinct questions. A register entry is not acceptance by an authority.

For software evaluation, ask to see the unresolved item as well as a completed example. The register demonstration worksheet helps record what was actually shown.

A practical authorisation review with NDPRO

Use the restrictive-practice record as the starting point for a review. Check the linked BSP reference, recorded authorisation status, jurisdiction and expiry information against the source documents. A populated field is a prompt to inspect the evidence; it is not an authorising decision.

A useful team review asks:

• Is the recorded decision still relevant to the practice and circumstances being reviewed?
• Can we locate the evidence behind the recorded status and dates?
• Is a plan change or an approaching expiry awaiting follow-up?
• Who is obtaining clarification, and when will the team check the outcome?

For example, in a fictional practice review, the team finds that a BSP has been updated but the authorisation record still refers to an earlier version. The next action is to check whether the decision covers the changed circumstances and obtain advice or updated evidence where needed. Marking the BSP complete does not close that question.

NDPRO provides a specialist workspace for the practice's restrictive-practice and authorisation records. The team can review those records alongside its BSP references rather than start a new search for each review. Agree the follow-up owner and check the evidence before closing an item.

NDPRO works standalone. Practices already using Splose can use the optional connection. Authorisation decisions and required submissions remain with the responsible people and authorities; NDPRO does not generate the monthly restrictive-practice return or restrictive-practice reduction plan reporting.

See the restrictive-practice record workflow or book a 30-minute NDPRO walkthrough.

Where to start

Take one participant with a regulated restrictive practice in place, and answer these without asking anyone: which practice, which jurisdiction, which body authorised it, under what conditions, until when, and where the evidence sits.

If any of those needs an email to find, the register is a list rather than a record — and you have found that out on a quiet afternoon instead of in front of an auditor.

---

Related: what Module 2A asks for, outcome by outcome · the interim BSP clock · keeping a PBS capability record current · practising as a sole trader.

Sources: NDIS Quality and Safeguards Commission — Rules for implementing providers and Rules for behaviour support and restrictive practices. Read 28/08/2026. The state and territory frameworks are published separately by the Commission and are revised; read those rather than any summary, including this one.

Review the handoff for your state

The operational review differs by jurisdiction. Use the NSW panel-handoff guide, Queensland approval-route review or Tasmania application-handoff guide alongside the current official sources. Each contains a distinct synthetic evaluation scenario.

Related workflow: BSP handover to implementing providers.