Governance and Safeguarding for Boards and Executives

The core module of the NDIS Practice Standards includes a group of outcomes on provider governance and operational management. They expect support to be overseen by robust governance and management systems that are proportionate to the size and scale of the provider and the complexity of the supports. This lesson walks through the outcomes in that group, what auditors expect of a governing body, and why proportionate does not mean optional. Key points: skilled and trained board members, participant input into governance, leadership on quality and safety, and systems that are monitored and reviewed.

Directors and officers hold personal legal duties that sit alongside the NDIS and aged care rules. In general terms, they must act with care and diligence, act in good faith in the best interests of the organisation and for a proper purpose, not misuse their position or information, disclose and manage conflicts, and make sure the organisation can pay its debts. Charities registered with the national charity regulator also have governance standards. This lesson explains these duties in plain terms and links them to safeguarding. It does not replace legal advice.

A conflict of interest arises when a personal interest could influence, or be seen to influence, a decision you make for the organisation. In care services, conflicts can involve related businesses, family members who use our services, gifts, referrals or other roles in the sector. The NDIS Practice Standards expect actual and perceived conflicts to be managed. This lesson explains how to recognise conflicts, how to declare them, how the board should record and manage them, and why perception matters as much as reality for participant trust.

Boards do not manage day to day risks, but they must make sure risks are identified, managed and reported, and that the organisation keeps improving. This lesson explains the board's role in setting risk appetite, approving the risk and quality frameworks, and testing whether controls work. It introduces the idea of lines of assurance: frontline management, internal quality and compliance functions, and independent review such as external audits. Key points: ask for evidence rather than reassurance, and focus on the risks that could harm participants most.

Good board reports turn front line activity into information the board can act on. This lesson sets out what a board of a registered NDIS or aged care provider should expect to see: incidents including reportable incidents and trends, complaints and how they were resolved, restrictive practices and progress towards reducing them, and workforce information such as screening, training, turnover and supervision. It also covers audit findings and corrective actions. Key points: look for trends and themes, not just numbers, and ask what changed as a result.

Culture is how people behave when no one is watching, and it is shaped from the top. This lesson explains how boards and executives set culture through what they ask about, what they reward and how they respond to bad news. It covers psychological safety, protecting people who speak up, hearing directly from participants and workers, and spotting warning signs of closed or defensive cultures. Key points: leaders' reactions to problems teach everyone what is expected, and a culture of openness is one of the strongest safeguards we have.

The Aged Care Act 2024 commenced on 1 November 2025 and places clear governance obligations on registered aged care providers. Providers must act consistently with the Statement of Rights. Providers registered in the nursing and transition care or residential care categories must, unless an exemption applies, have a governing body with a majority of independent non executive members and at least one member with clinical care experience, a quality care advisory body that reports to the governing body at least every six months, and must offer to set up consumer advisory bodies at least every 12 months.

Under the Aged Care Act 2024, registered providers have a statutory duty to do what is reasonably practicable so their conduct does not cause adverse effects to the health and safety of older people, and this duty cannot be handed to someone else. Responsible persons, including board members, executives and key service managers, have a duty to use due diligence to make sure the provider meets its duty. Providers must assess the suitability of responsible persons at least once a year and notify the Commission of certain changes within 14 days. This lesson brings the course together.

This case study follows the board of a mid sized provider that runs NDIS supported independent living homes and home care for older people. A quarterly dashboard shows incidents at one home have dropped sharply since a new manager started, and restrictive practice data for that home is missing. The lesson shows how the chair and board test the good news, what they ask for, and how they stay in their governance role while making sure participants are safe. Key points: question low numbers, ask for evidence, visit services and hear from all three lines of assurance.

This case study follows a board after the chief executive tells them about an allegation that a worker assaulted an older woman in our home care service, and that a journalist has asked for comment. The lesson explores the board's role when reputation and safety seem to pull in different directions. It covers making sure the person is safe and supported, making sure required notifications are made on time, keeping the investigation independent, and communicating honestly. Key points: safety and legal duties come first, the board oversees rather than investigates, and transparency protects trust.