NDIS Emergency and Disaster Plans for Solo Operators and Small Providers

If you’re a one-person business or a small provider delivering NDIS services and coming up to your Certification audit, you might be looking at the emergency and disaster management requirements and thinking: “This is designed for big organisations with buildings and staff teams. It doesn’t apply to me.”

It does. And it’s one of the areas where I saw the most non-conformances identified at audits – not because providers don’t care, but because they genuinely didn’t realise what was expected.

Let’s walk through what the standard actually requires, what it can look like for a small provider, and how to build a plan that’s realistic for your size without cutting corners.

What the Practice Standard actually says

The NDIS Practice Standards have a full outcome dedicated to emergency and disaster management planning, stating the following:

Emergency and disaster management includes planning that ensures that the risks to the health, safety and wellbeing of participants that may arise in an emergency or disaster are considered and mitigated, and ensures the continuity of supports critical to the health, safety and wellbeing of participants in an emergency or disaster. 

Every registered provider being audited against these standards needs to have an emergency and disaster management plan – it’s not optional.

The standard sits under the broader governance and operational management requirements and asks that each provider identifies, plans for, and manages emergencies and disasters that could affect the safety of participants or the continuity of the supports they receive.

The key word here is participants. The standard isn’t about protecting your business for its own sake. It’s about making sure the people you support aren’t left vulnerable when something dangerous is happening.

That applies whether you have 200 staff or whether it’s just you delivering supports in someone’s home.

What emergency management actually means

Emergency and disaster management is about one thing: what do you do when something dangerous is happening right now to keep people safe?

It’s the immediate response. A severe storm hits while you’re delivering supports, a participant has a medical emergency during a session, there’s a fire in the building where you’re running a group activity. Someone threatening enters the space. A pandemic changes how you can safely deliver services.

Your emergency plan covers how you identify those risks, what you do when they happen, and how you make sure participants are protected during the response.

This is different from business continuity planning, which covers how you keep delivering supports when something disrupts your ability to operate, like extended illness, vehicle breakdowns, or IT failures.

Why small providers get caught out

In my experience working in the NDIS audit space, there are a few common reasons smaller providers end up with non-conformances in this area.

“I didn’t think I needed a plan.” This is the most common. You don’t have a building, you don’t have a team, so you assume the requirement doesn’t apply to you. It does, it just looks different for you than it does for a large residential provider.

“I downloaded a template and it doesn’t match my business.” A generic emergency plan written for a provider running group homes or day programs is going to be full of procedures you don’t use and missing the risks that actually affect your service. If your plan references floor wardens and building evacuation routes but you’re a one-person provider delivering in-home supports, an auditor is going to ask questions you won’t be able to answer.

“I have a plan but I’ve never tested it or updated it.” Writing a plan is step one, but the standard also expects that you’ve tested it in some way, that your participants know what to expect in an emergency, and that you review and update it. A plan sitting untouched in a folder since registration doesn’t meet the standard (and potentially won’t be effective in an actual emergency).

“I covered the big disasters but forgot about participant-specific risks.” Your plan might cover what happens if there’s a bushfire or a flood, but does it address what happens if a participant has a medical emergency during a support session? Does it account for how your emergency response would change for participants with specific communication needs, mobility limitations, or health conditions?

What your emergency plan should cover

Your plan doesn’t need to be 30 pages long, but it needs to be proportionate to your service and genuinely address your risks.

Identify the hazards that are actually relevant to your service

Not every emergency scenario applies to every provider. Your plan should identify the hazards that are realistic for how and where you deliver services. Common categories include:

• Natural disasters – storms, floods, bushfires, heatwaves, cyclones depending on your location
• Building damage or threats – fire, structural damage, gas leaks, power failures (relevant if you deliver services from premises, but also relevant when you’re in a participant’s home)
• Pandemic and infectious disease outbreaks – how you deliver services safely during outbreaks, infection control during sessions
• Cyber security incidents – loss of access to participant records, communication systems, or scheduling
• Physical security threats – aggressive behaviour from third parties, intruders, threats in community or home settings

A solo operator delivering community access supports has a very different risk profile to a large company delivering in-home personal care. Your plan should reflect your actual service, not a generic list of every possible disaster.

Have clear response procedures

For each type of emergency, what do you actually do? The standard expects that you have practical steps and procedures for responding, not just a vague statement that you’ll manage the situation appropriately.

Common response procedures include:

• Evacuation – how you get yourself and participants out of a dangerous environment, accounting for mobility, communication, and support needs
• Lockdown – how you secure the space you’re in if there’s an external threat
• Shelter in place – what you do when it’s safer to stay where you are than to move (severe weather, for example)
• Service suspension – when and how you make the call to stop delivering services because it’s not safe to continue (and how you communicate that to participants)
• Medical emergency response – what you do when a participant or staff member has a medical emergency while services are being delivered, including who you call, what information you need to have accessible, and how you manage the situation until help arrives

Keep these practical and specific to your service. An auditor isn’t looking for a textbook, they want to see that you’ve genuinely thought through how you’d respond in the context of the work you actually do.

Account for participant-specific emergency needs

This is the layer that small providers most often miss. Your organisational plan covers the big-picture response procedures, but each participant may have individual considerations that change how you’d respond in an emergency.

Think about the participants you work with. Do any of them have mobility limitations that would affect an evacuation? Complex communication needs that would change how you explain what’s happening? Health conditions that could become an emergency during a session, or that complicate your response to a different emergency? Behavioural responses to stress or unexpected changes that you’d need to manage during an emergency?

These participant-specific considerations should be documented. They don’t need to sit inside your organisational emergency plan, and can be included in participant files or support plans, but you need to be able to show an auditor that you’ve thought about how your emergency response applies to the actual people you support.

Make sure participants know what to expect

The standard expects that participants are informed about your emergency procedures. For a sole trader or small provider, this might not mean handing participants a copy of your emergency plan, but instead having a conversation.

At the start of services, talk to each participant (and their family or support network where relevant) about what would happen in an emergency during a session. Check whether they have specific needs that would affect an emergency response. Confirm emergency contacts. Make sure they know what you’d do and what you’d need from them.

Document that this conversation happened. It doesn’t need to be elaborate, a note in the participant file confirming the discussion, what was covered, and any specific needs identified is enough.

Test and review the plan

You don’t need to run a full-scale evacuation drill every month, but you do need to show that the plan isn’t just a document you wrote once and forgot about.

At a minimum, review your plan annually and after any actual incident or near-miss. Ask yourself whether anything has changed (new service locations, new participants with different needs, new hazards in your area). If you’ve had to use the plan in a real situation, document what happened and what you’d do differently next time.

For small providers, testing can be as simple as a tabletop exercise: talking yourself through a scenario and checking whether your plan actually addresses it. Pick a realistic scenario (a medical emergency during a session, a severe storm while you’re delivering community access supports) and walk through your response step by step. Does the plan hold up? Are there gaps?

For more practical ideas, read our guide on how to test your NDIS emergency plan.

Common mistakes to avoid

Don’t use a large-provider template and put your name on it. Your plan needs to reflect your actual service. If an auditor reads a plan full of procedures for situations that don’t apply to your business, they’ll know it’s not genuinely yours and they’ll wonder whether you actually know what to do in an emergency.

Don’t treat this as a set-and-forget document. If you move to a new area, take on participants with different needs, or start delivering a new type of support, your risks change and your plan should change with them.

Don’t confuse emergency management with business continuity. Your emergency plan covers what you do when something dangerous is happening. What happens when you can’t operate for reasons that aren’t emergencies (extended illness, equipment failure, loss of a key staff member) is a business continuity question. Both are important, but they’re different plans addressing different problems. Trying to cover both in one document often means neither is done well.

Don’t forget that your emergency plan is for your staff and participants, not for your auditor. The point of emergency planning isn’t to produce a document that sits in a folder until audit day. It’s to make sure that when something goes wrong, you’ve already thought about what to do.

Start with what matters most

If you’re feeling overwhelmed, start with one question: what are the most likely emergencies that could happen while I’m delivering supports?

Be honest about your service, your environment, and the participants you work with, and build your plan around those real risks with practical responses you’d actually follow. Keep it proportionate to your size, make sure your participants are informed, and review it regularly.