Risk Based Regulation in Aged Care

ACQSC

21 April 2026

My notes from this webinar

4 key principles or risk based regulation:

-           Proportionate

-           Risk and intelligence based

-           Outcomes focused

-           Collaborative

Expectation is the provider identifies risk and manages themselves without reliance on the ACQSC.

Risk based conformance monitoring is different to compliance to standards. The process is separate and is additional to compliance to standards monitoring.

Risk based conformance monitoring is driven from data management from reporting through regulatory processes.

Examples

1.       Staff escalation early when deterioration is detected

2.       Care plans are changed in a timely manner when wounds change

Every provider is allocated a supervision status which helps answer what actions do the commission need to take to protect older people. All providers are under ongoing risk surveillance. This may look like an onsite inspection or information from a risk based monitoring team.

The supervision status does not reflect in the star ratings.

 An example is the commission receive 2 x serious incident reports related to restrictive practice, also around the same time they receive a complaint about unsafe practices, and also a whistleblower complaint about unsafe practices. This would result in further action likely to be an onsite inspection and monitoring.

This process replaces the routine auditing schedule previously used by the Commission. Now the process is through data highlighting a risk to people and care. The on site audits are likely to be unannounced. The Commission will determine if the risk is at the facility only or an organisational wide risk.

The commission will conduct separate audits for compliance to the standards for registration purposes.

Discussions through Q&A

Boards play a critical role in ensuring the delivery of safe, high-quality care, and engagement with them is expected to be constructive and outcomes-focused. Strong governance should be supported by clearly documented frameworks and underpinning policies.

Boards are expected to demonstrate that they have actively considered and implemented appropriate financial management practices, with procedures in place to mitigate risk. Importantly, evidence—not just statements—of effective risk management, governance, and decision-making is required. This includes showing what factors were considered in decisions and how the needs and wellbeing of older people were prioritised.

Supporting documentation such as board papers, meeting minutes, and relevant correspondence may be requested as evidence. Additionally, there should be clear demonstration of independent judgement in board deliberations and decisions.

Proactive risk identification extends beyond addressing documentation issues. Best practice involves a systematic, data-driven, and participatory approach to identifying risk. This means looking not only at incident reports, but also drawing insights from a range of sources such as complaints data and feedback mechanisms.

Providers should use indicator data to evidence emerging risks, with clearly defined thresholds that trigger escalation before harm occurs, alongside documented corrective actions. There should also be clear evidence of board oversight, including how actions are implemented and monitored. Additionally, risk appetite and tolerance statements should be demonstrably applied in governance and decision-making at the board level.

Will providers be notified if their performance is declining or if monitoring intensity increases to enable targeted improvement actions?

No. Providers are responsible for regularly reviewing their own data and identifying any areas of concern. Where risks are identified, providers are expected to engage proactively with the Commission—initiating contact to report the issue and outline the corrective actions and improvement plans being implemented.

If the Commission inspects a provider, are all homes and services included? Boards are not engaged when conducting an inspection, the facility manager will be contacted. More often the provider will be looked at wholistically, however the individual home where the risk is identified will be audited. If issues are found when onsite related to practices or policies, then another provider home will be included in the inspection and audit.

How long does an inspection report take? Within a couple of weeks. The exit meeting will indicate if any issues or concerns were identified.

In an unannounced inspection – will the entry meeting include which standards or issues will be investigated? Yes, the provider will be notified of the issues and why the Commission is present.

Is there a difference between non compliance and non conformance? Non compliance is when a provider is under active supervision where case management by the Commission is underway. Non conformance is related to the process of audits of registration.