FEDERAL COURT OF AUSTRALIA

Commissioner of the NDIS Quality and Safeguards Commission v Oak Tasmania [2026] FCA 7

ORDERS

THE COURT DECLARES THAT:

1.    The respondent, Oak Tasmania (Oak), contravened s 73J of the National Disability Insurance Scheme Act 2013 (Cth) (NDIS Act) on 474 occasions by failing to notify a reportable incident to the applicant, the Commissioner of the NDIS Quality and Safeguards Commission (Commissioner) within the required timeframes prescribed in the National Disability Insurance Scheme (Incident Management and Reportable Incidents) Rules 2018 (Cth) (Reportable Incidents Rules) as follows:

(a)    on 104 occasions, it failed to notify a reportable incident within 24 hours to the Commissioner as required by s 20 of the Reportable Incidents Rules; and

(b)    on 370 occasions, it failed to notify a reportable incident within 5 business days to the Commissioner as required by s 21 of the Reportable Incidents Rules.

2.    In providing supported independent living accommodation and services to the NDIS participant referred to as Ms D on 16 March 2021, Oak contravened s 73V of the NDIS Act by failing to provide Ms D, as required by s 6(1)(c) of the National Disability Insurance Scheme (Code of Conduct) Rules 2018 (Cth) (NDIS Code of Conduct), with supports and services in a safe and competent manner, with care and skill.

3.    In providing mealtime support services to Ms D on 24 June 2022, Oak contravened ss 73J and 73V of the NDIS Act by failing to provide Ms D:

(a)    as required by s 6(1)(c) of the NDIS Code of Conduct, with supports and services in a safe and competent manner, with care and skill; and

(b)    as required by cl 26A of Sch 1 of the National Disability Insurance Scheme (Provider Registration and Practice Standards) Rules 2018 (Cth) (NDIS Practice Standards) with a meal that was of a texture and in a manner that was appropriate to her individual needs.

4.    In providing supported independent living accommodation and services to the NDIS participant referred to as Ms H on 27 March 2021, Oak contravened s 73V of the NDIS Act by failing to provide Ms H, as required by s 6(1)(c) of the NDIS Code of Conduct, with supports and services in a safe and competent manner, with care and skill.

5.    In providing 1:1 scheduled daily support for his personal care, meal preparation, shopping and community access to the NDIS participant referred to as Mr S on 29 May 2022, Oak contravened s 73V of the NDIS Act by failing to provide Mr S, as required by s 6(1)(c) of the NDIS Code of Conduct, with supports and services in a safe and competent manner, with care and skill.

6.    In providing supported independent living accommodation and services to the NDIS participant referred to as Ms C on 10 March 2023 and 11 March 2023, Oak contravened ss 73J and 73V of the NDIS Act by failing to:

(a)    provide Ms C, as required by s 6(1)(c) of the NDIS Code of Conduct, with supports and services in a safe and competent manner, with care and skill; and

(b)    ensure that risks to Ms C were managed as required by cl 10 of Sch 1 of the NDIS Practice Standards.

7.    In providing respite care to the NDIS participant referred to as Ms W on 29 June 2023, Oak contravened ss 73J and 73V of the NDIS Act by failing to:

(a)    provide Ms W, as required by s 6(1)(c) of the NDIS Code of Conduct, supports and services in a safe and competent manner, with care and skill; and

(b)    ensure that Ms W had access to timely and appropriate supports without interruption, as required by cl 16 of Sch 1 of the NDIS Practice Standards.

THE COURT ORDERS THAT:

1.    Pursuant to s 82(3) of the Regulatory Powers (Standard Provisions) Act 2014 (Cth) and s 73ZK of the NDIS Act, Oak pay to the Commonwealth a pecuniary penalty in the amount of $1,100,000 (to be paid within 30 days from the date of these orders) for the contraventions of ss 73J and 73V of the NDIS Act which are the subject of the seven declarations above, comprising the following amounts:

(a)    $250,000 in respect of the contraventions of s 73J of the NDIS Act described in paragraph 1(a) above;

(b)    $100,000 in respect of the contraventions of s 73J of the NDIS Act described in paragraph 1(b) above;

(c)    $100,000 in respect of its contravention of s 73V of the NDIS Act concerning the incident on 16 March 2021 described in paragraph 2 above;

(d)    $100,000 in respect of its contraventions of ss 73V and 73J of the NDIS Act concerning the incident on 24 June 2022 described in paragraph 3 above;

(e)    $150,000 in respect of its contravention of s 73V of the NDIS Act concerning the incident on 27 March 2021 described in paragraph 4 above;

(f)    $120,000 in respect of its contravention of s 73V of the NDIS Act concerning the incident on 29 May 2022 described in paragraph 5 above;

(g)    $150,000 in respect of its contraventions of ss 73V and 73J of the NDIS Act concerning the incidents on 10 March 2023 and 11 March 2023 described in paragraph 6 above;

(h)    $130,000 in respect of its contraventions of ss 73V and 73J of the NDIS Act concerning the incident on 29 June 2023 described in paragraph 7 above.

2.    Oak pay the Commissioner’s costs of the proceeding fixed in the sum of $200,000 within 21 days of the date of these orders.

Note:    Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

REASONS FOR JUDGMENT

MCEVOY J:

1    By originating application and concise statement dated 19 April 2024 the applicant, the Commissioner of the NDIS Quality and Safeguards Commission (Commissioner), alleges that during the period 1 July 2019 to 1 December 2023 (Relevant Period) the respondent, Oak Tasmania (Oak), engaged in conduct that contravened ss 73J and 73V of the National Disability Insurance Scheme Act 2013 (Cth) (NDIS Act). The relevant conduct involved failures properly to notify the Commissioner of certain reportable incidents, and failures to provide supports and services to certain individuals with the care and skill required of Oak as a National Disability Insurance Scheme (NDIS) provider.

2    Oak is a registered charity and not-for-profit organisation. It has been a registered NDIS provider pursuant to s 73E of the NDIS Act since 1 July 2019.

3    Oak has admitted the contraventions alleged by the Commissioner, and on 14 August 2025 the parties jointly filed a statement of agreed facts (SOAF) for the purposes of s 191 of the Evidence Act 1995 (Cth) (Evidence Act). The parties have also provided a proposed minute of orders setting out the declarations to be made in relation to the admitted contraventions and the pecuniary penalty to be paid by Oak. The Commissioner and Oak jointly submit that the agreed pecuniary penalty is appropriate in this proceeding.

4    The orders proposed by the parties comprise:

(a)    declarations under s 21 of the Federal Court of Australia Act 1976 (Cth) (FCA Act) that Oak has contravened ss 73J and 73V of the NDIS Act;

(b)    an order pursuant to s 82(3) of the Regulatory Powers (Standard Provisions) Act 2014 (Cth) (Regulatory Powers Act), read with s 73ZK of the NDIS Act, that Oak pay a total pecuniary penalty of $1.1 million in respect of the contraventions of ss 73J and 73V of the NDIS Act; and

(c)    an order pursuant to s 43(1) of the FCA Act that Oak pay the Commissioner’s costs in the amount of $200,000.

5    In these circumstances it is necessary for the court to be satisfied of three matters:

(a)    first, that liability is established;

(b)    secondly, that it is appropriate to make the proposed declarations; and

(c)    thirdly, that it is appropriate to impose the pecuniary penalty which has been agreed.

6    In addition to the SOAF, the Commissioner relies upon:

(a)    its originating application and concise statement;

(b)    joint supplementary submissions on the issue of pecuniary penalty dated 4 December 2025; and

(c)    amended primary submissions dated 5 December 2025.

7    Oak endorses the written submissions on liability and relief made on behalf of the Commissioner and relies upon the following additional material:

(a)    a concise statement in response dated 20 September 2024;

(b)    the affidavit of Karen Mulraney affirmed on 19 September 2025;

(c)    the affidavit of Neil Joseph Walsh affirmed on 19 September 2025;

(d)    amended primary submissions dated 27 November 2025;

(e)    the joint supplementary submissions on the issue of pecuniary penalty dated 4 December 2025; and

(f)    certain further documents tendered at the hearing.

8    For the reasons that follow I am satisfied that liability has been established and that it is appropriate for the court to make the proposed declarations and impose the penalty which has been agreed. There will therefore be declarations and orders substantially in the terms proposed by the parties.

9    Given the agreement of the parties as to the relevant facts, the application of the law to those facts, and the appropriate relief, in these reasons I have drawn from the SOAF and, where appropriate, the parties’ written submissions. The SOAF is annexed to these reasons, and I will not describe the underlying facts in any more detail than is necessary to explain why I am satisfied that the proposed declarations should be made and the agreed penalty should be imposed.

THE NDIS AND THE RELEVANT STATUTORY PROVISIONS

Registered NDIS providers

10    In Commissioner of the NDIS Quality and Safeguards Commission v Valmar Support Services Ltd [2025] FCA 11 at [4] (Valmar), Raper J observed:

The purpose of the NDIS is to enable persons with disability, through the provision of tailored high quality and innovative support services that are safe (funded by the Australian government), to exercise their autonomy, facilitate their inclusion in the community, and the prevention of harms caused by support or service providers engaging in poor quality or unsafe practices: NDIS Act ss 3, 4. To achieve this end, registered NDIS providers are subject to statutory conditions and obligations. Compliance is policed by the applicant, [Commissioner], through the functions prescribed by ss 181C–181H of the NDIS Act.

11    Section 73F(1) of the NDIS Act provides that the registration of a person as an NDIS provider is subject to a number of conditions specified in s 73F(2), together with any conditions imposed by the Commissioner under s 73G, or any conditions determined by the NDIS rules under s 73H. Pursuant to s 73F(2) of the NDIS Act, these conditions relevantly include that the person must:

(a)    comply with all applicable requirements of the National Disability Insurance Scheme (Code of Conduct) Rules 2018 (Cth) (NDIS Code of Conduct), including s 6(1)(c) which requires a “Code-covered person” to provide supports and services in a safe and competent manner, with care and skill;

(b)    comply with all applicable standards and other requirements of the National Disability Insurance Scheme (Provider Registration and Practice Standards) Rules 2018 (Cth) (NDIS Practice Standards), which include:

(i)    identifying and managing risks to participants, workers and the provider: NDIS Practice Standards Sch 1 cl 10;

(ii)    ensuring each participant has access to timely and appropriate supports without interruption: NDIS Practice Standards Sch 1 cl 16; and

(iii)    where responsible for providing supports to participants who require mealtime management, ensuring that each participant receives meals that are:

(A)    nutritious, and of a texture that is appropriate to their individual needs; and

(B)    appropriately planned, and prepared in an environment and manner that meets their individual needs and preferences; and

(C)    delivered in a way that is appropriate to their individual needs and ensures that the meals are enjoyable: NDIS Practice Standards Sch 1 cl 26A;

(c)    implement and maintain the applicable incident management system in accordance with s 73Y of the NDIS Act; and

(d)    comply with all applicable requirements relating to “reportable incidents” prescribed by the National Disability Insurance Scheme (Incident Management and Reportable Incidents) Rules 2018 (Cth) (Reportable Incidents Rules) which are NDIS rules for the purposes of s 73Z of the NDIS Act.

12    Section 73J of the NDIS Act provides that a registered NDIS provider contravenes that section if they breach a condition of their registration (including those listed above).

13    Section 73V of the NDIS Act provides that a person who is subject to a requirement under the NDIS Code of Conduct and fails to comply with the requirement contravenes that section.

14    Sections 73J and 73V of the NDIS Act are civil penalty provisions.

Reportable Incidents

15    Pursuant to s 73Z(4) of the NDIS Act “reportable incident” means:

(a)    the death of a person with disability; or

(b)    serious injury to a person with disability; or

(c)    abuse or neglect of a person with disability; or

(d)    unlawful sexual or physical contact with, or assault of, a person with disability; or

(e)    sexual misconduct committed against, or in the presence of, a person with disability, including grooming of the person for sexual activity; or

(f)    the use of a restrictive practice in relation to a person with disability, other than where the use is in accordance with an authorisation (however described) of a State or Territory in relation to the person.

16    The definition of reportable incidents is modified by s 16 of the Reportable Incidents Rules and s 17 of those Rules provides that reportable incidents relevantly include alleged reportable incidents.

17    The Reportable Incidents Rules set out the responsibilities of NDIS providers and their employees for notifying reportable incidents. Pursuant to s 19 of the Reportable Incidents Rules, “a person employed or otherwise engaged by a registered NDIS provider” who becomes aware that a reportable incident has occurred must, as soon as possible, notify:

(a)    a member of the provider’s key personnel; or

(b)    a supervisor or manager of the person; or

(c)    the person who is responsible for reporting incidents that are reportable incidents to the Commissioner pursuant to s 10(1)(c) of the Reportable Incidents Rules.

18    Section 11A of the NDIS Act defines “key personnel” as being:

(a)    a member of the group of persons who is responsible for the executive decisions of the person or entity (including a director of a body corporate if the person or entity is a body corporate incorporated under the Corporations Act 2001 (Cth) and, in any other case, a member of the person’s or entity's governing body); and

(b)    any other person who has authority or responsibility for (or significant influence over) planning, directing or controlling the activities of the person or entity.

19    Pursuant to s 18 of the Reportable Incidents Rules, the provider’s key personnel and any person specified for the purposes of s 10(1)(c) of the Reportable Incidents Rules must take all reasonable steps to ensure that reportable incidents that occur in connection with the provision of supports or services by a registered NDIS provider are notified to the Commissioner.

20    If a registered NDIS provider becomes aware that certain categories of reportable incidents, which are specified in s 20(1) of the Reportable Incidents Rules, have occurred in connection with the provision of supports or services by the provider, this must be notified to the Commissioner within 24 hours: Reportable Incidents Rules s 20. The specified categories, which are a sub-set of those defined by the NDIS Act, relevantly include the serious injury of a person with disability, and the abuse or neglect of a person with disability.

21    If a registered NDIS provider becomes aware that a reportable incident not of a kind specified in s 20(1) of the Reportable Incidents Rules has occurred in connection with the provision of supports or services by the provider, this must be notified to the Commissioner in writing within 5 business days: Reportable Incidents Rules s 21. It follows that if a registered NDIS provider fails to implement an incident management system as required by Pt 2 of the Reportable Incidents Rules, or fails to comply with the requirements for notifying reportable incidents prescribed by Pt 3 of the Reportable Incidents Rules, that provider breaches a condition of their registration. Such a breach of the Reportable Incidents Rules will constitute a breach of s 73J of the NDIS Act.

22    The purpose of the requirement to notify reportable incidents can be ascertained from the NDIS Act, the Reportable Incidents Rules and the explanatory statement to the Reportable Incident Rules as including:

(a)    to enable the Commissioner to collect, correlate, analyse and disseminate information relating to reportable incidents to identify trends or systemic issues: NDIS Act s 181F;

(b)    to allow the Commissioner to take action in response to a specific reportable incident including:

(i)    referring the incident to another person or body with responsibility in relation to the incident;

(ii)    requiring or requesting the NDIS provider to undertake remedial action or carry out an internal or independent investigation; or

(iii)    carrying out an inquiry: Reportable Incident Rules s 26; and

(c)    to allow the Commissioner to focus on building the capacity of NDIS providers to respond to reportable incidents and to prevent recurrence of avoidable incidents: National Disability Insurance Scheme (Incident Management and Reportable Incidents) Rules 2018 (Cth) Explanatory Statement at 3.

THE ADMITTED CONTRAVENTIONS

23    The parties have described the contravening conduct in considerable detail in Parts D and E of the SOAF.

24    Oak admits that it did not comply with the requirements under the NDIS Act for reportable incidents and thereby contravened s 73J of the NDIS Act on 474 occasions during the Relevant Period. These are as follows, and are set out in paragraphs [16]-[17] and schedules 1 and 2 of the SOAF:

(a)    on 104 occasions where Oak failed to notify a reportable incident within 24 hours to the Commissioner as required by s 20 of the Reportable Incidents Rules; and

(b)    on 370 occasions where Oak failed to notify a reportable incident within 5 business days to the Commissioner as required by s 21 of the Reportable Incidents Rules.

25    Oak also admits that it did not comply with the NDIS Code of Conduct and the NDIS Practice Standards, thereby contravening ss 73J and/or 73V of the NDIS Act, on six occasions during the Relevant Period when providing care and support services as a registered NDIS service provider to five individuals who at all relevant times were NDIS participants and clients of Oak. The nature, circumstances and extent of these incidents and the resulting harm (or risk of harm) to each of these individuals (referred to respectively as Ms D, Ms H, Mr S, Ms C and Ms W) are set out in paragraphs [19]-[58] of the SOAF.

26    While the court is not required to accept the SOAF uncritically, in this case I accept it as proof of the facts it contains. It is credible and cogent and has the effect that evidence to prove the existence of those facts is not necessary: Evidence Act s 191(2); see also Australian Securities and Investments Commission v Kaur [2023] FCA 599 at [6] (Jackson J), citing Minister for the Environment, Heritage and the Arts v PGP Developments Pty Limited (2010) 183 FCR 10 at [35] (Stone J).

27    On this basis I accept that Oak’s liability is established.

28    The Commissioner submits, and Oak accepts, that Oak’s contraventions in relation to the reportable incidents and its failures to comply with the NDIS Code of Conduct and/or the NDIS Practice Standards in relation to Ms D, Ms H, Mr S, Ms C and Ms W involved very serious conduct.

DECLARATIONS

29    I turn then to consider whether it is appropriate to make declarations in the form proposed by the parties.

30    The nature of the power and purpose for making declarations was described by Abraham J in Commissioner of the NDIS Quality and Safeguards Commission v Australian Foundation for Disability [2023] FCA 629 at [39] (Afford) in the following terms:

The power to grant declaratory relief pursuant to s 21 of Federal Court of Australia Act 1976 (Cth) “is a very wide one” and the court is “limited only by its discretion”: Seven Network Ltd v News Ltd [2009] FCAFC 166; (2009) 182 FCR 160 at [1016], citing Forster v Jododex Australia Pty Ltd [1972] HCA 61; (1972) 127 CLR 421 (Forster) at 435. Three requirements need to be satisfied before making declarations: (1) the question must be a real and not a hypothetical or theoretical one; (2) the applicant must have a real interest in raising it; and (3) there must be a proper contradictor: Foster at 437–438. That a party has chosen not to oppose a grant of particular declaratory relief is not an impediment to such relief being granted by the Court: Australian Competition and Consumer Commission v MSY Technology Pty Ltd [2012] FCAFC 56; (2012) 201 FCR 378 at [14], [30]–[33]. Other factors relevant to the exercise of the discretion include: (a) whether the declaration will have any utility; (b) whether the proceeding involves a matter of public interest; and (c) whether the circumstances call for the marking of the Court’s disapproval of the contravening conduct: ASIC v Pegasus Leveraged Options Group Pty Ltd [2002] NSWSC 310; (2002) 41 ACSR 561 at 571; Australian Securities and Investments Commission v Monarch FX Group Pty Ltd, in the matter of Monarch FX Group Pty Ltd [2014] FCA 1387; (2014) 103 ACSR 453 at [63]; Australian Securities and Investments Commission v Stone Assets Management Pty Ltd [2012] FCA 630; (2012) 205 FCR 120 at [42].

31    Having regard to the agreed facts and the admissions which Oak has made, the parties submit that it is appropriate for the court to make that the proposed declarations.

32    In respect of Oak’s admitted contraventions of ss 73J and 73V of the NDIS Act, I am satisfied that each of the requirements identified by Abraham J in Afford at [39] are met. That is to say, the proposed declarations are in relation to live issues, the Commissioner is charged with ensuring compliance with the statutory regime, and Oak, as the subject of the declarations, accepts that they should be made.

33    I am also satisfied that the contraventions that are the subject of the proposed declarations are established by the facts and admissions set out in the SOAF, and that there would be utility in making them. The proposed declarations identify the contravening conduct, which is a matter of public importance, and record the court’s disapproval of it. It is therefore appropriate to make the declarations substantially in the terms the parties propose.

PECUNIARY PENALTY

34    Finally, it is necessary to consider whether the total pecuniary penalty which is proposed by the parties is appropriate in all the circumstances.

Civil penalty provisions

35    Section 73ZK(1) of the NDIS Act provides that the relevant civil penalty provisions are enforceable under Pt 4 of the Regulatory Powers Act.

36    The relevant provisions of the Regulatory Powers Act are as follows:

82 Civil penalty orders

Application for order

(1)     An authorised applicant may apply to a relevant court for an order that a person, who is alleged to have contravened a civil penalty provision, pay the Commonwealth a pecuniary penalty.

(2)     The authorised applicant must make the application within 6 years of the alleged contravention.

Court may order person to pay pecuniary penalty

(3)     If the relevant court is satisfied that the person has contravened the civil penalty provision, the court may order the person to pay to the Commonwealth such pecuniary penalty for the contravention as the court determines to be appropriate.

Note:     Subsection (5) sets out the maximum penalty that the court may order the person to pay.

(4)     An order under subsection (3) is a civil penalty order.

Determining pecuniary penalty

(5)     The pecuniary penalty must not be more than:

(a)     if the person is a body corporate—5 times the pecuniary penalty specified for the civil penalty provision; and

(b)     otherwise—the pecuniary penalty specified for the civil penalty provision.

(6)     In determining the pecuniary penalty, the court must take into account all relevant matters, including:

(a)     the nature and extent of the contravention; and

(b)     the nature and extent of any loss or damage suffered because of the contravention; and

(c)     the circumstances in which the contravention took place; and

(d)     whether the person has previously been found by a court (including a court in a foreign country) to have engaged in any similar conduct.

83 Civil enforcement of penalty

(1)     A pecuniary penalty is a debt payable to the Commonwealth.

(2)     The Commonwealth may enforce a civil penalty order as if it were an order made in civil proceedings against the person to recover a debt due by the person. The debt arising from the order is taken to be a judgement debt.

84 Conduct contravening more than one civil penalty provision

(1)     If conduct constitutes a contravention of 2 or more civil penalty provisions, proceedings may be instituted under this Part against a person in relation to the contravention of any one or more of those provisions.

(2)     However, the person is not liable to more than one pecuniary penalty under this Part in relation to the same conduct.

85 Multiple contraventions

(1)     A relevant court may make a single civil penalty order against a person for multiple contraventions of a civil penalty provision if proceedings for the contraventions are founded on the same facts, or if the contraventions form, or are part of, a series of contraventions of the same or a similar character.

Note:     For continuing contraventions of civil penalty provisions, see section 93.

(2)     However, the penalty must not exceed the sum of the maximum penalties that could be ordered if a separate penalty were ordered for each of the contraventions.

Relevant legal principles

37    The power to impose a penalty is to be exercised judicially, that is, fairly and reasonably: Australian Building and Construction Commissioner v Pattinson (2022) 274 CLR 450 at [40] (Kiefel CJ, Gageler, Keane, Gordon, Steward and Gleeson JJ) (Pattinson). It is to be borne in mind that the discretion to be applied in setting a pecuniary penalty must be guided by the relevant statutory provisions. However, the legal principles that govern the assessment of the quantum of a pecuniary penalty that should be imposed for contravention of civil penalty provisions are well established. These principles are summarised below.

38    Deterrence, both specific and general, is the primary purpose of pecuniary penalties: Pattinson at [15]; Commonwealth of Australia v Director, Fair Work Building Industry Inspectorate (2015) 258 CLR 482 at [55] (French CJ, Kiefel, Bell, Nettle and Gordon JJ) (Agreed Penalties Case), referring to Trade Practices Commission v CSR Ltd [1991] ATPR 41-076 at 52,152 (French J) (CSR). Specific deterrence is for the purpose of deterring repetition of the contravening conduct by the contravener and general deterrence is for the purpose of deterring others who might be tempted to engage in similar contraventions: Pattinson at [15], [17]; Agreed Penalties Case at [55], referring to CSR at 52,152. Pecuniary penalties are “primarily if not wholly protective in promoting the public interest in compliance”: Agreed Penalties Case at [55], referring to CSR at 52, 152; Pattinson at [15].

39    While a penalty should not be so high that it is oppressive, it should not be so low as to be regarded by the contravener as “an acceptable cost of doing business”: Pattinson at [17], [40]-[41]; Australian Building and Construction Commissioner v Construction, Forestry, Mining and Energy Union (2018) 262 CLR 157 at [116] (Keane, Nettle and Gordon JJ) (ABCC v CFMEU); Australian Competition and Consumer Commission v TPG Internet Pty Ltd (2013) 250 CLR 640 at [66] (French CJ, Crennan, Bell and Keane JJ); Singtel Optus Pty Ltd v Australian Competition and Consumer Commission (2012) 287 ALR 249; [2012] FCAFC 20 at [62]-[63] (Keane CJ, Finn and Gilmour JJ) (Singtel Optus); NW Frozen Foods Pty Ltd v Australian Competition and Consumer Commission (1996) 71 FCR 285 at 293 (Burchett and Kiefel JJ) (NW Frozen Foods); Australian Securities and Investments Commission v Westpac Banking Corporation [2019] FCA 2147 at [255] (Wigney J) (ASIC v Westpac Banking); Australian Securities and Investments Commission v Lanterne Fund Services Pty Limited [2024] FCA 353 at [116] (McEvoy J) (Lanterne). A penalty must have the necessary “sting or burden” to secure “the specific and general deterrent effects that are the raison d’être of its imposition”: ABCC v CFMEU at [116].

40    While it is important to have regard to the prescribed maximum penalty, the court should not start with the maximum penalty and then proceed by way of making proportional deductions from this amount: Markarian v The Queen (2005) 228 CLR 357 at [31] (Gleeson CJ, Gummow, Hayne and Callinan JJ) (Markarian). Rather, as I observed Lanterne at [121], consideration of the maximum penalty allows the court to make comparison between the worst possible case and the case that it is being asked to address: see Australian Securities and Investments Commission v Westpac Securities Administration Limited (2021) 156 ACSR 614; [2021] FCA 1008 at [24] (O’Bryan J), citing Markarian at [31]. As the plurality emphasised in Pattinson at [10], citing Australian Competition and Consumer Commission v Reckitt Benckiser (Australia) Pty Ltd (2016) 340 ALR 25; [2016] FCAFC 181 at [156] (Reckitt), the maximum penalty is not reserved only for the most serious examples of offending conduct and, instead, what is required is that there be “some reasonable relationship between the theoretical maximum and the final penalty imposed”. The requisite relationship will be established where the maximum penalty does not exceed what is reasonably necessary to deter future contraventions of a like kind by the contravener, and by others: Pattinson at [10]. Considerations of deterrence, and the protection of the public interest, justify the imposition of the maximum penalty where it is apparent that no lesser penalty will be an effective deterrent against further contraventions of a like kind: Pattinson at [50].

41    As will be apparent from the extracted text above, s 82(6) of the Regulatory Powers Act requires the court to take into account all relevant matters, including those there specified.

42    The factors that the court should take into consideration, keeping in mind the objective of pecuniary penalty provisions, have also been essayed in numerous cases. In Pattinson at [18], while noting that they should not be regarded as a “legal checklist” (at [18], [19] and [54]), the plurality endorsed the following factors identified by French J in CSR at 52,152-52,153:

1.    The nature and extent of the contravening conduct.

2.    The amount of loss or damage caused.

3.    The circumstances in which the conduct took place.

4.    The size of the contravening company.

5.    The degree of power it has, as evidenced by its market share and ease of entry into the market.

6.    The deliberateness of the contravention and the period over which it extended.

7.    Whether the contravention arose out of the conduct of senior management or at a lower level.

8.    Whether the company has a corporate culture conducive to compliance with the Act, as evidenced by educational programs and disciplinary or other corrective measures in response to an acknowledged contravention.

9.    Whether the company has shown a disposition to co-operate with the authorities responsible for the enforcement of the Act in relation to the contravention.

43    Ultimately the court’s task is to determine the “appropriate” penalty in the circumstances of the case: Pattinson at [19]; Australian Building and Construction Commissioner v Construction, Forestry, Mining and Energy Union (2017) 254 FCR 68 at [101] (Dowsett, Greenwood and Wigney JJ). The process of determining an appropriate penalty involves multi-factorial decision-making, where the result is arrived at by a process of intuitive or “instinctive synthesis”: Reckitt at [44]; Australian Competition and Consumer Commission v Murray Goulburn Co-Operative Co Ltd [2018] FCA 1964 at [36] (Beach J). The process requires a consideration of all factors taken together by reference to the civil penalty provisions contravened in their statutory context: Australian Securities and Investments Commission v Australia and New Zealand Banking Group Limited [2018] FCA 155 at [22(5)] (Middleton J); see also Lanterne at [126].

44    In Pattinson at [45]-[46] the plurality recognised that some concepts familiar from criminal sentencing, such as the course of conduct and totality principles and parity may usefully be deployed in the enforcement of the civil penalty regime. The course of conduct principle may apply where there is an interrelationship between the factual and legal elements of two or more contraventions, such that the court may “group” those contraventions together as a single course of conduct, so as to avoid double punishment in respect of the relevant acts or omissions that make up multiple contraventions: Construction, Forestry, Mining and Energy Union v Cahill (2010) 194 IR 461 at [39]-[42] (Middleton and Gordon JJ); see also Singtel Optus at [53], citing Australian Competition and Consumer Commission v Telstra Corporation Limited (2010) 188 FCR 238 at [231]-[235] (Middleton J) (ACCC v Telstra). In other words, where conduct engaged in by an offender may technically comprise a number of separate offences, if that conduct can fairly be characterised as a single act or course of conduct, the penalties imposed should be attuned to reflect that fact: ASIC v Westpac Banking at [265].

45    Pursuant to s 85(1) of the Regulatory Powers Act, the court may make a single civil penalty order against a person for multiple contraventions of a civil penalty provision if proceedings for the contraventions are founded on the same facts, or if the contraventions form, or are part of, a series of contraventions of the same or a similar character.

46    In determining the appropriate penalty for multiple contraventions, the court should have regard to the totality principle as a final consideration of whether the cumulative total of the penalty is just and appropriate and not excessive having regard to the relevant contravening conduct considered as a whole: ASIC v Westpac Banking at [272], [308]; Chief Executive Officer of the Australian Transaction Reports and Analysis Centre v Westpac Banking Corporation (2020) 148 ACSR 247; [2020] FCA 1538 at [69] (Beach J) (AUSTRAC).

47    As to parity, the court is not generally assisted by a comparison of penalties imposed in other cases, due to the widely differing circumstances of each case: Singtel Optus at [60], citing ACCC v Telstra at [215]. Nonetheless, the Commissioner referred the court to a number of recent cases involving contraventions of the NDIS Act by NDIS providers. These are Afford, Valmar, Commissioner of the NDIS Quality and Safeguards Commission v LiveBetter Services Ltd [2024] FCA 374 (Raper J), Commissioner of the NDIS Quality and Safeguards Commission v Aurora Community Care Pty Ltd (in liq) (No 2) [2025] FCA 1237 (Abraham J), Commissioner of the NDIS Quality and Safeguards Commission v Lifestyle Solutions (Aust) Ltd (Hakone House Proceeding) [2025] FCA 1393 (Abraham J) (Hakone House) and Commissioner of the NDIS Quality and Safeguards Commission v Lifestyle Solutions (Aust) Ltd (Reportable Incidents Proceeding) [2025] FCA 1394 (Abraham J).

48    I note, finally, that while the penalty proposed in this case was agreed between the parties, the court is not bound to accept it: see Australian Competition and Consumer Commission v Coles Supermarkets Australia Pty Ltd [2014] FCA 1405 at [70]-[73] (Gordon J) and Agreed Penalties Case at [46].

49    As I observed in Australian Securities and Investments Commission v Dixon Advisory & Superannuation Services Ltd [2022] FCA 1105 at [43], the process of fixing the quantum of a civil penalty is not an exact science. There is a permissible range in which “courts have acknowledged that a particular figure cannot necessarily be said to be more appropriate than another”: Agreed Penalties Case at [47], citing Minister for Industry, Tourism & Resources v Mobil Oil Australia Pty Ltd [2004] ATPR 41-993 at 48,626 [51] (Branson, Sackville and Gyles JJ) and NW Frozen Foods at 290-291. Therefore, in cases such as this which involve an agreed penalty the question for the court is whether that agreed penalty falls within the range of appropriate penalties and is an appropriate penalty, rather than the appropriate penalty: Australian Competition and Consumer Commission v Google LLC (No 4) [2022] FCA 942 at [20] (Thawley J), referring to Australian Securities and Investments Commission v Australia and New Zealand Banking Group Limited (No 3) [2020] FCA 1421 at [78] (Allsop CJ).

Is the total pecuniary penalty proposed appropriate?

The nature, extent and circumstances of the contravening conduct

50    Reportable Incidents are serious matters which centre around the safety of individuals who are some of the most vulnerable in Australian society. The Commissioner is correct in submitting that the legislative regime’s purpose is defeated if NDIS providers are not notifying reportable incidents within the timeframes prescribed. In the context of statutory reporting requirements, it has been observed that a failure to report not only results in the relevant regulator being “deprived of timely information”, but it also “hinders law enforcement efforts”: see AUSTRAC at [94]-[95]. The Commissioner submits, and I accept, that in cases involving a failure to notify reportable incidents, the delay and lack of transparency not only deprives the Commissioner of information to which she is entitled, it also compromises the ability of the Commissioner to keep participants safe.

51    The Commissioner is also correct in submitting that Oak’s contraventions of the NDIS Act, through its non-compliance with the NDIS Code of Conduct and Practice Standards, caused harm to, or at least put at risk of harm, persons with disability who require protection. That harm or risk of harm was of the utmost seriousness. The nature, extent and circumstances of Oak’s conduct in relation to its five relevant individual clients is described in detail in paragraphs [19]-[58] of the SOAF.

52    It is important to note that no evidence has been adduced that Oak intended to breach the law by the contravening conduct. The Commissioner submits, however, and Oak agrees, that the contravening conduct could have been avoided if Oak had put in place adequate reporting processes and guidelines for its staff members for reporting incidents within the timeframes required for each reportable incident. I accept that this is so.

The harm/loss suffered as a result of the contravening conduct

53    The Commissioner submits, and Oak accepts, that by reason of Oak’s conduct, the relevant contraventions resulted in harm and suffering (or at least the serious risk of harm and suffering) to persons with disability. In addition to the harm suffered by, or the serious risk of harm caused, to the five relevant NDIS participants, Oak accepts that harm was also suffered by family members, friends and carers of these individuals. Oak accepts that family members, friends and carers likely experienced stress and anxiety in entrusting Oak as the provider of a necessary service in circumstances where those services were provided in an environment in which there was non-compliance with the rules and regulations designed to protect them.

54    As Oak failed to notify the Commissioner of the relevant reportable incidents within the requisite time, I accept that the persons impacted by these incidents may also have been deprived of prompt, adequate and necessary treatment or responses to the harm that they suffered, or that there was at least a risk of this being so.

The size and financial position of Oak

55    Oak is a public company limited by guarantee. As has been mentioned, it is a not-for-profit organisation and a charity registered with the Australian Charities and Not-for-Profits Commission. However, as Abraham J observed in Afford at [67], the fact that a contravenor is a not-for-profit entity “does not obviate the significance of specific deterrence, or of the very serious nature of the contraventions”. The Commissioner submits, and I accept, that the conduct in this case, given the seriousness of the contraventions and their potential to cause significant detriment (including fatality) to vulnerable members of the community, requires a strong specific and general deterrent message.

The existence of prior contraventions

56    It is relevant to observe that Oak has not been found liable for similar conduct to that which has occurred here.

Cooperation

57    In paragraphs [59] and [61] of the SOAF, the parties agree that Oak has cooperated with the investigation conducted by the NDIS Quality and Safeguards Commission and made admissions at an early stage of the proceeding and before the filing or service of any evidence. As the Commissioner submits, such cooperation obviously avoids protracted investigation and litigation, and so enables the resources of the Commission and the Commissioner to be dedicated to other investigations, and for court resources to be spared.

Corrective measures

58    Oak submits, and I accept by reference to certain documents tendered at the hearing, that it has put in place a number of corrective measures in response to its admitted contraventions. These include implementing comprehensive incident reporting and management procedures, a Complex Health Care Policy and a Learning and Development (Complex Care) Credentialling procedure. It is apparent that Oak has also taken specific steps in respect of improving the supports and services provided to Ms D, Ms H, Mr S, Ms C, and Ms W, including by way of training and communications with staff and, in some cases, disciplinary measures.

59    Oak submits that the measures which have been established following the contravening conduct demonstrate a corporate culture of compliance in which Oak has sought to address its admitted non-compliance in meaningful ways. As senior counsel for the Commissioner observed in oral submissions, however, no matter how well prepared and well written a policy is, the ultimate measure and efficacy of any such policy relies heavily upon its implementation and adherence: see Hakone House at [60]. I accept that this is so.

The acquisition of Oak’s parent company

60    Oak draws attention to the fact that since the contravening conduct its parent company, Possability Group Ltd (Possability Group), has undergone a merger with Independence Australia Group Limited (IAG). It is apparent from the affidavits that Oak has filed in this proceeding that effective from 1 September 2025, IAG became the sole member of Possability Group and the ultimate parent company of Oak. All existing directors of Oak and Possablity Group resigned and were replaced by IAG nominee directors. Oak submits that this merger of IAG and Possability Group, as well as the complete turnover of Oak’s senior leadership, indicate a reduced need for specific deterrence than would be the case had Oak continued to have the same separate existence and senior management as it did throughout the Relevant Period. Oak submits also that the agreed penalty appropriately reflects this consideration.

61    I accept that specific deterrence as a penalty consideration may be moderated where a respondent has merged with another entity in the period after the contravening conduct: Australian Securities and Investments Commission v Statewide Superannuation Pty Ltd [2021] FCA 1650 at [100] (Besanko J) (Statewide); Australian Securities and Investments Commission v LGSS Pty Ltd (No 3) [2025] FCA 205 at [135] (O’Callaghan J). This is because the respondent, as it existed at the time of the contravening conduct, has ceased to have a separate existence: see Statewide at [99]-[100].

62    I also accept, as Oak submits, that a change in composition of the board and senior management of a contravening entity after the relevant period is also a factor that may moderate any penalty that is to be imposed: see Australian Securities and Investments Commission v Chemeq Ltd (2006) 234 ALR 511; [2006] FCA 936 at [97], [99] (French J).

Proposed pecuniary penalty

63    The maximum penalty for a contravention of the relevant civil penalty provisions in the NDIS Act for a body corporate is 1,250 penalty units: NDIS Act ss 73J and 73V, read with Regulatory Powers Act s 82(5)(a)). The value of an individual penalty unit increased over the Relevant Period as follows:

(a)    from 1 July 2017 to 30 June 2020, it was $210;

(b)    from 1 July 2020 to 31 December 2022, it was $222;

(c)    from 1 January 2023 to 30 June 2023, it was $275; and

(d)    from 1 July 2023 it was $313.

64    The Commissioner submits, and I accept, that the maximum penalty for a single contravention of ss 73J and 73V of the NDIS Act therefore ranged from $262,500 to $391,250 over the Relevant Period.

65    In relation to the six contraventions of the NDIS Code of Conduct and Practice Standards admitted by Oak, the Commissioner submits, and Oak agrees, that:

(a)    four attracted a maximum penalty of $277,500; and

(b)    two attracted a maximum penalty of $343,750.

66    The total maximum penalty for these contraventions would thus be $1,797,500.

67    In relation to the 474 occasions admitted by Oak where it failed to notify a reportable incident as required by the Reportable Incidents Rules, the Commissioner submits, and Oak agrees, that:

(a)    242 contraventions attracted a maximum penalty of $262,500;

(b)    216 contraventions attracted a maximum penalty of $277,500;

(c)    11 contraventions attracted a maximum penalty of $343,750; and

(d)    five contraventions attracted a maximum penalty of $391,250.

68    The total maximum penalty for these contraventions would thus be $129,202,500.

69    The Commissioner submits that where there are so many contraventions involved, as here, it may become an “arid exercise” to engage in a mere arithmetical calculation and it may not be useful to calculate a maximum aggregate penalty by reference to such a number: Australian Securities and Investments Commission v Commonwealth Bank of Australia [2020] FCA 790 at [65] (Beach J) citing Australian Competition and Consumer Commission v Coles Supermarkets Pty Ltd (2015) 327 ALR 540; [2015] FCA 330 at [17], [18], [84] and [85] (Allsop CJ) (Coles). This is especially so where the potential aggregate maximum penalty results in an amount that would be well beyond what a court would ever impose: Coles at [18]-[82].

70    In such circumstances, and as I have described, the court has adopted an approach of determining the appropriate penalty by reference to all relevant considerations, in particular deterrence, and by taking a broad view of the course or courses of conduct: Reckitt at [157]; Coles at [18]. In like cases the court has been prepared to impose a single penalty by reference to the courses of conduct involved, and having due regard to the totality principle: see Coles at [85]. It is to this end that the parties have proposed the total aggregate penalty of $1.1 million. That total amount is the sum of the following indicative penalties proposed for each category of contravening conduct:

(a)    $250,000 for the contraventions of s 20 of the Reportable Incidents Rules and thus s 73J of the NDIS Act in respect of Oak’s failure on 104 occasions to notify a reportable incident to the Commissioner within 24 hours;

(b)    $100,000 for the contraventions of s 21 of the Reportable Incidents Rules and thus s 73J of the NDIS Act in respect of Oak’s failure on 370 occasions to notify a reportable incident to the Commissioner within 5 business days;

(c)    $100,000 for the contraventions of s 6(1)(c) of the NDIS Code of Conduct and in turn s 73V of the NDIS Act concerning Ms D on 16 March 2021;

(d)    $100,000 for the contraventions of s 6(1)(c) of the NDIS Code of Conduct, cl 26A of Sch 1 of the NDIS Practice Standards and therefore ss 73V and 73J of the NDIS Act concerning Ms D on 24 June 2022;

(e)    $150,000 for the contraventions of s 6(1)(c) of the NDIS Code of Conduct and in turn s 73V of the NDIS Act concerning Ms H on 27 March 2021;

(f)    $120,000 for the contraventions of s 6(1)(c) of the NDIS Code of Conduct and therefore s 73V of the NDIS Act concerning Mr S on 29 May 2022;

(g)    $150,000 for the contraventions of s 6(1)(c) of the NDIS Code of Conduct and cl 10 of Sch 1 of the NDIS Practice Standards and therefore ss 73V and 73J of the NDIS Act concerning Ms C on 10 March 2023 and 11 March 2023; and

(h)    $130,000 for the contraventions of s 6(1)(c) of the NDIS Code of Conduct, cl 16 of Sch 1 of the NDIS Practice Standards and therefore ss 73V and 73J of the NDIS Act concerning Ms W on 29 June 2023.

71    The parties submit the above amounts appropriately reflect the specific nature, extent and circumstances of the contraventions for each category of conduct. This includes a higher penalty for the contraventions of s 20 of the Reportable Incidents Rules and thereby s 73J of the NDIS Act in respect of Oak’s failure to notify a reportable incident within 24 hours given that this conduct relates to a large number of incidents that were serious and urgent in nature.

Conclusion on pecuniary penalty

72    As has been mentioned, the High Court has endorsed the practice of the court acting upon agreed penalty submissions, observing that there is an important public policy involved in promoting predictability of outcomes in civil penalty proceedings: Agreed Penalties Case at [46]. The practice of receiving, and if appropriate accepting, agreed penalty submissions increases the predictability of outcome for regulators and for wrongdoers. This encourages corporations to acknowledge contraventions, which in turn assists in avoiding lengthy and complex litigation: Agreed Penalties Case at [46]. It is entirely consistent with the nature of civil penalty proceedings for the court to make orders by consent and to approve a compromise of proceedings on terms proposed by the parties, provided the court is persuaded that what is proposed is appropriate: Agreed Penalties Case at [57].

73    Considered as a whole, I am satisfied that the conduct the subject of this proceeding which is described in the SOAF and admitted by Oak was extensive and serious. In weighing all relevant matters, and endeavouring to balance the need for specific and general deterrence with the importance of ensuring that the amount of the pecuniary penalty is not so high as to punish and be oppressive, I consider that the total aggregate pecuniary penalty of $1.1 million which the parties have agreed is appropriate in the circumstances of this case. There will therefore be an order that Oak pay to the Commonwealth a pecuniary penalty in this amount.

COSTS

74    The parties have agreed that Oak should pay the Commissioner’s costs of the proceeding, to be fixed in the amount of $200,000. I am satisfied that this is appropriate in all the circumstances and there will be an order in these terms.

Associate:

Dated:    19 January 2026

ANNEXURES

Annexure A – Statement of Agreed Facts

Annexure A

This page is intentionally left blank.