Guide
Restrictive practice register software: eight questions for the demo
Every product in this category has the same feature list. Register, authorisations, expiry alerts, reporting. Read four vendor pages and you will not be able to tell them apart, because the list is the easy part — the differences only appear when you ask what happens on a particular day.
These are eight questions to ask in a demo. They are ordered so the cheap ones come first. Each says what a thin answer sounds like, and at the end there is the same test applied to NDPRO, including the two it does not pass.
First, what you are actually buying
A register is not a list of restrictive practices. It is the record that answers, for any participant on any day: which practice, permitted by whom, under what conditions, until when, and where the evidence is.
That distinction decides everything below. A product that stores practices is a list with a search box. A product that stores permissions with lifecycles is a register. Both demo well.
The eight questions
1. "Show me an authorisation as its own record."
Not the practice with an authorisation field on it — the authorisation itself, with the authorising body, the jurisdiction, the dates and the conditions attached.
Thin answer: a text field or a file upload labelled "authorisation". That is an attachment, not a record, and nothing in the system can reason about a PDF.
2. "The participant's plan changes and the practice is replaced. What happens to the old authorisation?"
This is the question that separates the category, and almost nobody asks it. A behaviour support plan is not an authorisation — the two are separate artefacts with separate lifecycles — so a plan changing does not change what was permitted.
Thin answer: "you'd update the register." Ask who tells them to.
3. "Where does the jurisdiction live?"
Authorisation comes from the state or territory, not from the Commission, and each runs its own process. So the jurisdiction has to be a recorded field.
Thin answer: "we take it from the participant's address." Reasonable most of the time, and the Commission words the test in more than one way — in one place the state where the person lives, in another the state where the practice is used. For a cross-border participant those are not the same answer, and a system that infers cannot record which one applied.
4. "Show me a practice where authorisation is not required in that jurisdiction."
Where a state has no applicable authorisation process, the obligations do not disappear: the practice still has to be in a behaviour support plan, and the specialist provider still lodges that plan with the Commission.
Thin answer: an empty authorisation field. To anyone auditing, a blank cell reads exactly like a missing authorisation. You want "not applicable in this jurisdiction, because —" as a positive state.
5. "What does it do thirty days before an authorisation expires?"
Thin answer: "there's a dashboard." A dashboard is a place you have to remember to visit. Ask what arrives without anyone opening the product, and ask who it goes to.
6. "An unauthorised practice was used yesterday. Walk me through it."
The correct answer involves the incident pathway, not the register: an unauthorised use is a reportable incident under the Incident Management and Reportable Incidents Rules 2018 — a different obligation with a different clock from monthly reporting. There is a debrief to document and supports to adjust afterwards.
Thin answer: anything that routes this into the monthly report. Conflating the two is one of the more serious mistakes available in this area, and a product that models it wrongly will teach your team to make it.
7. "Can you produce the monthly return to the Commission?"
Ask it plainly, and get a yes or a no rather than a description of reporting.
8. "Export everything, now."
Ask to watch it happen in the demo rather than to be told it exists. What comes out, in what format, and how long it took. This is the question you will care about most at the moment you care about it least — when you are leaving, or when an auditor wants the file today.
Thin answer: "you can request an export."
The question behind the eight
Every one of them is the same question in different clothes: does the record change when the work changes, or does it change when someone remembers?
A register with four independent clocks — the authorisation's expiry, its conditions, the plan's review date, and the participant's circumstances — cannot be kept accurate by memory. Not because teams are careless. Because there is no natural moment at which someone would think to reconcile them, and the moment you find out they diverged is the moment it costs you.
The same test, applied to NDPRO
Interested party. Here it is anyway, with the failures in the same table as the passes.
| 1. Authorisation as its own record | Yes — body, jurisdiction, dates, conditions, linked to the plan |
| 2. Plan changes, old authorisation | Visible against the authorisation that permitted the old practice |
| 3. Jurisdiction recorded | A recorded field, not inferred from an address |
| 4. "Not applicable here" | A positive state rather than an empty cell |
| 5. Before expiry | Reminders that arrive rather than a dashboard you visit |
| 6. Unauthorised use | Routed to the incident register, not to monthly reporting |
| 7. Monthly return to the Commission | No — NDPRO does not generate or submit it. It holds the register the return is assembled from |
| 8. Export | One-click audit pack, and the database is yours |
Two more it does not do, in the same spirit: restrictive practice reduction plan reporting has no interface, and NDPRO will not tell you what your state requires or judge whether you are compliant. It shows what is outstanding and who it belongs to. There is no score and no green tick, which is deliberate — a percentage would be a judgement the authorising body makes, and a dashboard that grades you is a dashboard your team stops opening.
About question 7
It is worth being precise rather than apologetic, because the honest answer is more useful than either a yes or a flat no.
The monthly return is a submission. What makes it hard is almost never the submitting — it is that the return is only as good as the register it is assembled from. A practice that files on time from a register with a lapsed authorisation in it has met a deadline and not much else, and the two problems have different sizes: a late return is a late return, while a practice used past its authorisation is a reportable incident.
So the question underneath question 7 is which half you are actually buying. If your registers are already accurate and the only thing standing between you and a quiet month is the filing, buy the filing — several products do it, and NDPRO is not among them. If what is costing you is the state of the register the return comes out of, that is what this is for, and the filing is the last fifteen minutes of a problem you will have already solved.
And if you need both, say so on the application rather than ruling us out. Four founding practices for 2026 get their workflow scoped into the build rather than filed as feedback, and this is exactly the kind of thing that gets decided by which practices are in the room. There is no screen for it today and no date promised for one — but "not built" and "not going to be built" are different answers, and the difference is decided by the people who ask.
What to do with this
Take the eight questions to whichever products you are considering, including this one. The answers to 2, 4 and 6 will separate them faster than any feature comparison, because they are the questions a thin product has no rehearsed answer for.
And before any demo: pick one participant with a regulated restrictive practice in place and answer questions 1 and 5 about your current system. Whatever you buy has to be better than that, and until you have measured it you do not know what better means.
Related: what a register has to hold, field by field · Module 2A, outcome by outcome · keeping a PBS capability record current.
Note on sources: the regulatory statements above are drawn from the Commission's Rules for implementing providers and the Supplementary module: Implementing behaviour support plans, both cited in the linked guides. Read those rather than any summary, including this one.