Observations and recommendations regarding the NDIS Quality and Safeguards Commission

Submission to Joint Standing Committee on the NDIS

Inquiry into the NDIS Quality and Safeguards Commission

Kai Sinor and Louise Butler, July 2020

Introduction

Kai Sinor  is a practicing  solicitor with MPS Law specialising in administrative law and

regulatory matters. Prior to joining MPS Law, Kai was Assistant Director, Compliance with the NDIS Quality and Safeguards Commission (the Commission) in South Australia for a period of one year from the Commission’s establishment in July 2018. As Senior Lawyer at MPS Law he provides legal services to businesses in the disability sector on NDIS and related regulatory and commercial law matters. Kai has worked across a range of regulatory and investigative settings, including the UK’s Competition and Markets Authority, inquiries into deaths in custody and Aboriginal and Torres Strait Islander Corporations.

Louise Butler is a Teaching Specialist in the School of Social Work at Flinders University. Louise’s most recent past position was Director, Behaviour Support with The Commission in South Australia for a period of eighteen months from inception in the state in July 2018. This followed a career in Disability related roles in South Australia and the United Kingdom.

Kai and Louise collaborate to explore opportunities to contribute to the safeguarding of people with Disabilities and their supports. This is primarily achieved through enhancing the capacity of Registered NDIS Providers to understand and comply with their regulatory obligations as outlined in the National Disability Insurance Scheme Act 2013 (Cth) (NDIS Act), NDIS rules and related instruments.

Louise and Kai gained unique insights into the operations of the Commission through the early establishment phase and through their current roles supporting and advising Providers and participants to navigate the new regulatory framework.

The observations and recommendations provided are the result of reflections on the expertise gained in this area and observations regarding how the service may benefit from adaptations or enhancements.

TOR #1

Monitoring, investigation and enforcement powers available to the Commission and how these are exercised in practice

Constraints on the power of delegation impact how statutory powers are deployed

1.  Subsection 202B of the NDIS Act  limits the NDIS Commissioner’s power to delegate

compliance and enforcement powers and functions to staff who are SES employees.1 This increases the administrative burden of decision-making and planning processes relating to the exercise of these powers (briefings, meetings, updates etc.). Where such powers are exercised, close oversight and monitoring by senior management follows.

1National Disability Insurance Scheme Act 2013 (Cth) (‘NDIS Act’) s 202B limits the Commissioner’s power of delegation in s 202A; powers and functions under Division 8 of Part 3A of Chapter 4 of the NDIS Act may only be delegated to an SES employee, or acting SES employee. This includes incidental powers and functions under the Regulatory Powers (Standard Provisions) Act 2014 (Cth).

1

2. In a field of nascent regulatory practice, control and supervision of the exercise of enforcement powers is appropriate. 2 However, s 202B centralises administrative control of a suite of

   regulatory powers. We consider that centralised administrative control impacts how

responsively some regulatory tools can be deployed. In particular, powers typically used for ‘lower’ order compliance problems, such as compliance notices, civil penalty infringement notices and monitoring (inspection) warrants. To the extent there is caution, reluctance or difficulties exercising these powers in appropriate cases, the regulatory strategy shifts toward consultation, persuasion and the provision of technical assistance. While a compliance orientated approach is consistent with the policy design for the regulatory framework, this may reduce the credibility of the sanction.

TOR #2

Adequacy and effectiveness of NDIS Code of Conduct and NDIS Practice Standards

3. The NDIS regulatory architecture has unusual characteristics. It consists of the NDIS Act, “rules” and “guidelines” prescribing matters under the Act, which also form part of the legislation.3 Supporting guidance is set out in policy and “guidance” (informal guidelines) produced by the Commission.4 As regulator, the Commission is responsible for administering the Practice Standards and Code of Conduct. However, in practice the substantive task of interpreting and applying the Practice Standards is carried out predominantly by Approved

Quality Auditors (auditors).5

4. The intent of the regulatory design is to devolve routine compliance evaluations away from the Commission to auditors. From a compliance perspective, the audit process enables providers to interact with auditors about what is required and in doing so, strengthen their understanding of how regulatory requirements are interpreted and applied. These interactions are important because it provides a ‘feedback loop’ to shape education activities and build regulatory intelligence on those areas where there are higher risks of non-compliance and the drivers of compliance.

5. By decentralising the audit function, the Commission’s ability to monitor how regulatory requirements are interpreted and gather intelligence from the ground is diminished. We do not suggest that quality audits be centralised, but work is required to close the ‘feedback loop’. Consideration of mechanisms for ‘quality assuring’ how auditors interpret and apply the Practice Standards and remedies that are available in relation to auditors’ decisions is also required. This is discussed further at Attachment A.

2 For example, those relating to banning orders, enforceable undertakings and injunctions. See NDIS Act (n 1) ss 73ZN, 73ZP, 73ZQ. 3 NDIS Act (n 1) s 209(1). 4 Guidance and policy (‘informal guidelines’) are drafted by the NDIS Commissioner to provide guidance on how requirements under the NDIS Practice Standards and NDIS Code of are to be interpreted. Where legislation does not provide clear direction as to how discretion is to be exercised, decision-makers may refer to informal guidelines for guidance. Generally, these documents should be applied by the Administrative Appeals Tribunal (‘AAT’) unless there is good reason not to do so: Re Drake and Minister for Immigration and Ethnic Affairs (No 2) [1979] AATA 179. Both courts and the AAT have shown reluctance to regard non-statutory guidelines and informal policies as binding. Such materials cannot lay down mandatory or determinative requirements and as they do not have the force of law, opportunities for using them in judicial review proceedings are limited and their misconstruction cannot itself amount an error of law. See also Australian Law Reform Commission (Cth), Principled Regulation: Federal Civil and Administrative Penalties in Australia, Report No 95 (2003) 251-252. 5 See NDIS Act (n1) s 73E(1)(c).

2

6. An area we suggest also requires further work is the Commission’s capabilities to undertake proactive, risk-based, compliance monitoring. In particular, the criteria for assessing provider risk. A key challenge in developing and implementing ‘risk-responsive’ compliance monitoring is the absence of comprehensive and reliable data. Although datasets may develop over time within the Commission, the immediate challenge is to develop indicators of risk so that systems and processes can be put in place now to capture and store information that is relevant to those indicators.

The NDIS regulatory architecture is a ‘principles-based’ regulatory framework

7. By nature, principles are expressed broadly. This, coupled with decentralised third-party audits, affects how regulatory requirements are interpreted and applied, and how enforcement is carried out. In a principles-based regulatory framework, interactions between the regulator, regulated and others (i.e. quality auditors) is central to developing a shared understanding

   about meaning and what is required. This is discussed further in Attachment B and

Attachment C at [6]-[10].

In practice, the interpretation of meaning of the NDIS Practice standards is anchored in a system focus

8. The NDIS has a deliberate focus on internal systems of management and controls relevant to quality, safety, and human rights. This is to be expected in a principles-based regulatory framework, which tends toward a stronger focus on internal management systems.6 The focus toward management systems occurs because these systems contain the internal rules, processes and other controls that are preconditions to compliance with, and fulfilment of, broader objectives involving abstract concepts such as ‘dignity’ and ‘choice and control’.

9. Despite the strong focus on individual outcomes and person-centred care within the Practice Standards, audit and other compliance testing may focus more on ‘concrete’, objectively measurable elements that are identified as markers of quality and safety in service provision. This is particularly the case where there is limited understanding of meaning and purpose of

   rules that express broadly stated abstract concepts. Attachment A at [4]-[5] suggests

preliminary research to elicit feedback from auditors on those areas of the Practice Standards that are difficult to interpret or apply.

Compliance is a process, not an event

10. Currently, the primary mechanism for ‘testing’ compliance is through third-party audits.7 We note that the timing and focus of both quality audits and (to a lesser extent) ‘for cause’

    inspections is reasonably predictable. This creates a tendency for providers to view

compliance as a time-bound event.

11. A compliance approach focuses on repairing harm, correcting defects, securing future compliance. The goal is preventative (not punitive) and the style is conciliatory and relies on persuasion, education, negotiation and bargaining to attain results.8 Although enforcement powers may be intimated, compliance-orientated strategies do not rely on the use of sanctions.

6 Julia Black, ‘Rise, Fall and Fate of Principles Based Regulation’ (2010) (Working Paper No 17/2010, Law Department, London School of Economics, Society and Economy Working Papers, 2010) 8. 7 Inspections may be carried out by the NDIS Commission ‘for cause’ which are typically focussed on the discrete issues raised in a complaint, reportable incident or intelligence. 8 In contrast, enforcement is prospective, responding to a problem and negotiating future conformity to standards that are administratively determined. See Julia Black, ‘Penalties: Policy, Principles and Practice in Government Regulation’ (2001) (Australian Law Reform Commission Conference Papers, 2001) 4.

3

Partnership is therefore pivotal and the regulatee must be both willing and able to accept responsibility for ensuring standards are met on an ongoing basis throughout the ‘process’.9

12. What counts as ‘compliance’ is not simply a matter of conformity to a rule; compliance is a matter of interpretation; interpretation of rules and interpretation of facts.10 Interpretation occurs through an ongoing, long-term, process that evolves through different forms of interaction between the regulator, regulatee and others, that occur over time. Refer to Attachment B for discussion of the factors that influence the compliance process in a principles-based regulatory framework.

Risk-based compliance monitoring in a principles-based regulatory framework

13. Faced with finite resources, risk-based prioritisation in inspection and enforcement activities is indispensable. There are two preconditions for effective assessment and prioritisation of risk: (a) criteria to assess individual risk and rank according assessed risk levels and (b) data on all (or a majority) of regulatees that allows assessment of their individual level of risk.

Criteria for assessing risk

14. To our knowledge, the NDIS Commission does not yet have an organisational wide framework for systematically analysing provider risk or tools and guidelines to assist enforcement staff to assess the relative risk of different types of violations and rank them according to the potential risk they present. If the absence of framework and useable tool is not available to Commission staff then this is a critical gap.

Data to assess risk

15. The OECD recommends that, in the absence of comprehensive (and/or fully reliable) data, agencies should rely on interpreting what data exists.11 In these circumstances, the minimum objective is to establish what sectors or market segments appear to generate or cause the most harm or have the greatest potential for non-compliance.

Proactive compliance monitoring

16. In principle, reactive (‘for cause’) inspections should be a minority of the total volume of inspections carried out and base-level frequency of inspections is required to maintain credible threat of detection.12 Unannounced inspections led by the NDIS Commission should be a central feature the compliance program. The vast majority of these inspections should be proactive, with targeting based on risk assessment (which are based on data from a variety of sources).13 Risk factors taken into account for this targeting should include at least intrinsic risk of the activity, scope of operations and vulnerability factors (location, population served, communication difficulties).

17. Relevantly, we suggest that the Netherlands Ministry of Justice’s ‘Table of Eleven’ can be usefully adapted as a risk assessment tool for NDIS quality and safeguarding. This is discussed further in Attachment D at [7].

9 See Black (n 6) 9. 10 See Keith Hawkins, Environment and Enforcement (Oxford University Press, 1984). 11 OECD, Best Practice Principles for Regulatory Policy: Regulatory Enforcement and Inspections (Report, 2014) 28 (‘OECD Regulatory Enforcement Best Practice Report’). 12 However, this is difficult whether data and tools to support risk analysis are not available (see [6] above). 13 OECD, Regulatory Enforcement and Inspections Toolkit (Report, 2018) 21-23 (‘OECD Enforcement and Inspections Toolkit’).

4

The balance between clarity, precision, complexity and use of different ‘rule’ types impacts implementation of regulatory strategy

18. Generally, imprecise rules with broadly framed language offer flexibility at the expense of clarity and certainty. The use of principles creates space within regulatory requirements in which providers, auditors and the NDIS Commission can exercise choice and discretion. With this discretion comes the need and responsibility to work out what needs to be done. A challenge for regulatory strategy is to strike a balance between guidance (to give certainty and reduce interpretive risk) and encouraging providers to think for themselves. As noted above at [7], auditors also have a pivotal role in the interpretation of meaning under the regulatory design.

19. If changes to instruments that contain the NDIS Practice Standards or NDIS Code of Conduct are contemplated, consideration should be given to the effect of how changes to the rule dimensions may affect the choice or implementation of regulatory strategy. This is discussed further at Attachment C at [1]-[2].

Clarity of the NDIS Code of Conduct and when it is applied

20. The broad aim of both the Practice Standards and Code of Conduct (the Code) is to establish minimum standards. Requirements of the Practice Standards are stated broadly, enabling a diverse range of entity and business types to self-adapt, where required. The requirements of the Practice Standards are opaque, but this is consistent with the objective of standard setting.

21. The Code applies to both registered and unregistered providers and is thus broader in application. While the Code also sets standards, it is applied primarily as a tool to sanction behaviours. In particular, workers, unregistered providers, and those registered providers whose conduct is not appropriately sanctioned using other regulatory tools. From a broader policy perspective, as sanctioning tool, the Code should be applied as punishment for individual or entity misconduct and for retributive and deterrent purposes.

22. It is notable that National Disability Insurance Scheme (Code of Conduct) Rules 2018 contain vague descriptions that lack clarity. Key standards and requirements to clarify what is required, including examples of contravening conduct, are provided in the NDIS Commission guidance. In its present form, applying the Code without reference to the NDIS Commission’s guidance is difficult. Moreover, as internal review of determinations under s 73V (Code of Conduct contraventions) is not available, disputes as to meaning and application of the Code are contested in court.14 This increases the transaction cost of administering and enforcing the Code and interpretive risk for the NDIS Commission.15 Where there is doubt in how the Code applies, there is an increased likelihood that a sanctioned provider will contest its

    interpretation. This may decrease the readiness of enforcement staff to utilise it as an

enforcement tool.16

23. Subsection 73ZS(3) of the NDIS Act requires that certain regulatory actions are published on the NDIS Provider Register (Register).17 Although the list of actions in subsection 73ZS(3) is exhaustive and does not include matters relating to enforcement of the Code, it is the intention

14 See NDIS Act (n 1) s 99(1).

15 For example,  non-statutory guidance may have  limited  application  in review proceedings under  the

Administrative Decisions (Judicial Review) Act 1997 (Cth). Non-statutory guidance documents have limited application in interpreting meaning of legislation. 16 See Robert Baldwin, ‘Why Rules Don’t Work’ (1990) 53(3) Modern Law Review 321-337. 17 See NDIS Act (n 1) ss 73ZS(3)(g)-(k). Regulatory actions specified include determinations to suspend registration, issue banning orders or compliance notices and agree to enforceable undertakings.

5

of the legislature that there is a “high degree of flexibility in relation to the NDIS Register to support the exercise of choice and control by people with disability in response to the emerging NDIS market”.18 Thus while there is an explicit requirement that Register contain information about registered providers, the publication of information about unregistered providers is not expressly excluded.

24. Publishing information about actions under s 73V, whether on the Register or otherwise, is consistent with the objective of supporting participants to exercise choice and control. From a strategy perspective, publishing information about Code of Conduct broadens the deterrent effect of individual enforcement actions.

TOR #7

Any related matters

Engagement and outreach with First Nations peoples and their communities

25. To our knowledge, the Commission does not have a plan or strategy in place to guide its engagement with First Nations peoples. While the majority of First Nations people may reside in northern regions of Australia, initiatives to engage and make the services of the Commission known to communities in these areas should reflect an organisational wide approach. The heightened risks and other issues faced by First Nations people with disability was observed by the Disability Royal Commission in its recent issues paper. The lack of clarity in how the Commission will engage with and deliver services to First Nations people, particularly those in rural and remote communities, is concerning.

Recommendations:

1. The Commission develop a framework for assessing risk that includes: a. criteria for analysing participant and provider risk; b. guidance for assessing violation types and ranking according to potential risks they present to (i) participants (ii) governance and operational management (iii) safe delivery of supports and services; and

c. indicators for the ‘drivers’ of compliance behaviours for provider risk profiling. 2. Relevant criteria, policies or guidance for assessing risk are made available to regulatees and relevant stakeholders are periodically engaged to discuss these materials and the Commission’s approach / understanding of risks so that evolving hazards and threats are identified and properly addressed.

3. Develop a program of inspection that is targeted by reference to indicators of participant and provider risk and which include a combination of announced and unannounced visits.

4. Develop mechanisms for the Commission to review how third-party auditors apply the Practice Standards so that interpretations ‘on the ground’ are consistent with the regulator’s expectations. These mechanisms should also enable feedback to auditing stakeholders so that there is a shared understanding of meaning, application and purpose, particularly in relation to more opaque, rights-focussed requirements.

5. Guidelines and/or templates in relation to audit reports be developed to (a) set standards for the level of detail and analysis that is to be provided (b) develop a shared understanding of audit evidence for different quality indicators (c) clarify information that must be provided to

18 See Explanatory Memorandum, National Disability Insurance Scheme Amendment (Quality and Safeguards

Commission and Other Measures) Bill 2017 (Cth) 48.

6

“demonstrate corroboration of evidence…” and convey “evidence from documented records and interviews with stakeholders that can be substantiated…”.19

6. Review the appropriateness and effectiveness of complaints and appeals processes required under ISO 17065:2012 and/or JAS-ANZ. Whether these are adequate in circumstances where registration has been approved, but findings involving minor non conformities are disputed by the provider.

Kai Sinor

Senior Lawyer, MPS Law

rv1Ps Louise Butler

Liability limited by a scheme approved Teaching Specialist Clinical Practitioner by professional standards legislation

Flinders University

19 See National Disability Insurance Scheme (Approved Quality Auditors) Guidelines 2018 s 16(c)-(d) (‘AQA Guidelines’) which sets out ‘matters’ to be included in audit reports.

7

ATTACHMENT A

Remedies for review of decisions of quality auditors under the National Disability Insurance Scheme (Quality Auditors) Guidelines 2018 are limited

1. Under the statutory scheme, approved quality auditors made ‘certification’ or ‘verification’ decisions to the NDIS Commissioner, who in turn makes a decision under s 73E of the NDIS Act. Decisions under s 73E may be reviewed by the Administrative Appeals Tribunal, however decisions of auditors under s 18 the National Disability Insurance Scheme (Approved Quality Auditors) Guidelines 2018 (AQA Guidelines) are not. Further, as the AQA Guidelines are not a legislative instrument, scope for review of the conduct or decisions of auditors under the Administrative Decisions (Judicial Review) Act 1997 (Cth) (ADJR Act) is also limited.20

2. Each Approved Quality Auditor (AQA) is required to have a documented process to receive, evaluate and make decisions on complaints and appeals.21 Process requirements for complaints and appeals about AQAs are set out in ISO 17065. There are no additional requirements or arrangements for the NDIS Commissioner to oversight complaints under the AQA Guidelines (or otherwise).22 How the ‘Joint Accreditation System of Australia and New Zealand (JAS-ANZ) manages complaints from providers about AQAs is unclear.23

3. As a result of the above, the following issues arises: a. disputes about non-conformances identified at audit are resolved (primarily) between the AQA and the regulatee. Mechanisms to support a shared understanding of how standards are applied or to monitor consistency of auditors’ interpretations are not yet developed;

b. where a non-conformity is reported to the NDIS Commission, a provider can seek internal review but only in relation to the ‘final’ decision to refuse registration under s 73E;24

c. if the decision under s 73E is to approve the application for registration, internal review is not available and other remedies are limited;25

d. where the task of interpreting the Practice Standards is polycentric, mechanisms to promote shared understanding of meaning and application do not exist, and remedies for review of auditors’ decisions are unclear, the interpretive risk for the regulatee is higher.

20 While there are authorities to suggest conduct “preparatory” to a final decision may be reviewable under s 6, we have not examined this further in our submission. As the AQA Guidelines (n 19) are not a legislative instrument, decisions made by quality auditors are not made ‘under an enactment’ for the purposes of ADJR Act. See Legislation Act 2003 (Cth) s 8 and Administrative Decisions (Judicial Review) Act 1997 (Cth) ss 3 and 5 (‘ADJR Act’).

21 International Standard Organisation, ‘Conformity Assessment – Requirements for Bodies Certifying Products,

Processes and Services’, ISO/IEC 17065 [7.13]. 22 See AQA Guidelines (n 19). 23 See https://www.jas-anz.org/complaints 24 Decisions under s 73E may be reviewed by the Administrative Appeals Tribunal, however decisions of auditors under s 18 AGA Guidelines (n 19) are not. See NDIS Act (n 1) s 99(1). Applications for review of internal review decisions may be made to the Administrative Appeals Tribunal under s 103. 25 As noted above, the AQA Guidelines (n 19) are not a legislative instrument. Therefore, scope for review of the conduct or decisions of auditors under the ADJR Act (n 19) is limited. The question of whether auditor inquiries and determinations are conduct “preparatory” to a final decision that is reviewable under s 6 ADJR is not considered here.

8

e. where interpretive risk for the regulatee is high it is more difficult to encourage

innovation and apply a strengths-based approach to regulation.

Closing the feedback loop

4. As indicated above, the absence of a ‘feedback loop’ or other mechanisms for understanding, monitoring and providing guidance to auditors on how Practice Standards are interpreted creates the potential for regulatory standards will be applied inconsistently. This creates a risk of divergent systems and practices that do not meet what the regulator expects and is required to assure quality and safety.

   5. While the Commission’s limited resource envelope is rightly focussed on provider and

participant education, activities to educate auditors should not be forgotten. We consider that the first step is to undertake research to better understand which elements of the Practice Standards require elucidation or are more difficult to apply in practice. In our view, this information could be obtained by developing case studies and inviting auditors to participate in an online survey that requests their views on how the Practice Standards are applied in different case study scenarios. Analysis of this data would then indicate the knowledge gaps or key areas of uncertainty within the NDIS audit community.

9

ATTACHMENT B

The NDIS architecture is a ‘principles-based’ regulatory framework

1. Several characteristics of a principles-based regulatory framework impact how the practice of regulation is carried and the processes by which regulatory requirements are interpreted, applied and enforced.

2. Since requirements are expressed broadly, a degree of uncertainty is inherent and providers face a strong interpretive risk (the risk that the NDIS Commission or auditor will not agree with how they have interpreted and applied the rules in their systems). The regulator must therefore adopt a responsive mode of supervision and enforcement, in which negotiation as to meaning, application and purpose plays a central role and in which the focus is on the outcome to be achieved.

3. The following is required, or will enable, effective principles-based regulation: a. close engagement between regulator and regulatee based on mutual trust; b. providers are encouraged to go beyond minimal compliance with regulatory

requirements;

c. outcomes and goals are clearly communicated by the regulator; d. appropriate distribution of responsibilities and allocation of discretion within the

regulatory regime;

e. enforcement regime is predictable and compliance focussed.26 4. While all of the above involve questions of regulatory strategy, [a]-[c] are notable in that they do not immediately require the use statutory powers or adjustment to the regulatory architecture; strategies to achieve these aims can be implemented without intervention from policy makers or the legislature.

5. Predictability of the enforcement regime is particularly important because of the vague and uncertain nature of what principles require in ‘borderline’ cases. A predictable, compliance focussed enforcement regime is necessary to reduce providers’ interpretive risk and give assurance that unwarranted sanctions will not be imposed on the ‘well intentioned and ill informed’ provider.

26 Julia Black, ‘Rise, Fall and Fate of Principles Based Regulation’ (2010) (Working Paper No 17/2010, Law Department, London School of Economics, Society and Economy Working Papers, 2010) 6-8.

10

ATTACHMENT C

Dimensions of administrative rules

Table 1 – Dimensions of administrative rules

a. Status and force: a rule may purport to have full legal status and force, evidential value or to summarise good practice; it may exhort or merely advise.1

b. Character: whether it prohibits, permits, discourages or mandates behaviour. c. Linguistic structure: whether the language the rule uses is vague or precise, whether the rule is simple or complex in its requirements. Linguistic structure also impacts clarity – whether a rule is phrased in everyday language, concise and easily understood or the rule is voluminous, with highly technical language couched in jargon or legalise. Clarity of the rule is increased by drafting rules with words that have well-defined and universally accepted meanings and language that is clear and

easily understood.  Precision and  clarity  of the  rule promotes transparency and

accessibility by clearly articulating how the it applies when people are similarly situated and limiting the discretion available to the official decision makers.27

1. Any combination  of dimensions  is possible, subject  to any  overriding objectives  (i.e.

enforceability) and inevitable trade-offs. Crucially, not all trade-offs are equally acceptable. For example, a transparent and precise rule may assure consistent treatment of similar cases, but may be too narrow in its application and thus under inclusive. Varying the degree of precision with which a rule is expressed also impacts the primary behaviour of the regulatee, the transaction costs associated with administering the rule and the type of regulatory approach that is adopted.28

2. The optimal balance between these rule dimensions is not discussed here.29 However, we emphasise that understanding how enforcement officials exercise their functions is central to understanding how the regulatory system operates and thus the changes (if any) that are required to how regulatory requirements are expressed.30 It is therefore important to develop the clearest possible understanding of and/or objectives for:

27 See Colin S Driver, ‘Optimal Precision of Administrative Rules’ (1983) 93(65) Yale Law Journal 65-109, 67-71. Driver posits that an accessible rule is one which is applicable to concrete situations without excessive difficulty or effort. A related dimension not applied in this submission is congruence – whether substantive content of what is communicated in the rule produces the desired behaviour. Whether the rule is congruent with the underlying policy objective. Congruence directly fosters the law’s substantive moral aims by promoting outcomes in individual cases consistent with those aims. 28 ‘Transaction cost’ refers to resources (time, staff etc.) incurred in connection with administration of the rule (i.e.

interpreting, applying  or  enforcing). A  related  transaction cost  is the  difficulty  of  controlling subordinate

decisionmakers, including NDIS quality auditors. Where there is need to control or limit the discretion of decision makers, attention focusses toward clarity and precision. For discussion of the extent to which enforcement strategy is helped or hindered by the kinds of written rules employed, see Baldwin (n 16) 321-337. 29 A related issue, considered in Braithwaite’s work studying nursing home regulation, is the optimal balance of binding rules backed by non-binding principles versus binding principles backed by non-binding rules. Binding rules and non-binding principles refers to the presumption that the rules should be followed when there is conflict between the rules and the principles and vice versa when principles are binding and rules are non-binding. See John Braithwaite, ‘Rules and Principles: A Theory of Legal Certainty’ (2002) 27 Australian Journal of Legal Philosophy 48-82.

30 ‘Enforcement official’ in this context means any officer who performance a compliance or enforcement functions, including education, persuasion etc.

11

a. relationships between the enforcer (the Commission), interpreter (quality auditors) and regulatees (providers);31

b. discretion afforded to those administering or enforcing the rule; c. substantive aims (i.e. whether the intended objective is to exhort or mandate); d. ‘transaction costs’ (i.e. time and resources to administer, enforce or manage disputes about rules).32

Principles33

3. Any combination of the dimensions in Table 1 above is possible, however there are three elements of structure that characterise a norm as a principle: (1) precision (2) complexity and (3) clarity.34 Varying choices as to these elements of structure produces regulatory rules of three broad types: bright line rules, principles or detailed rules.35

4. Specific and absolute ‘bright line’ rules are attractive to regulators because they enable the enforce to clearly identify how the rule has been breached. The key disadvantage is the narrowness of application and potential for under-inclusiveness.36

5. The use of principles in the NDIS regulatory architecture offers three key advantages: a. Principles create congruence between the substantive content / regulatory objective for what is communicated and the promotion of behaviour that will achieve those objectives.37

b. By requiring the interpreter to focus on outcomes, they minimise scope for regulatees to engage in “creative compliance” or “gaming” of regulatory requirements.

c. They can be applied and interpreted flexibly to a diverse and evolving NDIS provider market.

Tools and sanctions available for different compliance behaviour

6. Under a neoclassical economics view, regulatees are rational and self-interested; regulation serves to fix market failures and enable interventions when negative externalities are such that consumers need protection. On this view, it assumed that where the regulator poses a credible risk of detection, enforcement and threat of sanction, compliance behaviour of the regulated (rational) actor naturally follows. Contemporary regulatory practice acknowledges the flaws in these assumptions and refocuses attention and strategies to the ‘motivational

31 Factors that influence how enforcement officials and those administering rule (quality auditors) construct definitions of compliance must also be considered. 32 Transaction costs may be a higher where a rule is complex and lacks clarity because application of the rule to particular fact circumstances cannot be readily discerned. Conversely, an imprecise yet clear and simple rule that sets out a widely-drawn general duty may be prone to challenge or appeal and therefore create transaction costs. 33 For present purposes, the essential qualities of a principle are that it is outcome-orientated but formulated with a non-specific or vague prescription of what is required.

34 Complexity and clarity are broadly reflective of the dimensions of clarity and intelligibility. 35 Julia Black, ‘Forms and Paradoxes of Principles Based Regulation’ (2008) (Working Paper No 13/2008, Law Department, London School of Economics, Society and Economy Working Papers, 2008) 15.

37 See Colin S Driver, ‘Optimal Precision of Administrative Rules’ (1983) 93(65) Yale Law Journal 65-109, 67-71. Driver posits that an accessible rule is one which is applicable to concrete situations without excessive difficulty or effort. A related dimension of a rule is congruence – whether substantive content of what is communicated in the

rule produces the desired behaviour.  Whether the rule  is congruent with the underlying policy objective.

Congruence directly fosters the law’s substantive moral aims by promoting outcomes in individual cases consistent with those aims.

12

postures’ that drive compliance behaviour. These strategies are often depicted in the ‘regulatory pyramid’. The peak of the pyramid represents the ultimate constraint on pursuing a course of action that is in breach of regulatory standards.38 The diagram below illustrates how different tools can be applied to respond to different types of conduct and motivational posturing (non-compliance behaviour).

Education, Persuasion, Compliance Support

7. The bottom of the pyramid represents lower-order breaches that are dealt with through education or persuasion; these regulatees are generally willing and able to comply. The top of the pyramid typically corresponds to offences or contraventions that are serious (i.e. reflect significant risk) where the regulatee is culpable or where the regulator has determined that the broader deterrent effects of a sanction are appropriate. The regulator may respond to move a recalcitrant regulatee upward through pyramid if ‘soft’ interventions at the lower levels of the pyramid fail to achieve the desired response. Conceived in this way the pyramid provides a useful depiction of how the mantra of ‘responsive regulation’ is operationalised and a broad framework through which the regulator’s finite resources can be prioritised.

8. Characterisation of the drivers of regulatees’ behaviour varies. Even within a single sector such as the NDIS there is variation between the motivational postures of registered and non registered providers, sole providers, SMEs and large business or between providers in remote, rural and urban areas. We do not profess detailed insights on these issues. For present purposes, we are concerned with the type of rule configuration that will be more useful with regulatees who fail to comply for different reasons. For the purposes of our analysis, we identify three broad categories of provider behaviour:

Well intentioned, ill-informed provider is (in the absence of serious hazards, risks to participant health, safety or wellbeing) generally treated sympathetically and is commonly a sole provider or SME business. For these providers, inspecting officers combine

38 Providing it is a credible sanction, that is, those being regulated believe that the regulator can and will use this power, it serves a number of functions. In a societal sense, it signals the seriousness of a breach of rules. It reminds those being regulated of their obligations and of the course of action they should pursue, as agreed in the social compact at the base of the pyramid. Should social pressures fail, economic pressures come into play. It is costly to escalate to the top. It is rational for the regulatee not to carry the costs of non-compliance, and return to a cooperative stance at the base of the pyramid that respects the law sooner rather than later. See Mary Ivec, Valarie Braithwaite et al, ‘Applications of Responsive Regulation in Australia and Overseas: Update’ (2015) (ANU Occasional Paper, March 2015) 7-8.

13

negotiation with advice, education and information-giving. Inspectors may agree a timetable for implementing corrective/remedial actions and undertakings (non-statutory) as to what needs to done. In the absence of other risk factors or concerns, inspectors are disinclined to get too ‘legalistic’.

Ill-intention, ill-informed provider also typically a SME and may have a history of repeated low order, technical breaches (i.e. failing to lodge reports within prescribed timeframes). ‘Ill intentions’ may emanate from a single (dominant) member of the governing body, or

Problematic provider or irrational non-complier is usually recalcitrant. The provider may vary in intention or degree of knowledge but is characterised by the fact that they are inherently difficult to deal with.

9. Precise, ‘bright line’ rules are conducive to a sanctioning approach if it is clear on the face of the rule what conduct is required or prohibited.39 Thus they are more effective for “irrational non-compliers” because they enable the enforcer to clearly articulate how the rule has been breached.40 However, studies show that a mass of detailed rules may increase discretion and

   rather than facilitate enforcement, it may hinder it due to the volume of rules that must be

monitored.41

10. In contrast, general rules (i.e. principles) containing a broadly stated duty or obligation or a vague as to manner, process and which impose evaluative standards implicitly confer discretion to those applying the rule (including regulatees) to make a judgement as to its application in particular circumstances. Such rules make it easier for a compliance approach to be adopted, thereby supporting regulatory practices of persuasion and negotiation as to what conduct is required.

11. In our view, any changes to how requirements within the Practice Standards or Code of Conduct (or other instruments) are expressed should be framed by careful consideration of these issues discussed above.

ATTACHMENT D

Risk-based compliance

1. Risk is understood here as the combination of the likelihood of an adverse event (hazard, harm) occurring and the of the potential magnitude of the damage cause (combining number of people affected and severity of damage for each). This means that typically, highest risk categories will comprise objects for which both probability and potential magnitude are high – but also in some cases, where probability is low, but magnitude of damage would be extreme and result in severe harm.

   2. Risk-based compliance is especially important in supervisory regulation because it is not

possible to inspect each and every provider. In the absence of comprehensive and/or fully reliable data, the regulator must rely on interpreting what data exists (at least to establish which sectors appear to generate the most damage).

39 See Black (n 8) 7. 40 See Karl N Lewellyn, Jurisprudence: Realism in Theory and Practice (University of Chicago Press, Chicago, 1962). 41 See Braithwaite (n 29).

14

3. Risk assessment and risk management require resources and expertise, and to be

continuously updated using the results of inspections, monitoring, and analysis of all available sources of information on ongoing trends in the relevant field. As the OECD notes, this may require governments to ensure that regulatory agencies have a dedicated unit or teams specifically in charge of risk management, with adequate resources to perform their task effectively. In addition, OECD recommend that regulators collect and use the following:42

a. Criteria to assess the risk of individual businesses and rank them according to assessed risk level.

b. Data on all (or at least most) businesses allowing to effectively assess their individual risk level.

c. Planning and resource allocation mechanisms so that inspection visits are effectively planned based on the risk level, and resources are rationally allocated

d. Updating process so that the risk-profile of each business is regularly updated to incorporate new information, and risk criteria are modified based on new statistical data on hazards, possible damages etc.

e. Consistently-compliant businesses are treated as correspondingly lower risk, and inspected less frequently (“earned recognition”).43

f. Develop and track indicators that give “early warning” of changes in both the likelihood of occurrence and the magnitude of consequences.

Inspections

4. Inspections provide opportunities for regulatory enforcement agencies to provide information and advice, suggest cost-effective remedies on site, increase the agencies’ understanding of the businesses they regulate – and in this process, allow to develop trust relationships between regulators and regulatees.

5. Relatedly, regulatory enforcement agency need some compliance (and compliance-related) information on all regulated entities – including regulatees with good compliance records – in order to monitor and measure regulatory compliance and performance in a comprehensive manner. This in turn allows tracking the evolution of risks, and whether their risk assessment models remain valid – and also to feed into the “responsive regulation” approach.

6. In principle, reactive inspections should be a minority of the total volume of inspections carried out. The vast majority of inspections should be proactive, with targeting based on risk assessment (which are based on data from a variety of sources).44 However, this is difficult whether data and tools to support risk analysis are not available.

42 OECD Regulatory Enforcement Best Practice Report (n 11) 28-29. 43 See generally OECD Regulatory Enforcement Best Practice Report (n 11) 33-36. 44 See OECD Enforcement and Inspections Toolkit (n 13) 21. Risk factors taken into account for this targeting should include at least intrinsic risk of the activity, scope of operations and vulnerability factors (location, population served). In addition, the OECD recommends that design of inspection program include randomised sampling of providers who do not meet the ex ante risk assessment threshold, so that the regulator can obtain insight into providers’ operations and systems generally.

15

Table of Eleven

7. Developed by the Dutch Ministry of Justice, the ‘Table of Eleven’ (the Table) was developed to assist the government to determine whether new legislation could be enforced in a way that would leave to compliance. The Table lists 11 factors that behavioural science showed influenced compliance. The Table was later adapted to reflect a more holistic view of

   compliance and the factors that influence how individuals’ and businesses’ everyday

motivations, characteristics and business models interact to influence their perceptions of regulatory obligations, enforcement and, ultimately, compliance.

16