When risk becomes routine: what the Aurora judgment really teaches providers.
23 October 2025
On 10 October 2025, the Federal Court imposed a $2,200,000 civil penalty on Aurora Community Care for contraventions of ss 73J and 73V of the NDIS Act however in February 2024, Aurora went into voluntary administration, so it’s unlikely the penalty will ever be paid.
So what’s the point?
Both the Commission and the courts have operated on the assumption that high-profile prosecutions and large penalties will deter other providers.
As the then NDIS Commissioner Tracey Mackey stated: “The Commission expects every support worker and provider in the NDIS to act at all times with integrity, honesty and transparency and deliver safe and quality services to participants. If they fail to do so, the Commission will act.”
But for that deterrence to work, providers must be clear on what to avoid.
Aurora Community Care was found to have more than 130 breaches. The Court noted that the conduct was repeated, ongoing, and unrectified even after Aurora had been notified of its shortcomings.
The goal of this article is to articulate those shortcomings and identify mechanisms to prevent them because any CEO who reads this judgment and thinks “That won’t happen in my organisation” is the most vulnerable of all.
This case demonstrates that the most dangerous moment in any organisation isn’t when someone makes a mistake, it’s when that mistake becomes routine.
- When we grow complacent.
- When we’re too overstretched to notice the Swiss-cheese holes beginning to line up.
Risk hides in plain sight. Not usually through reckless action, but through comfortable and continued inaction.
Sometimes, the greatest risk isn’t what you do; it’s what you avoid:
- Not opening an email.
- Not reporting a restraint.
- Not checking when a door opens at 1 a.m.
Background
Aurora Community Care became a Pty Ltd company on 30 January 2017 and an NDIS-registered provider on 8 February 2017.
For anyone wondering how that was possible so early, their initial registration occurred under the state-based NDIS system in NSW and automatically transitioned to national regulation on 1 July 2018 when the Commission commenced in NSW.
In FY 2021–22, Aurora reported around $5.9 million in NDIS revenue. The following year, they experienced 15 per cent revenue growth (for those who believe revenue growth equates to quality—take note).
In the 12 months before Ankur Gupta’s avoidable death on 17 March 2023, Aurora supported 38 participants.
After the incident and despite a significant post-incident revenue hit, they still earned $3.55 million in NDIS revenue in FY 2023–24, before entering voluntary administration in February 24. It wasn’t until 19 November 2024 that the NDIS Quality and Safeguards Commission imposed a 10-year personal banning order on sole director Mohamed Issak, effective until November 2034.
The Man Behind the Story
Ankur Gupta was a much-loved son, brother and friend. Born in 1984, he lived with multiple complex conditions, including intellectual disability, epilepsy and tuberous sclerosis.
But he is more than his diagnosis. There is not a lot of public information about him, but we can piece together that he loved simple pleasures: watching television, sharing a Pepsi, listening to familiar sounds around his home.
Ankur began receiving support from Aurora Community Care in July 2021 while in Logan Hospital. He later moved to a supported independent-living residence at Dyandra Drive, Eagleby, Queensland, on 16 February 2022.
Court evidence showed that Ankur had significant executive-function and behavioural challenges, with functioning comparable to a five-year-old child.
He was funded for 2:1 active supports, including active night shifts. Aurora’s responsibility was to maintain constant observation as doors and gates were intentionally unlocked. Vigilance was critical.
At about 1:45 a.m. on 17 March 2023, Ankur left his home unnoticed. One support worker had fallen asleep beside him; the other heard a door but did not check.
Ankur was struck by a vehicle near the M1 exit at Eagleby. He died from his injuries at only 38 years old.
Aurora had already identified the risks. A risk assessment dated 30 March 2022 stated that staff must “always watch him so he’s not absconding.” His PBS plan, dated 28 June 2022, confirmed ongoing aggression and property damage, recommending continuous 2:1 support.
Aurora also had other warning signs that there could be a problem:
- Four weeks before his death, Ankur set fire to his mattress with a lighter while alone in his room.
- On multiple occasions, his parents found support workers asleep on duty and made verbal complaints that went unanswered.
What is most concerning, is on the night of his death, staff were shown a trailer of what could happen when risks are not responded to.
That very day, on the 3 p.m.–11 p.m. shift, one staff member left early at 10:20 p.m., leaving a single worker. At 10:35 p.m., Ankur exited through the back gate and sat in the middle of the road, saying he wanted to go in an ambulance.
The night-shift worker, who would later fall asleep, arrived at 10:45 p.m. and worked with the other staff member to called an ambulance, and returned Ankur home to wait.
There were warnings. They just weren’t heeded.
Then, to make matters worse, misinformation followed.
At 6:30 a.m., Mr Issak phoned Ankur’s parents, claiming he had “run away” but was safe and with police. The family learned of Ankur’s death later that morning, from their other son, a Queensland Police officer.
Aurora did not notify the Commission until 28 March 2023, eleven days later. On that date, they also registered his behaviour support plan and uploaded restrictive-practice details.
Inside the Governance Failure
A man lost his life.
A provider was penalised.
A regulator made its point.
On paper, a provider can appear flawless. This was a registered provider. They had all the policies, reporting systems, compliance dashboards to pass an audit. But paperwork cannot stop poor judgment or apathy. Procedures can’t replace vigilance.
The Commission is using this tragedy as an entry point to expose every related failure beneath it. This isn’t about one night in Eagleby; it’s about what that night revealed.
When governance fails at the point of practice, everything that follows becomes evidence of what we should have seen. Instead of fixating on penalties, we must ask: how did systems built for safety allow risk to become normal and why did the alarms go unheard?
Aurora’s wider convictions included:
- Unauthorised restriction of television at least 19 times and Pepsi seven times without plan coverage or reporting.
- Use of chemical restraint under short-term state approvals, without reporting to the Commission, despite five reminder emails between February and December 2022.
By July 2022, deeper governance cracks should have been seen.
A community visitor found the coordinator uncertain about what constituted a restrictive practice, which practices were authorised, and the conditions of approval. Staff admitted they “just know” when to administer medication.
When the community visitor followed up by email, Mr Issak’s reply did not address the questions about how or when restrictive practices were reported to the Commission.
Where Accountability Really Begins
Registered Providers currently operate in a self-reporting system. One where breaches often go unnoticed until harm occurs and someone decides to look.
We need to be aware, that the Commission’s response after harm is swift, forceful and brings out all of the skeletons in the closet.
Whilst we do not know the exact weightings of the penalties applied. We do know that The Commission allocated less than 25% of the total fine to the actions that directly contributed to Ankur’s preventable death. About 15% were for breaches to his human rights.
And the rest? Administration and reporting failures.
So whilst you may not get caught. Accountability for past breaches can still be enforced at the point of tragedy.
This means the onus sits with providers to design and implement their own harm-prevention mechanisms and self-policing strategies.
By its nature, some types of disability support are high risk. Documentation and reporting matter but they only prove what happened after the fact.
The real test of quality is how effectively an organisation identifies, responds to, and prevents risk before it becomes harm.
Five Practices Shifts to Prevent Following in Aurora’s Footsteps
1. Redefine “ratios of care” and “awake night support” as an active safety system.
Move beyond roster notes and ROC compliance. There’s reason active nights are funded. Ensure your staff understand why. Reinforce the seriousness through real-time verifications, such as spot checks, digital logs, exception alerts. The goal must be to confirm presence and attentiveness, not just attendance.
2. See triggers as insight, not control.
When behaviour plans identify triggers like television or Pepsi, treat them as early-warning data, not levers for restriction. Build alternative strategies and teach staff to recognise escalation cues before control measures are reached.
3. Put PRN and restrictive practices under clinical governance, not routine habit.
Every PRN restrictive practice use should spark a reflective review, not just an entry in a medication log. Create feedback loops between behaviour support practitioners, nursing oversight, and frontline staff to analyse why the intervention was needed and how to prevent it next time.
4. Make silence visible.
Non-response is a risk signal. Escalate unanswered emails, missed incident follow-ups, or overdue reviews automatically. Set internal SLAs that treat no action as an alert, not a neutral state.
5. Evidence prevention, not paperwork.
Documentation should prove that safety is embedded. Not that compliance boxes were ticked. Capture data that reflects practice: night-shift wakefulness, restrictive-practice reviews, participant choice measures. If something still goes wrong, use that data to tell a story of safe, empowering support and not bureaucratic compliance.
The Road Ahead
Based on the ANAO audit, the Commission is likely to keep regulating after harm for at least the next 18 months. But providers, we must regulate before it. People’s lives depend on it.
Ask yourself: how quickly would you notice the small signals Aurora missed?
- At Aurora, staff sleeping on night shifts wasn’t treated as a critical safety failure. It was ordinary.
- Restricting Pepsi or television, despite being known triggers, became “just how things are done.”
- Failing to reply to five departmental emails about restrictive-practice reporting was dismissed as being too busy.
It wasn’t good enough for Ankur and the answer isn’t more red tape.
Ankur’s story reminds us that every person deserves to be seen beyond their diagnosis. He had challenging behaviours, yes, but he was also a whole human being whose safety, comfort and dignity were non-negotiable.
His life, and the way it ended, challenge our sector to do better: to stay awake, to notice, and to act with care before harm occurs.
The Aurora penalty sends a strong accountability signal. But the deeper lesson is operational: if your organisation still relies on “should be awake,”“we just know,” or “we’ll report later,” you’re gambling with things you can’t afford to lose. You need to contact us ASAP.
There’s no judgment. Just urgency and appreciation for being brave enough to say, “I’m not confident we are doing this well, and the people we support deserve better”.
Deterrence is a consequence; prevention is a system and we want to help you build a better one.
Come to our webinar, where we use real case studies against routine operating models. We want you to have the time, space and clarity to prepare for more risk aware support delivery
Date: Thursday, 6 November 2025
Time: 11:00am – 12:00pm (UTC+10:00)
Format: Live & interactive online session
Registration: Limited spaces for executives and senior leaders
How we can help
In today’s climate of tight overhead margins and a competitive labour market, resourcing your transformation team entirely with internal staff may not be feasible. That’s where we come in. Our experienced project and change managers can provide the specialised support you need to keep your transformation on track.
We also offer skilled facilitation for transformation team meetings, maximising your time and ensuring meaningful, high-quality outcomes.
For broader strategic needs, we provide executive advisory and tailored support packages designed to empower NDIS businesses at every stage of growth and development.
Get involved and get connected!
- We would love to know if you’ve tried any of the activities we’ve suggested or done something similar in the past – and what the outcomes were! You can reach out to us in the Get in Touch section at the bottom of this page.
- We also share practical tips, real life examples, and expert insights every week on LinkedIn. Follow along, join the conversation, and share these posts with your network.
- Join our mailing list here to receive notifications up upcoming instalments and webinars. We truly value the insights and experiences attendees are bringing to our webinars!
Get in touch
If you would like confidential assistance in looking at this differently, book in a time to have a no obligation chat via my bookings calendar or email me at angela@supportingpotential.com.au.
Let’s build a stronger, more adaptable NDIS community, together.
Your partner in achieving compliance, growth and sustainability
Angela Harvey
Managing Director of Supporting Potential
To read all our other blogs visit here
