The organisations trusted with the most vulnerable people are also the most exposed.

Claims and service records submitted through direct API or aggregator integrations authenticate on organisation-level credentials. The record can show your organisation was involved; it often cannot show which staff member was.

• Business-to-business credentials with no named, current custodian
• Shared logins in rostering and case management systems
• Attribution logs retained for shorter periods than substantiation can be sought

A worker's screening can lapse or their employment can end without their system access being revoked on the same day. The reconciliation most providers run checks screening against employment records, not against who can still log in.

• Departed or screening-lapsed staff retaining active credentials
• Coordinators and administrators entering records on behalf of support workers without a documented delegation
• Aggregator-managed integrations where the provider cannot see what is logged

For NDIS and aged care providers, an unresolved substantiation request or a reportable incident handled poorly does not stay a back-office problem. It reaches funding continuity, registration status and, ultimately, the people relying on the service.

• NDIS payment withheld pending substantiation under section 45
• Aged Care Quality and Safety Commission compliance action for unresolved incidents
• Loss of funder or referral-partner confidence following a public finding