Two-factor authentication ensures that even if a password is compromised, unauthorised access to participant data, shift records, and organisational documents remains blocked. Combined with the platform's role-based access controls, 2FA forms the first layer of a multi-layered security model that protects sensitive NDIS operational data.

WCC is cloud-hosted, meaning your team can log in securely from any browser, on any device, from any location in Australia. There is no server infrastructure to maintain, no VPN required, and no local installation to manage. Access is immediate, secure, and available whenever your team needs it.

New participants can be enrolled in two ways. The first is a direct manual entry by an admin, which is the fastest method for providers who receive referrals through existing channels. The second is an online referral link sent directly to the prospective participant or their representative. This link opens a six-step self-registration form that captures full demographic information, next of kin and guardian details, mainstream support contacts, disability and health information, and current support needs. Once the form is submitted, the record appears in the Online Referrals list for admin review. A single click accepts the record and moves it into the active Participants list.

New participants can be enrolled in two ways. The first is a direct manual entry by an admin, which is the fastest method for providers who receive referrals through existing channels. The second is an online referral link sent directly to the prospective participant or their representative. This link opens a six-step self-registration form that captures full demographic information, next of kin and guardian details, mainstream support contacts, disability and health information, and current support needs. Once the form is submitted, the record appears in the Online Referrals list for admin review. A single click accepts the record and moves it into the active Participants list.

Two critical compliance flags sit within every participant profile. The first controls whether that participant's shifts require shift case note completion enforcement. The second controls whether GPS location capture is required when staff clock into that participant's shifts via the mobile app. Both flags are configurable per participant and allow coordinators to manage compliance requirements at an individual level rather than applying blanket rules across the entire participant list.

Creating a roster involves selecting the participant, setting the fortnight period, and then expanding individual dates to allocate staff. Each shift slot captures the allocated support worker, shift start time, shift end time, and break duration. A cover or backup staff member can also be added to every individual shift slot, creating a named fallback for each shift before an absence occurs rather than scrambling to find cover on the day.

One of the most operationally significant features of the rostering module is contracted hours tracking. Every staff member has a contracted hours figure per fortnight stored in their profile. WCC calculates total allocated hours as a roster is built and displays a red warning when any staff member is allocated hours that exceed their contracted maximum. This alert appears in real time as shifts are added, giving coordinators the opportunity to correct the roster before it is finalised and before a SCHADS Award breach occurs.

The copy function allows any individual shift configuration to be duplicated across multiple dates within the same fortnight, or the entire roster can be copied forward to a new fortnight period. Once a roster is finalised, the system assigns an Allocation ID to every shift and sends automated email notifications to all allocated staff. Cancelled shifts can be flagged individually without deleting the roster, and all notification history can be reset and re-sent if staffing changes occur after the roster has been distributed.

The process begins when a shift ends. Three hours after the roster end time, if no case note has been submitted, the support worker receives an automated email notification. If the case note remains outstanding at 24 hours, a second notification is sent and the worker's platform login is automatically disabled. Access is restored the moment a finalised case note is submitted. For case notes that have been submitted in draft but not finalised, a first reminder is sent at 48 hours and a second notification combined with login restriction at 72 hours.

The case note entry process itself is structured in two stages. The first stage captures the shift summary, participant and shift details, staff on shift, any co-worker present, transport details (vehicle type, kilometres travelled per staff member), and a voice recording option for the narrative shift summary. The second stage is the Case Notes Wizard, which is a participant-specific set of clinical and care documentation sections. Sections marked with a red exclamation are mandatory for that participant. Others are completed as applicable.

Wizard sections cover goals tracking, food and drink charts, behaviour logs, sleep recording charts, ABC log sheets, PRN and short-term medication administration records, blood glucose level charts, monthly weight recording, and bowel charts. Every section is configured per participant, so support workers only see the sections that are relevant to the person they are supporting. Completed case notes are viewable as formatted PDFs and retained in the participant record for audit purposes. Draft case notes can be edited; finalised case notes are locked and cannot be altered.

To create an open shift, a coordinator locates the participant's existing fortnight roster, expands the relevant date, and clicks Add Open Shift on the AM shift row. The staff field defaults to Open Shift with Approval. The coordinator enters the start time, end time, and break time, and then selects the staff members they want to broadcast the vacancy to. The system automatically assigns the shift manager as the approval authority.

Once saved, an email notification and a dashboard notification are sent simultaneously to all selected staff. Each staff member sees Accept and Reject buttons on their dashboard and within the email. When a staff member accepts, the shift manager receives an immediate notification. All interested applicants are then visible in the Pending Shift Requests view, where the manager reviews each application and approves one. The successful applicant receives a confirmation email. All unsuccessful applicants receive a rejection email. The entire process is documented within the platform with no external communication required.

This approach ensures that open shifts are filled through a transparent, auditable process. There is a clear record of who was offered the shift, who accepted, and who was approved. Coordinators maintain control over who fills the shift rather than it going to whoever responds first in a group chat.

Page one of the incident form captures the participant involved, the event type, date, start and finish time, location, and the people involved in the event. Each person involved is recorded with their name, contact number, status, and age if under 18. A checkbox flags whether the incident is an NDIS Commission reportable incident, and the specific incident type is selected from a configurable list of categories that includes aggression, property damage, medication errors, unexplained injuries, and other notifiable event types.

Page two captures the narrative detail: what happened, when and where it occurred, the details and contact information of any witnesses, the physical evidence available, the source of information, the settings or circumstances in which the behaviour is most likely to occur, and the triggers that commonly precede the behaviour. The strategies used to manage the behaviour during the incident are documented in a dedicated field. All mandatory fields are marked and the form cannot be finalised until they are complete.

Incidents begin in Draft status, which allows for review and editing by coordinators or managers before the report is locked. Once the status is changed to Finalised, the report is locked and cannot be altered. Compliance status is tracked as a separate field, allowing a multi-stage internal review process to occur without conflating the report completion status with the compliance review status. Finalised reports are available as formatted PDFs suitable for NDIS Commission submission and internal audit documentation. Automated email notifications are sent to configured management recipients when each report is submitted.

Authority PRN forms record medications that are taken as required rather than on a fixed schedule. These forms capture the Medic Alert number, participant details, prescribing practitioner name, parent or carer name if applicable, and the full detail of each medication including dosage, administration method, and the clinical authority for its use. Authority Regular forms record medications administered on a fixed schedule, following the same field structure as the PRN form but configured for scheduled administration.

Both medication record types are viewable and downloadable as formatted PDFs, searchable by participant name, and fully editable to reflect changes in prescriptions or administration requirements. The most operationally significant integration point, however, is the connection between the medication records and the shift case note wizard. Sections D.6 (Medication Administration Record: PRN) and D.7 (Medication Administration Record: Short Term) within the case note wizard pull from the participant's medication records, so support workers are prompted to document administration against the correct medications during their shift documentation process rather than relying on memory or separate paper records.

The service agreement form is structured across multiple sections covering the agreement details, the specification of supports to be delivered, the parties to the agreement, and the signatures of both the participant or their representative and the service provider. Once completed, the agreement is available as a formatted PDF for download, distribution, or audit submission at any time.

The consent form for information sharing is a separate document within the same module that captures the participant's consent for their information to be shared with relevant parties as required by their support plan and the provider's obligations under the NDIS Practice Standards. Like the service agreement, the consent form is legally binding, stored against the participant's profile, and viewable and downloadable as a PDF. Both documents are date-stamped and retained in the participant record for the duration of the service relationship and beyond for audit and compliance purposes.

Recruitment begins with an online application link that can be sent to candidates via email. Candidates complete a structured application form that captures personal details, employment history, experience, and qualifications. Applications are received directly into the WCC platform where HR managers can search and filter by name, position, experience level, and gender, and export the applicant list in Excel or PDF. Each application can be progressed to an interview by sending a scheduled interview invitation via automated email directly from the platform.

When an application is accepted, WCC launches a four-step onboarding workflow: personal and contact details, system access configuration (user group, designation, employment type, login status), document upload (identification, working with children checks, certificates), and initial training assignment. This workflow creates the staff member's user account and assigns their first training modules in a single session.

Ongoing workforce management covers leave applications with separate annual and personal leave balance tracking for full-time and part-time permanent staff and unpaid leave for casuals. Managers can approve, reject, or partially approve individual days within a leave application, with automated email notifications sent to the staff member at each stage. Employee documents are tracked with expiry dates and review date reminders that appear on the dashboard. GPS employee swipe logs record every clock-in and clock-out event with timestamp and location data. The employee rewards module allows managers to issue Recognition, Birthday/Anniversary, or Employee of the Month awards, each with a custom badge and a broadcast message to all platform users.

Training courses are created inside the platform with a training name, a description, a deadline date after which the training is no longer active, and an optional link to external study materials. Supporting documents such as policy documents, procedure guides, or instructional PDFs can be uploaded directly to the training record for staff to review as part of their learning. Each training module is configured with a Training Rule that defines the completion requirements: whether formal acknowledgement is required, whether an on-screen signature is required from the trainee, and whether a questionnaire assessment is included.

Where a questionnaire is included, the admin creates multiple-choice questions with defined correct answers and sets the pass threshold. WCC grades each submission automatically and marks the training as passed or failed. Staff who pass can view their answer sheet and download or view their training certificate immediately. Staff who do not meet the pass threshold are notified and can reattempt the training.

Training is assigned to one or more staff members simultaneously through the Assign Training function. Every assigned staff member receives an automated email notification with a direct link to their training. Completion status is tracked in real time across the entire assigned cohort, so managers can see at a glance which staff have completed, which are in progress, and which have not started. The Pending Training widget on the admin dashboard shows the count of outstanding training assignments at any time.

For providers using the internal invoicing pathway, invoices are generated per participant based on the rate configuration stored in the Participant Invoice Settings. Each participant's invoice settings include a toggle to enable invoicing, the email addresses invoices should be sent to, the payment due period in days, billing address, ABN, and ACN. The Rates Setting tab within the participant's invoice settings defines the specific support service charges applicable to that participant. Invoice status moves through Draft, Finalised, and (for Xero users) Saved and Synced with Xero.

For Xero integration, the setup process involves selecting Xero as the invoicing method in Invoice General Settings, then running four sync operations: Sync Accounts, Sync Tax Rates, Sync Pay Rates, and Sync Contacts. Each participant must have a Xero Email Address recorded in their profile that matches exactly their contact email in Xero. When the match is confirmed, a green tick appears in the Linked with Xero column on the Participants list. Invoice payment management allows managers to record payments received, send payment reminder emails, and issue payment receipt emails to participants, all from within the platform. A complete change history is maintained for every invoice.

Standard user groups include Super Admin, Admin, Senior Manager, House Manager, Coordinator, and Staff. Each group's default permissions are configured at the system level and apply automatically to every new user added to that group. Where an individual user requires access that differs from their group default, permissions can be overridden at the individual user level for any specific menu or activity. The Is Default Permissions flag records whether a user's permissions have been manually adjusted from their group default, and a Reset to Default Permissions button restores the group defaults for any user whose individual permissions need to be reverted.

Access control also operates at the participant level. Every staff member is bound to one or more specific participants through their user profile. This participant binding controls which participants appear in that staff member's roster view, case note creation interface, and reporting access. A support worker who is not bound to a participant cannot access that participant's records, regardless of their broader system permissions. This two-layer access model, combining role-level permissions with participant-level binding, ensures participant data is accessible only to the people who have a legitimate operational reason to see it.

The twenty forms cover: Feedback, Business Risk, Staff Meeting, Weekly House Meeting, Management Meeting, Asset Register, Training Attendance (In House), Annual Training Register, Document Control Register, Financial Transaction Register, Risk Compliance Register, Employment Check Register, Risk Assessed Role Register, Risk Assessed Role Employee Register, House Risk Assessment, Employee Performance Appraisal, Continuous Improvement Register, Home Visit Assessment and Management, Conflict of Interest, and Participant Support Plan.

Every form supports adding new records via an Add button, searching and filtering existing records across multiple criteria, and exporting the full record set or individual entries in Excel, CSV, or PDF format. Individual records can be viewed as formatted PDFs, edited, or deleted. These export capabilities are directly relevant to audit preparation: rather than hunting through folders and spreadsheets for evidence of quality management activity, coordinators and quality managers can generate a formatted, searchable export of any form's complete record history in seconds.

Field components available in the builder include text fields, text areas, number inputs, password fields, checkboxes, select boxes, radio buttons, file upload fields, and buttons from the basic category, with additional advanced, layout, and data-bound components also available. Each field is configurable with a label, placeholder text, description, tooltip, validation rules (required, minimum and maximum length, regex patterns), and display options. Fields can be arranged in any order and reorganised by dragging.

Forms begin in Draft status, which allows editing but prevents sharing. Once a form is set to Finalised, it becomes shareable. The Share function provides three distribution methods: a unique URL that can be copied and shared manually, an email delivery to one or more addresses, and a direct assignment to specific registered users in the platform. When a form is assigned to a user, they receive an email notification with a direct link and the form appears in their Pending Dynamic Forms widget on the dashboard. The form page itself is accessible without a platform login, making it suitable for participants, external stakeholders, or prospective staff.

All submissions are tracked in the Form History view with the recipient's name, submission date and time, number of attempts, and completion status. Submitted forms are viewable as formatted PDFs. The Submissions view provides a searchable list of all submitted responses across all forms.

The Maintenance module provides a structured ticketing system for raising, tracking, and closing maintenance requests. Each request captures the participant whose property is involved, the address (auto-populated from the participant profile), the priority level (Super Urgent, Urgent, Normal, or Low), the date the request was raised, the trade category required (Electrician, Plumber, Gardener, Handyman, Waste Management, or Hard Waste), a subject line and detailed description of the issue, and the current status (Open, In-Progress, or Closed). Supporting documentation and photographs can be attached to each request.

The Pending Requests list provides a searchable, filterable view of all open and in-progress maintenance requests across all participants. Requests can be exported in Excel or PDF format for reporting or contractor briefing purposes. Automated email notifications are sent to configured management recipients when a new request is created and when the status of an existing request is updated, ensuring that maintenance issues are not sitting unresolved in a system that only one person monitors.

Every data record across all modules in WCC is searchable, filterable, and exportable. Case notes, incident reports, roster records, leave applications, invoice histories, general form entries, dynamic form submissions, employee swipe logs, and user activity logs can all be searched and filtered by relevant criteria and exported in Excel, CSV, or PDF format. This means that when an audit requires documentation of a specific incident, a particular participant's shift history, or evidence of staff training completion over a defined period, the data is available in a structured, exportable format without manual compilation.

The User Activity Audit Log, accessible in Settings, records every action performed on the platform by every user. Each log entry shows the date and time, the type of action (Add, Edit, or Delete), the user who performed it, the record or table affected, and the previous and current values of any changed fields, highlighted for easy comparison. This level of audit trail detail supports both internal quality management processes and external compliance reviews.

Each user's storage folder is private to that user by default. Files can be uploaded by dragging and dropping or browsing from any device. Multiple files can be uploaded simultaneously. Within their folder, users can create subfolders to organise their documents, create text files directly within the drive using a built-in text editor, rename files and folders, move files between folders, and copy files to other locations. The maximum file size per upload is 5MB.

Files can be shared with specific individual users, multiple users, or an entire user type or group. Sharing permissions can be set to View Only or Edit, giving the sharing user control over whether the recipient can modify the file. The Shared With Me view shows all files that have been shared with the logged-in user along with the source folder and owner. Admin users have access to all user folders and files across the platform and can view total storage consumption through the Storage Analytics view, which shows total storage used, active storage, trashed storage, and a per-user breakdown of storage size and percentage. Files deleted by any user are moved to Trash and can be restored by an admin before permanent deletion.

WCC includes a built-in chat module accessible from the platform dashboard and from the mobile app. Users can send direct messages to any other registered platform user and create group chats for team communication. All conversation history is retained within the platform and accessible to the participants in the conversation at any time.

The platform also includes a full contact directory that displays all registered users with their contact details, filterable by user group. External contacts who are not registered platform users can be added to the directory by an admin and made visible to all users, specific users, or a specific user group. The directory can also be set to display in the mobile app, giving support workers access to coordinator and management contact details without needing to maintain a personal contact list. The directory is refreshed automatically at midnight each night as user data changes, and can be manually refreshed at any time using the Fetch Contacts from Users button.