Plan management providers must work with a participant to define how they will manage their funds. This includes defining the invoice authorisation process and keeping full, accurate records of required evidence (such as invoices) and information needed to monitor and make a claim for funds from a participant’s plan. Plan management providers must provide a participant with regular (at least monthly) reports of plan expenditure and the balance of funds remaining in a participant’s plan. The plan management providers must also alert a participant of any risks associated with plan spending on services that will exceed a participant’s NDIS plan limit, or paying for supports and services not funded by the NDIS in a participant’s plan. A plan management provider must have robust security processes in place to store and maintain participant information. Both the physical and electronic means of storing NDIS participant information must protect against unauthorised access. These records should be consistent with the Australian Taxation Office requirements. The NDIS Commission Code of Conduct (external) provides additional information about what is expected of providers concerning the appropriate use and storage of participant information