Regulation 17: good governance that can be evidenced

Regulation requires

Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires effective systems for compliance. Paragraph 17(2) addresses quality and safety monitoring, risk reduction, secure and accurate care records, necessary employment and management records, feedback, and improvement of the information processes themselves.

The requirement concerns operation as well as design. A policy describes an intended arrangement; records of decisions, checks and follow-up help establish whether that arrangement is working.

Under 17(3), a registered person asked by CQC for the specified written report must respond within 28 days beginning on the day after receiving the request. The report covers compliance with the quality, safety and risk-monitoring requirements and relevant improvement plans.

CQC looks for

CQC's guidance expects scrutiny by the board or equivalent leadership, regular audit, timely and accurate information, competent analysis and escalation where findings require action. Feedback should influence improvement, and leaders should monitor progress when an agreed action is delayed.

For an audit review, this means looking beyond whether a register exists. Can staff explain how concerns reach a decision-maker? Do repeated incidents appear in management discussions? Is an action marked complete because a document was written, or because its effect was checked?

A practical evidence trail

Our recommendation is to trace a small selection of real issues from identification to follow-up. Record the underlying facts, the relevant requirement, the risk to people, the decision, the accountable owner and the evidence used to close the action.

A repeat finding should prompt examination of why earlier action failed. Possible questions include whether staff understood the change, resources were available, responsibilities were clear and the original audit tested the right thing. These are review prompts, not assumptions about a particular provider.

• Concern: what was observed, when, and how reliable is the information?
• Decision: who evaluated the risk and what action was authorised?
• Delivery: what changed in practice, and who checked it?
• Outcome: what evidence shows that the identified risk reduced?
• Learning: where else might the same weakness exist?

Other law requires

Governance records can contain sensitive personal information. UK GDPR and the Data Protection Act 2018 require an appropriate legal basis, purpose limitation, security and retention controls; health information needs an additional special-category condition. An audit purpose does not justify collecting unrestricted copies of patient records.

Where a decision concerns a person who may lack capacity, the Mental Capacity Act framework and applicable consent or authorisation rules must be considered. Current deprivation-of-liberty practice must reflect the Supreme Court's 2 June 2026 judgment and subsequent DHSC guidance. DoLS continues where applicable; LPS has not replaced it.

Sector and framework notes

In homecare, useful samples may connect missed or late visits with risk assessment and escalation. In a care home, they may connect medicines or nutrition checks with care-plan changes. In a clinic, they may connect consent, test-result follow-up or equipment checks with management oversight. These are suggested audit starting points, not reported breaches or a fixed universal checklist.

Regulation 17 remains a legal obligation regardless of proposed assessment-framework changes. Current Well-led quality statements and draft sector KLOEs help organise evidence but do not replace the regulation. Label each mapping with its framework version.

Enforcement exposure

Regulation 22 identifies failure to comply with Regulation 17(3) as an offence. It is inaccurate to describe every governance shortfall under Regulation 17 as automatically prosecutable under that provision. Other breaches can support regulatory action, and the facts may engage additional requirements.

Treat a CQC information request, identified safety risk and ordinary improvement action as distinct work items, each with its own owner and deadline.

Our recommendation

Maintain a concise assurance dashboard linked to the underlying evidence. Show overdue high-risk actions, recurring findings, feedback themes, staffing concerns and checks of completed improvements. Agree what must be escalated immediately and what can wait for a routine governance meeting.

Use a proportionate sample and document its limitations. A clean sample does not prove that every record or service location is compliant. Reports should distinguish missing evidence, observed weaknesses and matters requiring further investigation.

Evidence checklist

• Governance responsibilities and escalation arrangements.
• Audit programme with sampling method, findings and repeat checks.
• Risk register linked to current mitigation and responsible owners.
• Management or board minutes showing challenge and decisions.
• Care-record and recruitment-record quality reviews using minimised samples.
• Feedback analysis and evidence of resulting changes.
• Action tracker with closure evidence and overdue-item escalation.
• Register of CQC information requests and verified response dates.

Common questions

Sources and review record

1. legislation.gov.uk — Uksi · 2014 · 2936 · regulation · 17 · data.html↗ (opens in a new tab)
2. legislation.gov.uk — Uksi · 2014 · 2936 · regulation · 22 · data.html↗ (opens in a new tab)
3. cqc.org.uk — Regulation 17↗ (opens in a new tab)
4. cqc.org.uk — Governance management sustainability↗ (opens in a new tab)
5. ico.org.uk — Special category data↗ (opens in a new tab)
6. gov.uk — Uk supreme court 2026 judgment on what constitutes a deprivation of liberty↗ (opens in a new tab)
7. questions-statements.parliament.uk — 22320↗ (opens in a new tab)

Content version: 1 November 2026 · Next scheduled content review 1 December 2026. This is a content review date, not a monitoring service or a guarantee that a source will remain unchanged.