Check the scope
Registered providers and managers carrying on regulated activities in England. Systems should be effective and proportionate to the service’s size, complexity and risks.
What the law requires
- Establish and operate effective systems to meet the regulatory requirements. Assess, monitor and improve quality and safety, including people’s experience, and assess and mitigate risks.
- Maintain secure, accurate, complete and contemporaneous service-user records, including care, treatment and decisions. Keep necessary employment and management records securely.
- Seek and act on feedback, and evaluate and improve information-processing practice. If CQC requests the report specified in Regulation 17(3), provide it within 28 days beginning on the day after receipt.
What CQC expects
- CQC guidance expects scrutiny by the board or equivalent, competent analysis of current information, effective audit and appropriate escalation of concerns.
- Leaders should demonstrate that identified problems led to action and improvement. Records should support continuity of care and show decisions clearly.
Suggested checks for your review
- Select a material concern and trace it through recognition, assessment, escalation, decision, action, outcome and learning.
- Compare management reports with a sample of underlying records, staff accounts and people’s experiences to test accuracy and completeness.
- Review overdue or repeatedly reopened actions; ask who owns the risk, what interim protection exists and what evidence will demonstrate closure.
Illustrative evidence
Choose evidence relevant to the actual service and risk. These examples are not a universal list of documents required by CQC.
- A risk register with clear owners, controls and review decisions.
- Meeting records and audit reports linked to specific improvement actions.
- Checks of care records and feedback showing whether changes worked in practice.
Potential gaps to check
- An audit reports compliance from a narrow sample without explaining what was examined or what remains uncertain.
- Actions close when a document is issued, without evidence that practice changed.
- Managers receive reassuring totals that conceal repeated failures affecting a smaller group of people.
Sources and review
- cqc.org.uk — Regulation 17 (opens in a new tab)
- legislation.gov.uk — Uksi · 2014 · 2936 · regulation · 17 (opens in a new tab)
Content version: 1 November 2026. Next planned review 1 December 2026. Check current primary sources before relying on a requirement.
Give the finding a next step.
Add a non-confidential action or evidence reference to your own working plan.
Open the evidence workbenchRelated guidance and next steps
Content version: . Named expert review remains pending for public launch.