CQC Regulation 17 Good Governance: what care providers need to evidence
What CQC Regulation 17 requires, what inspectors ask to see, the governance failures that lead to requirement notices, and the 28 day deadline for a written governance report.
Statixs Compliance Team
Statixs
Short answer: Regulation 17 requires you to run governance systems that actually operate, and to be able to show it. In practice that means four things an inspector can ask for on any ordinary day: a risk register with current ratings, named owners and dated reviews; audits whose findings become actions that close; records that are accurate, complete and retrievable; and evidence that people's feedback changed something. Documents alone do not satisfy it. The trail of the system running is what satisfies it.
What is CQC Regulation 17?
CQC Regulation 17 (Health and Social Care Act 2008, Regulated Activities Regulations 2014) requires registered persons to maintain effective governance systems that assess, monitor, and improve the quality and safety of the services they provide.
In practice, it is the regulation that covers everything that stops a care home from descending into reactive crisis management: risk registers, audit cycles, action plans, management oversight, and formal review structures.
It is also one of the most commonly cited regulations in CQC requirement notices. Poor governance is rarely about one incident. It is about the absence of a system that would have caught the incident earlier.
What CQC Inspectors Expect to See
1. A maintained risk register
Not a spreadsheet created the week before inspection. Inspectors look for:
- Active risks with current ratings (likelihood × impact)
- Named owners and review dates
- Evidence that risks have been reviewed, not just listed
- Actions taken in response to elevated risks
A risk register that hasn't been updated in three months tells an inspector that governance is ceremonial, not operational. See how a structured risk register system produces this evidence as you work.
2. Action plans that close
Action plans must demonstrate improvement, not just intent. CQC expects:
- Actions linked to identified risks, incidents, or audit findings
- Named responsible persons with deadlines
- Evidence of completion, not just a "closed" checkbox
- A trail showing what happened between the action being raised and being resolved
3. Regular audits with dated findings
Governance audits must be documented and dated. If your audit is "mental notes from the manager's walkround," it will not satisfy inspection evidence requirements.
Common audit areas inspectors look for evidence of:
- Medication management
- Staffing levels against baselines
- Training compliance
- Infection prevention
4. Governance meetings with minutes
Regular management review meetings with attendance records and decision logs. If governance only happens during inspections, the evidence will show it.
5. Responsive action after incidents
Inspectors follow the trail from incident to investigation to action to review. If that chain breaks anywhere, the governance finding will follow.
Common Governance Failures That Lead to Requirement Notices
| Gap | What CQC Sees |
|---|---|
| Risk register not updated | "No evidence that risks were actively managed" |
| Action plans created but not closed | "Actions identified but not followed through" |
| No governance meeting minutes | "No documented oversight by the registered person" |
| Audit findings not actioned | "Audits conducted but no evidence of improvement" |
| Incidents not reviewed at governance level | "Individual incident review but no systemic analysis" |
The Problem with Spreadsheet Governance
Most care providers run governance through a combination of spreadsheets, shared drives, and email threads. The fundamental problem is not the tools. It is that these systems do not produce evidence automatically.
When a CQC inspector asks for your governance evidence, you either have it structured and ready, or you spend the first hour of an inspection assembling it. The latter signals that governance is not embedded in day-to-day operations.
A governance operating layer changes this by producing evidence as part of the workflow (risk identified, action raised, evidence structured, review completed) rather than as a separate administrative exercise.
What Good Governance Evidence Looks Like
When Regulation 17 evidence is produced structurally:
- Risk register shows real-time status, last review date, current actions, escalation history
- Action plans show each action from open to closed, with evidence attached
- Assurance packs are pre-structured around CQC standards, ready before the inspector requests them
- Governance reviews are scheduled, attended, and logged with outcomes
- Audit trail is automatic. Every change, review, and decision is timestamped
This is the difference between governance as a paper exercise and governance as an operating function.
Regulation 17: Key Requirements Summary
| Requirement | Evidence Expected |
|---|---|
| Assess, monitor and improve quality | Regular audits with dated findings and outcomes |
| Assess, monitor and mitigate risks | Maintained risk register with owner and review trail |
| Maintain accurate, complete records | Documented governance decisions and meeting minutes |
| Seek and act on feedback | Records showing feedback received and responded to |
| Share information with relevant persons | Evidence of disclosure and notification where required |
FAQs
What does CQC Regulation 17 actually require?
Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires registered persons to establish and effectively operate systems or processes that ensure compliance with that Part of the Regulations. The regulation then names what those systems must enable: assessing, monitoring and improving the quality and safety of the service; assessing, monitoring and mitigating risks to service users and others; maintaining an accurate, complete and contemporaneous record for each service user; keeping the records needed in relation to staff employed and the management of the activity; seeking and acting on feedback in order to keep improving; and evaluating and improving how all of that information is handled.
Does CQC ever ask a provider to write a governance report?
Yes, and it carries a statutory deadline. Under Regulation 17(3), when the Commission requests it, the registered person must send a written report setting out how, and to what extent, the quality-and-safety and risk requirements are being complied with, together with any plans for improving the service. That report must be sent no later than 28 days beginning on the day after the request is received. This is one of the few places in Regulation 17 where a fixed date applies rather than a matter of provider policy.
How does Regulation 17 relate to the five key questions?
The five key questions are how CQC organises its judgement of a service. Regulation 17 is the legal duty that sits underneath the well-led question in particular, because it is the regulation that requires a system for assessing, monitoring and improving quality and risk. Evidence produced for Regulation 17, the risk register, audit cycle, action plans and governance minutes, is the same evidence a well-led judgement draws on.
Is a risk register enough on its own?
No. A register lists risks. Regulation 17 requires systems that assess, monitor and mitigate them, so the evidence has to show movement: a rating, a named owner, a review that happened on its review date, an action, and a record of the action being completed and checked. A register with no review trail evidences the list, not the system.
What is the most common Regulation 17 failure?
Governance that exists only as documents rather than as a running system. The register, the policy and the meeting template are all present, but nothing shows the cadence: no dated reviews, no minutes where a risk was escalated, no record of a decision being revisited after the situation changed. Regulation 17 asks for systems operated effectively, and a system that produced no trail in six months reads as a system that was not operated. The related question of audits turning into completed actions is covered in the CQC audit requirements and evidence checklist.
Where can I read Regulation 17 in full?
The text is published by The National Archives on legislation.gov.uk as regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014. CQC's own guidance on meeting the regulation is on cqc.org.uk. Those two are the only sources worth relying on.
Next Steps
If your current governance system relies on spreadsheets and shared folders, the question is not whether CQC will find a gap. It is when. This is the job CQC compliance software exists to do: produce governance evidence as part of daily work, not as a separate exercise before an inspection.
The Statixs governance layer is built specifically around Regulation 17 activity: risk register, action plans, assurance packs, and governance reviews connected in one operating system.
Email updates are not available at the moment
We are not collecting email addresses for updates right now. New guides and articles are published on the resources page.
See Statixs in your environment
A demonstration tailored to your compliance requirements: CQC compliance, DBS checks, scheduling, and workforce management.
Book a Demonstration