CQC Regulation 17 Good Governance: What It Requires and How to Evidence It

CQC Regulation 17 Good Governance: What It Requires and How to Evidence It

Regulation 17 is the regulation that holds the other fundamental standards together. Here is what it requires, what inspectors want to see, and how to prove your governance works.

CQC Regulation 17 (good governance) requires you to run systems and processes that assess, monitor and improve the quality and safety of your service, manage risk, keep accurate records and act on feedback. To evidence it, show a regular audit programme, a governance meeting that closes actions, a live risk register and records that are complete and up to date. You must also be able to send CQC a written report on how you do this within 28 days of being asked.

Regulation 17 sits behind almost every serious inspection finding. A service can deliver kind, attentive care and still breach it, because inspectors are asking a different question: how would you know if something was going wrong?

This guide turns the wording of the regulation into practical steps. It follows CQC’s own regulation guidance (CQC: Regulation 17) so you can plan your CQC compliance work against what the regulator actually says.

What Does Regulation 17 Actually Require?

The regulation has one headline duty and six specific ones. Systems or processes must be established and operated effectively to ensure compliance with the requirements in Part 3 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014. That means Regulations 4 to 20A, not just Regulation 17 itself.

The six specific duties, in plain English:

CQC’s guidance also says the system should include scrutiny and overall responsibility at board level, or the equivalent for your organisation. In a small owner-managed home, that means the provider or nominated individual visibly reviews the data, not only the registered manager.

The 28-Day Written Report: Be Ready Before CQC Asks

Regulation 17(3) lets CQC ask you for a written report setting out how, and to what extent, you are complying with 17(2)(a) and (b), and any plans you have to improve. You must send it no later than 28 days beginning on the day after you receive the request.

CQC’s guidance says this could include a request for an action plan or, in adult social care, a Provider Information Return. It also says CQC can prosecute for failing to submit the report when requested, without first serving a warning notice.

How to be ready:

• Keep a current summary of your audit programme, latest findings and open actions that you could send within days, not weeks.
• Keep your latest improvement plan with owners, dates and status.
• Know who in the organisation signs off a report to CQC.

For the Provider Information Return, see our guide to the CQC provider information return.

What Is a Breach of Regulation 17?

A breach of Regulation 17 means CQC has found that the provider has not met a requirement of the regulation. The headline duty is to establish and operate effectively systems or processes that ensure the provider complies with the other requirements of Part 3 of the 2014 Regulations. The specific duties cover assessing, monitoring and improving quality and safety, assessing and mitigating risk, keeping accurate and complete records, and seeking and acting on feedback. In practice, inspectors usually cite it not for a single mistake but because the provider has no system that would catch and correct problems. Examples of what a breach can look like (our summary, not CQC wording):

• Audits are not done, or are done but findings are not acted on.
• Actions are raised with no owner or deadline and never closed.
• Risks to people are recorded but not mitigated, or not recorded at all.
• Care, staff or management records are missing, inaccurate or out of date.
• Incidents are logged without learning, or feedback is collected but not used.
• The written governance report CQC requested was not sent within 28 days.

Can CQC Prosecute for a Breach of Regulation 17?

Only for one part. CQC’s offences guidance lists Regulation 17(3), the requirement to give CQC a report on how you comply with the good governance requirements and your improvement plans within 28 days of a request, as an offence that CQC may prosecute directly, without first issuing a warning notice. For the other parts of Regulation 17 (17(1) and 17(2)), CQC cannot prosecute but can take other regulatory action under its enforcement policy.

What Do Inspectors Look For When Testing Governance?

Governance is mostly judged through the well-led lens, but a weak system usually shows up as breaches elsewhere. These are practical tests to run against your own service, based on the wording of the regulation and CQC’s guidance:

• Can you show what you audited, when and what you found? CQC says audits should be baselined against Regulations 4 to 20A and, where possible, include people’s experiences.
• Do findings lead to action? Guidance says providers must monitor progress against improvement plans and act without delay when progress is not achieved.
• Is information accurate, up to date and reviewed by someone competent to understand it? Results should be escalated when required.
• Do people hear what happened? Providers should have communication systems so people using the service, staff and, where appropriate, external bodies know the results of reviews and required actions.
• Are risks handled in proportion? Measures to reduce or remove a risk should be introduced within a timescale that reflects the level of risk.
• Do you share information with the right bodies? Subject to consent and confidentiality, that includes safeguarding boards, coroners and regulators.

How to Build Governance That Passes an Inspection

1. Set an audit calendar linked to the regulations

List what you audit, how often and who does it. Cover at least medication, care plans, infection prevention and control, health and safety and premises, safeguarding, supervision and training, complaints, mental capacity and DoLS, and recruitment. Our guide to how to carry out a care home audit and the audit schedule template give you a starting point.

2. Hold a governance meeting that produces actions

A monthly or quarterly meeting should review audit results, incidents, complaints, safeguarding, staffing, training and risks. Minutes are worth little unless each action has an owner and a date. See how to run a care home governance meeting and the governance meeting agenda.

3. Keep a live risk register

Record each risk, the control measures, the owner, the review date and escalation route. Include risks to staff and visitors, because the regulation covers “others”.

4. Treat records as evidence

Care records must be complete, legible, accurate and up to date, with decisions and consent recorded. Mental capacity decisions need to show they followed the Mental Capacity Act 2005. Records must be stored securely and meet the Data Protection Act 2018 whether paper or electronic.

5. Seek feedback and show what changed

Collect views from residents, relatives, staff and visiting professionals. CQC says you must be able to show how you analysed the feedback, took action and made improvements. A “you said, we did” board is simple evidence.

6. Review the system itself

Once a year, ask whether your audits and meetings are finding problems early. If the first time you hear about an issue is from an inspector, your system needs changing. That is exactly what 17(2)(f) is about.

Common Regulation 17 Gaps to Fix Now

• Audits with no action plan. Findings are logged but nobody owns them.
• Actions with no deadline or re-check. Nobody confirms the fix worked.
• Records written late. Care notes completed at the end of the shift or days later weaken the “contemporaneous” requirement.
• Provider not involved. The nominated individual or owner does not see the data.
• Feedback collected but not used. Surveys with no analysis or response.
• Governance built for the inspection. Paperwork appears in the weeks before a visit and stops afterwards.

If an inspection has already found a Regulation 17 breach, see how to write a CQC improvement plan and Regulation 12: safe care and treatment, which often appear in the same report.

What Happens After a Regulation 17 Breach

CQC chooses its response according to risk. Depending on the case it can ask for an action plan, serve a warning notice, impose conditions, or take further action if problems continue. A breach is usually reflected in the report and often affects the well-led rating. Useful guides on each step:

• Action plan request (formerly a requirement notice): how to respond within 28 days.
• Responding to a warning notice, including the short window for representations.
• Enforcement action explained.
• Factual accuracy check on the draft report: your chance to correct errors before the report is published.

How to Fix a Regulation 17 Breach

1. Read every finding and map it to the part of Regulation 17 it relates to (quality and safety, risk, records, feedback).
2. Check the facts and use the factual accuracy process if the draft report is wrong.
3. Fix the system, not just the symptom. If audits were missed, create a schedule with an owner. If actions stayed open, add a monthly governance review that closes them.
4. Write an action plan with owners, dates and the evidence that will show each action is complete (how to write an improvement plan).
5. Collect dated evidence as you go: completed audits, minutes, closed actions and updated records.
6. Tell CQC when you have achieved compliance, with the evidence, and re-audit to show it holds (from Requires Improvement to Good).

Why Regulation 17 Breaches Are Common

CQC’s State of Care 2025/26 (published October 2026) says leadership is a key area for improvement in care homes: about a third were rated Requires improvement (31%) or Inadequate (3%) for the well-led key question. Looking at the well-led quality statement on governance, management and sustainability, it found shortfalls in more than half (55%) of the care home assessments that looked at it. Inspectors and specialists told CQC the key concerns included leaders not having the time and support they need to provide good oversight and drive improvements, and not listening to staff or acting on their feedback. See what causes an Inadequate rating.

Tracking Governance Evidence in One Place

CQCLogic includes an audit schedule tracker with 12 pre-loaded audits, findings and re-audit dates, a governance meetings module with a 10-item agenda and actions, a KPI dashboard, task tracking with deadlines, and logs for incidents, complaints, safeguarding, supervision and training. These are separate registers rather than a single integrated quality system, so link them through your actions: every finding becomes a task with an owner and a date.