CQC Regulation 17: good governance explained

What is CQC Regulation 17?

Regulation 17, good governance, is part of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014. It requires providers to run systems that assess, monitor and improve quality and safety, manage risks, keep accurate records, seek and act on feedback from people and staff, and keep improving how they do all of this.

In short, Regulation 17 asks one question: do you know what is happening in your service, and do you act on it? To check your own answer before an inspector does, run a practice inspection with the free CQC mock inspection kit.

Regulation 17 in plain English

The regulation, part by part

Regulation 17 applies to every provider registered with CQC for a regulated activity, from a small home care agency to a group of care homes.

What CQC inspectors check

CQC’s guidance on Regulation 17 is specific. Inspectors look for:

• Regular audits measured against the regulations that include, where possible, the experiences of people who use the service.
• Oversight at the top. The system must include “scrutiny and overall responsibility at board level or equivalent”, which in a small service means the owner or director.
• Good information. Up to date, accurate and reviewed by people with the skills to understand it, with escalation when results call for it.
• Results that travel. People who need to know, inside and outside the service, hear about reviews and the actions that follow.
• Feedback that leads somewhere. Providers should seek views from people, families, staff and visiting professionals, and must be able to show how they analysed and responded to them.
• Plans that move. Progress against improvement plans is monitored, with action without delay when it slips.
• Records that are fit for purpose. Complete, legible, accurate, up to date and secure, including consent and decisions made under the Mental Capacity Act.

Under the current framework, most of this evidence sits under the Well-led key question, in the quality statement on governance, management and sustainability. In CQC’s draft framework for adult social care, the matching key line of enquiry is called governance and management.

Nine ways to evidence Regulation 17

1. A governance calendar. Which audit happens when, who does it and who reviews it.
2. Closed audit loops. For each key area, one example of audit, action and re-audit, with dates.
3. A live risk register. Every risk has an owner, an action, a review date and a current rating.
4. A monthly quality report to the owner, director or board: risks, trends, actions and what changed.
5. “You said, we did”. Feedback from people and relatives with a visible response, on a board, in a newsletter or at meetings.
6. Staff feedback with actions. A regular anonymous survey and team meeting minutes that record outcomes.
7. Learning from incidents and complaints. Themes you have spotted, changes you made and how staff heard about them.
8. Record-keeping checks. Care plan audits and samples of daily notes checked for quality.
9. An improvement plan that moves. Dated entries that show what has been done, by whom and with what result.

The same evidence looks a little different by setting. A home care service adds spot checks on visits and call time data. A supported living provider with several houses keeps a short quality report for each service and one for the group.

Staff feedback deserves a special mention, because it links governance to retention. Turnover in adult social care was 22.1% in Skills for Care’s 2026 data, and each leaver costs a median £7,870 to replace. Our free retention white paper, CQC Edition 2026, shows what inspectors look for in your workforce data.

Common gaps behind a Regulation 17 finding

• Audits that find problems but lead to no action.
• Action plans with no owner or date, or nobody checking them.
• Feedback collected but never acted on or reported back.
• Governance that depends on one person and stops when they are away.
• Records written up hours later, or with gaps.
• Leaders with little view of nights, weekends or care in people’s homes.

Regulation 17 and repeated Requires improvement

Regulation 17 also matters when a rating stalls. CQC’s guidance on services repeatedly rated Requires improvement, which it says is under review, explains that after a first Requires improvement rating it writes to the provider to say that further ratings of Requires improvement may be a breach of Regulation 17. It may also ask for an improvement action plan under Regulation 17(3), to be returned within 28 days. Our 90-day plan back to Good shows how to respond.

Can CQC prosecute for a Regulation 17 breach?

For one part, yes. If a provider fails to send the written report CQC asks for under Regulation 17(3), CQC can prosecute, and it can do so without first serving a Warning Notice. For other parts of the regulation, CQC can take regulatory action, such as an action plan request or a Warning Notice.

How the evidence builds itself

Regulation 17 asks you to seek and act on feedback, and to show how it led to improvements. CareKudos runs a monthly anonymous Staff Voice survey with results on the dashboard. Good Catch records safety observations and what changed as a result. Recognition from colleagues, managers and families shows the culture day to day.

The monthly evidence report brings this together, sorted under CQC’s key questions, as a tamper-evident PDF you can share with your owner or board. It sits next to your audits and risk register and gives them the people’s side of the story.

Questions managers ask