When CQC finds problems in a service, Regulation 17 is the breach it cites most often. Not because providers do not audit, but because their audits do not connect to anything.
Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 is the good governance regulation. It requires every registered provider to operate systems that assess, monitor and improve the quality and safety of the service, manage risk, keep accurate and complete records, and seek and act on feedback.
It is also the regulation behind most requires improvement and inadequate well-led judgements. The pattern in published reports is remarkably consistent: the service has audits, but the audits are tick-box exercises that miss the problems inspectors find within hours, or they find the problems and nothing happens next. This guide sets out the audit cycle CQC actually expects to see, and how to run it without drowning a small service in paperwork.
What Regulation 17 actually requires
Strip the legal language back and the regulation asks four questions of your service:
- Do you know how good and how safe your service is right now, from your own systems rather than from CQC telling you?
- Do you know your risks, and are you doing something about them?
- Are your records accurate, complete and current, for the people you support, your staff and the management of the service?
- Do you gather feedback from people, families and staff, and can you show what changed because of it?
Every audit, meeting and quality report you produce should serve one of those four questions. Anything that serves none of them is decoration.
The audit cycle, not the audit
The word cycle matters more than the word audit. A cycle has five stages, and inspectors look for evidence of all five:
- Schedule. A planned programme across the year covering the areas that matter for your service: care records, medicines, infection prevention and control, health and safety, recruitment files, incidents and accidents, complaints, notifications, training and supervision.
- Audit. Done against a defined standard, by someone competent, with enough sampling to mean something. Five care plans checked properly beat twenty skimmed.
- Findings and actions. Every finding becomes an action with an owner and a date. This is the join most services break at: audits filed with findings that never became actions.
- Follow-through. Actions get closed, and someone checks the fix worked. An action plan where everything is marked complete but the next audit finds the same issues is worse than no plan at all, because it shows the system is performative.
- Learning and oversight. Themes go to team meetings and to whoever holds provider-level oversight, a nominated individual, director or owner, who can evidence that they check the manager’s picture rather than simply receiving it.
What inspectors test
Assessment conversations about governance are practical. Expect an inspector to pick a thread and pull: show me your last medicines audit, show me the actions from it, show me the evidence this action was completed, now let us look at the medicines records today and see whether the problem is still there. If the thread holds, well-led gets easier across the board. If it snaps, every other claim in your quality report loses credibility.
Inspectors also triangulate your governance against reality: your incident log against your statutory notifications, your training matrix against the staff on shift, your complaints log against what families tell them, your quality report against what staff say in interviews. A governance system that only exists in the office does not survive triangulation.
Right-sizing governance for a small service
Regulation 17 does not require a quality department. A domiciliary agency with twenty clients can be fully compliant with a one-page annual audit schedule, a standing monthly audit slot in the manager’s diary, one live action plan, and a quarterly review with the provider. What it cannot survive is pretending: importing a corporate governance framework it never uses, or buying a stack of audit templates that stay blank. Pick the smallest system you will genuinely run, then run it without gaps.
A twelve-month schedule you could actually run
To make this concrete, here is the shape of an audit year for a small to medium community service. Adjust areas and frequency to your own risks; the value is in the pattern, not the specific grid.
| Area | Frequency | Typical sample |
|---|---|---|
| Medicines administration records | Monthly | All clients with support, or a rotating sample in larger services |
| Care plans and risk assessments | Monthly | Five files, rotating so every file is seen across the year |
| Incidents, accidents and notifications cross-check | Monthly | Whole log for the month |
| Daily records and visit logs | Quarterly | Sample across staff and clients |
| Recruitment files | Quarterly | All starters that quarter plus two legacy files |
| Training and supervision compliance | Quarterly | Whole matrix |
| Complaints and feedback themes | Quarterly | Whole log plus survey results |
| Infection prevention and control | Twice yearly | Practice observation plus stock and guidance check |
| Health and safety, premises and equipment | Twice yearly | Office and a sample of delivery settings |
| Policy review currency | Annually, spread across months | Full policy set on a rolling schedule |
Run honestly, this is roughly a day of management time per month. The discipline that keeps it alive is boring and effective: the audit slots sit in the diary as recurring appointments, each audit ends with its actions transferred to the single action plan before the file closes, and the quarterly provider review opens with last quarter’s actions rather than this quarter’s good news.
Records deserve their own line
Regulation 17 explicitly covers records, and record-keeping failures are among the most cited specifics in reports: care plans that do not reflect current needs, gaps in medicines administration records, incomplete recruitment files, unsigned or undated entries. Build records into the audit schedule as a topic in its own right, and treat every records finding as a governance finding, because that is how CQC treats it.
What to do now
- Write or refresh a twelve-month audit schedule that covers your genuine risk areas, and put the slots in the diary.
- Move every open finding from past audits onto a single action plan with owners and dates. One plan, not one per audit.
- Pick one past action marked complete and verify the fix is still in place. If it is not, your follow-through stage needs rebuilding first.
- Set a quarterly provider-level review where someone above the registered manager examines the evidence, and minute it.
- Test your own thread the way an inspector would, from audit to action to today’s records, and fix whichever link snapped.
How Cura Compliance can help
Our mock inspection service runs exactly this thread-pulling exercise across your service and leaves you with a prioritised action plan. The CuraFlow suite includes our compliance portal for running audits and action plans digitally, alongside policy libraries with the audit tools and governance policies a Regulation 17 system needs. If you are pre-registration, our CQC registration support service builds the governance framework your interview answers will describe.
Frequently asked questions
What is Regulation 17 of the Health and Social Care Act regulations?
It is the good governance regulation. It requires registered providers to run effective systems to assess, monitor and improve quality and safety, manage risks, keep accurate records, and seek and act on feedback about the service.
What audits does CQC expect a care service to do?
There is no fixed statutory list. CQC expects a planned programme proportionate to your service, typically covering care records, medicines, infection prevention and control, health and safety, recruitment files, incidents, complaints and training, with findings turned into completed actions.
How often should care service audits be done?
Frequency should follow risk. Many services audit medicines and care records monthly and lower-risk areas quarterly or twice yearly. What matters at assessment is that the schedule exists, is followed, and produces actions that get closed.
Why do providers get breaches of Regulation 17?
Most commonly because audits failed to identify problems inspectors then found, because findings never became completed actions, or because records were inaccurate or incomplete. The breach is usually about the system around the audits, not the absence of audits.
Does Regulation 17 apply to small providers?
Yes, fully. The systems can be simple and proportionate, but every registered provider, down to the smallest agency, must be able to evidence the cycle of audit, action and learning.
What is the difference between Regulation 17 and the well-led key question?
Regulation 17 is the legal duty; well-led is the assessment lens. CQC assesses well-led using its quality statements, and where governance falls short it cites Regulation 17 as the breached regulation. Build your systems to the regulation and the well-led evidence largely takes care of itself.
Sources
- The Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, Regulation 17 (legislation.gov.uk, accessed September 2026)
- CQC guidance on meeting the regulations and the well-led key question (cqc.org.uk, accessed September 2026)