Regulation 17 (Good governance): Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires providers to have systems that assess, monitor and improve the quality and safety of the service, and to keep accurate, complete records.
It is the regulation most often cited in enforcement, because almost any other failure can also be read as a governance failure: if something went wrong and the provider had no system that would have caught it, Regulation 17 is engaged.
In practice it means audits that actually run on a cycle, findings that turn into actions with owners and dates, evidence that the actions were completed, and some demonstration that outcomes changed as a result. A folder of completed audit forms with no action trail is the classic way to fail it.
It also covers records: care records that are accurate and contemporaneous, and records about the running of the service itself, held securely and available when CQC asks.