Regulation 17 is the fundamental standard that sits behind almost every poor well-led rating. It is short, it sounds abstract, and it is breached far more often than any regulation about direct care, because it is about whether the provider knows what is happening in its own service and does something about it. This guide explains what Regulation 17 requires, what CQC looks for, why homes get caught by it, and the evidence that shows governance working rather than existing on paper.
The short answer
Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires providers to have systems and processes that work in practice to assess, monitor and improve the quality and safety of the service, manage risk, keep accurate and contemporaneous records for every person, keep proper staff and management records, seek and act on feedback, and improve practice. The key words are 'operated effectively'. An audit nobody acts on, a policy nobody follows and a care plan written after the event all count as governance failures. Good evidence is a small set of audits with dated actions that were closed, records written at the time, and a clear line from a problem found to a change made.
What Regulation 17 actually says
Regulation 17(1) says systems or processes must be established and operated effectively to ensure compliance with the other fundamental standards. Regulation 17(2) lists what those systems must enable the provider to do:
| Part | What it requires | What it looks like in a care home |
|---|---|---|
| 17(2)(a) | Assess, monitor and improve the quality and safety of the service | Audits of medicines, care plans, infection control and the environment, with actions that get closed |
| 17(2)(b) | Assess, monitor and mitigate risks to health, safety and welfare | Risk assessments that are current, incident analysis, falls and pressure ulcer trends acted on |
| 17(2)(c) | Maintain an accurate, complete and contemporaneous record for each person | Care plans, daily notes and charts written at the time and kept up to date |
| 17(2)(d) | Maintain records about staff and the management of the regulated activity | Training, supervision, recruitment, rotas, maintenance and policies that are current and findable |
| 17(2)(e) | Seek and act on feedback from people, families, staff and others | Surveys, residents' meetings, complaints analysis, with a 'you said, we did' trail |
| 17(2)(f) | Evaluate and improve practice in relation to the above | Learning from incidents and audits shared with staff and changing practice |
Regulation 17(3) also says that if CQC asks, the provider must send a written report within 28 days setting out how it is meeting 17(2)(a) and (b), and its plans for improvement.
Why Regulation 17 is breached so often
When an inspector finds a medication error, a missing risk assessment or an out-of-date care plan, the first breach may be under Regulation 12 (safe care and treatment) or Regulation 9 (person-centred care). But the next question is always: why did the provider not know? If the home had a medicines audit that should have caught the error and did not, or caught it and did nothing, that is a Regulation 17 breach as well.
That is why Regulation 17 appears in so many reports. It is the regulation that turns a single failing into evidence that the systems are not working. It is also why a service can be rated Requires Improvement under well-led even when the day-to-day care is kind and competent.
'Operated effectively' is the whole test
Most homes have the paperwork. Governance fails on three patterns:
- The audit that finds nothing. A monthly care plan audit with every box ticked, in a home where the inspector finds three out-of-date plans on the first morning. The audit was not testing anything.
- The action that never closes. An audit finds a problem, writes an action, and the same action appears next month and the month after. Nobody owns it and nobody checks it.
- The record written later. Daily notes written at the end of the shift, charts filled in from memory, a care plan updated after the inspector asked. Records that are not contemporaneous breach 17(2)(c) directly.
Inspectors test effectiveness by sampling. They will pick an audit, find an action, and check whether it was done. They will compare a resident's care plan with what staff tell them and what they see. They will look at the times on daily notes. A governance system that cannot survive that sampling is not operated effectively.
The audits that matter
More audits is not better governance. A small set done properly beats a large set done as box-ticking. For most care homes, a core programme looks like this:
| Audit | Frequency | Tests |
|---|---|---|
| Medicines | Monthly, with weekly controlled drug checks | MAR gaps, codes, stock, PRN protocols, storage, competency |
| Care plans and risk assessments | Monthly sample | Current, personalised, reviewed after change, matching what staff do |
| Incidents, falls, safeguarding | Monthly analysis | Trends by person, time and place, actions taken, notifications made |
| Infection prevention and the environment | Monthly | Cleaning records, equipment, laundry, hand hygiene |
| Staffing and training | Monthly | Training compliance, supervisions, agency use, rota cover |
| Health and safety and fire | Weekly checks, monthly review | Fire tests, PEEPs, water safety, equipment servicing |
| Feedback and complaints | Quarterly | Themes, responses, what changed |
Our medication audit checklist shows what a good medicines audit tests, and our guide to care home policies and procedures explains how audits connect policies to practice.
Making actions close
Every action from an audit, an incident review, a complaint or a meeting should have four things: what will be done, who owns it, by when, and how you will know it worked. Keep one action log for the home rather than actions scattered across ten documents. Review it at a fixed meeting each month, and close an action only when the evidence is attached.
The test inspectors apply is simple: pick an action from three months ago and ask what happened. A strong answer is 'it was closed on this date, this is what changed, and the next audit shows it held'.
Contemporaneous records
Regulation 17(2)(c) is the part most often breached without anyone noticing. 'Contemporaneous' means written at the time, or as close to it as is practical. Daily notes written in a block at 7pm, charts completed at the end of the shift from memory, and fluid totals estimated rather than recorded are all weak.
The fix is not more training on record keeping. It is making recording quick enough to do at the time. If writing a note takes five minutes at a desk, it will be done at the end of the shift. If it takes a few moments on a phone in the room, it will be done in the moment. Our article on daily care notes shows the difference, and digital versus paper records covers the trade-offs.
Provider oversight
Governance is not only the registered manager's job. The provider, through the nominated individual or directors, must have its own oversight. For a single-home provider this might be a monthly visit by the owner with a written report. For a group it means a provider-level dashboard, regular quality visits, and the ability to see across homes.
Inspectors will ask the provider what they know about the home and how they know it. A provider who can describe the falls trend, the training compliance and the open safeguarding concerns from their own reports, without ringing the manager first, is showing oversight. Our guide to getting back from Requires Improvement covers provider oversight in more detail.
How Regulation 17 maps to the single assessment framework
Under CQC's single assessment framework, governance evidence sits mostly in the well-led quality statements: governance, management and sustainability; learning, improvement and innovation; and freedom to speak up. But because Regulation 17 underpins compliance with every other standard, weak governance tends to show up across safe and effective too. Our guide to the quality statements explains how evidence is scored.
A governance pack that works
When an inspector arrives, the registered manager should be able to show a short governance pack:
- The audit schedule and the last three months of completed audits.
- One action log with owners, dates and closures.
- Monthly analysis of incidents, falls, safeguarding and complaints, with trends and actions.
- Training and supervision compliance.
- The notifications log.
- Provider oversight reports.
- Minutes of staff and residents' meetings showing feedback and learning shared.
- An improvement plan that reflects what the audits found.
Most of that should be produced by the systems you already use, not assembled the week before. When it has to be assembled, it usually means the system is not being used for oversight.
Worked example: the medicines audit that kept passing
A 40-bed home completes a monthly medicines audit. For six months every audit scores above 95 per cent. Then an inspection finds missing signatures on four MAR charts, two PRN medicines without protocols, and a controlled drug balance that does not match.
The audit had been checking that the MAR folder was tidy and the fridge temperature recorded, not sampling charts or counting stock. The provider rewrites the audit to sample five residents a month in full, count all controlled drugs, and check every PRN against a protocol. The first new audit scores 71 per cent, which is the true position. The actions are logged with owners. Three months later the score is 94 per cent, and this time it is real. At the next inspection, the inspector sees the drop, the actions and the recovery, and that trail is stronger evidence of good governance than six months of perfect scores.
Common mistakes
- Audits that check paperwork exists rather than testing whether it is right.
- Actions repeated month after month with no owner or closure.
- Feedback gathered but no record of what changed as a result.
- Records written at the end of the shift rather than at the time.
- Provider oversight that consists of asking the manager how things are.
- A governance file assembled for inspection rather than used every month.
- Too many audits, none done well.
What good looks like on inspection day
The inspector asks the manager how she knows the service is safe. She opens the governance pack: last month's audits, the action log with dates and owners, the falls analysis showing a cluster in the evenings and the staffing change made in response, and the provider's monthly report. The inspector picks an action from February and the manager shows when it closed and the audit that confirmed it held. The daily notes sampled have times through the shift, not a block at 7pm. If you want to see how audits, actions and records sit together in one system, book a demo.
Final conclusion
Regulation 17 is not about having a governance file. It is about whether the people running the service know what is happening and act on it. Keep the audit programme small and honest, keep one action log and close actions with evidence, make recording quick enough to happen at the time, and make sure the provider has its own view of quality. A home that does those four things will rarely be caught by Regulation 17, because problems are found and fixed before an inspector finds them.
Frequently asked
What is CQC Regulation 17?
Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 is the good governance fundamental standard. It requires providers to have systems that work in practice to monitor and improve quality and safety, manage risk, keep accurate records, seek and act on feedback, and improve practice.
What does 'contemporaneous records' mean under Regulation 17?
Records written at the time care is given, or as close to it as practical. Notes written in a block at the end of a shift or completed from memory are not contemporaneous and are weak evidence.
Why is Regulation 17 breached so often?
Because it is the regulation that applies when a provider's systems failed to spot or fix a problem. A medication error may breach Regulation 12, but if the medicines audit should have caught it, Regulation 17 is breached too.
What audits does a care home need for Regulation 17?
A core programme usually covers medicines, care plans and risk assessments, incidents and falls, infection prevention, staffing and training, health and safety, and feedback and complaints. A small set of honest audits with closed actions is better than many tick-box audits.
Which key question does Regulation 17 relate to?
Mainly well-led, through the governance, management and sustainability and learning and improvement quality statements. Weak governance often affects safe and effective ratings too.
What is a Regulation 17(3) report?
If CQC asks, a provider must send a written report within 28 days explaining how it is assessing, monitoring and improving quality and managing risk, and its plans for improvement.
Sources
- Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, regulation 17
- CQC: guidance for providers on meeting the regulations, Regulation 17 good governance
- CQC: single assessment framework, well-led quality statements
- NICE guideline SC1 Managing medicines in care homes
