Care home quality assurance

The rule: Regulation 17 and what CQC expects of audit

Regulation 17(1) of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 says “systems or processes must be established and operated effectively to ensure compliance with the requirements in this Part”, and Regulation 17(2) says those systems must enable the provider in particular to “assess, monitor and improve the quality and safety of the services provided”, “assess, monitor and mitigate the risks relating to the health, safety and welfare of service users and others”, keep the records, “seek and act on feedback”, and “evaluate and improve their practice” in all of this. Quality assurance is the practical form of that duty. Our Regulation 17 guide takes the regulation limb by limb; this one is the programme that meets it.

CQC’s guidance on Regulation 17 sets the standard a programme is judged by. Providers “must have systems and processes such as regular audits of the service provided”. The audits “should be baselined against Regulations 4 to 20A” and “should, where possible, include the experiences [of] people who use the service”. Systems are fit for purpose when they “enable the provider to identify where quality and/or safety are being compromised and to respond appropriately and without delay”, and information “should be up to date, accurate and properly analysed and reviewed by people with the appropriate skills and competence to understand its significance”. Above it all: “The system must include scrutiny and overall responsibility at board level or equivalent.”

Three consequences follow. The programme has to cover all the fundamental standards, not only the easy-to-count areas. It has to include what people living in the home think, not only what the records say. And it has to reach the people who run the provider, whether that is an owner, a company board or a charity’s trustees.

What a quality assurance programme contains

CQC asks every new provider to send its governance and quality assurance policies with its registration application, and its guidance on what they must contain is a good outline for any care home’s programme. The policies must show how the provider will meet Regulation 17, UK GDPR and the Data Protection Act 2018, and cover “details of how good governance will be achieved”, “the responsibilities of specific leaders and staff groups in your governance processes”, “how accountability works within your company”, “the processes you’ll use to assess, monitor and improve the quality and safety of your services”, “details of your audits”, “how you identify, manage and learn from risks”, records, and how the provider will “seek and act upon feedback”.

In practice a working programme has six parts:

1. A written quality assurance policy, naming who audits what, who reviews the results, and who holds overall responsibility.
2. An audit calendar for the year, with each audit’s frequency, owner and the standard it audits against.
3. Audit tools, one per area, that test whether care was right, not only whether it was written down.
4. One action log for every finding from every source: audits, incidents, complaints, safeguarding, feedback, inspections and external visits.
5. Feedback from residents, families, staff and visiting professionals, gathered regularly and acted on.
6. Provider oversight: regular visits by the owner, nominated individual or a quality lead, and a report to whoever holds overall responsibility.

The audit calendar: fixed intervals and the ones you set

A few frequencies are set by law or by the Health and Safety Executive. Most are not, and the provider sets them by risk. Keep the two apart in the calendar, so that nobody mistakes a local choice for a legal requirement or the other way round.

Frequencies that come from outside the home:

• Water safety. HSE’s guidance on legionella in health and social care says providers “must identify ‘sentinel’ outlets (furthest and closest to each tank or cylinder) for monthly checking of the distribution temperatures”, should check hot water cylinder temperatures every month and cold water tank temperatures at least every 6 months, should “flush out infrequently used outlets (including showerheads and taps) at least weekly” and should “clean and de-scale shower heads and hoses at least quarterly”, all within the provider’s risk assessment of its water systems, with “a competent person” checking, inspecting and cleaning the system “in accordance with the risk assessment”.
• Bathing temperatures. HSE’s guidance on scalding and burning says that where vulnerable people are at risk during whole body immersion “water temperatures must not exceed 44°C”, and that outlet temperatures and thermostatic mixing valves (TMVs) need regular checks and maintenance so the controls keep working. Record each check.
• Hoists and slings. Under regulation 9 of the Lifting Operations and Lifting Equipment Regulations 1998, lifting equipment for lifting persons, and lifting accessories, must be thoroughly examined “at least every 6 months”, or in accordance with an examination scheme, and after exceptional circumstances liable to affect safety.
• Fire. Article 9 of the Regulatory Reform (Fire Safety) Order 2005 requires the fire risk assessment to be reviewed “regularly so as to keep it up to date”, and particularly after a significant change; the checks and drills it sets go in the calendar.
• CQC. CQC requests an annual provider information return from adult social care services, and under Regulation 17(3) the provider must send a written report on quality and risk within 28 days of a request.

A suggested pattern for the rest, to adjust by risk and size. These are not legal requirements:

• Monthly: medicines; falls, accidents and incidents with the notifications made; weights, nutrition and hydration; pressure care and skin integrity; infection prevention and control spot checks; complaints, compliments and safeguarding; staffing levels against dependency.
• Quarterly: a sample of care plans and risk assessments tracked against daily notes; mental capacity assessments and DoLS authorisations and their conditions; training, supervision and appraisal against the matrix; a sample of recruitment files; a full infection prevention and control audit; records and data protection.
• Every six months: resident and family meetings or survey; staff survey or listening sessions; a review of the risk register.
• Annually: a full mock inspection against CQC’s five key questions; the statement of purpose; policies due for review; the business continuity plan; the provider’s annual quality report.
• After any trigger: a serious incident, a safeguarding enquiry, a complaint upheld, a poor audit result or a new kind of risk brings the relevant audit forward.

A care home audit checklist, by area

Each audit tool should ask whether care was right, not only whether a form was filled in. The questions below are a starting checklist to build audit tools from, organised by area. For each one, record the gaps identified, raise each gap on the action log, and note anything missed since the last audit:

• Care plans and risk assessments: is the plan current, written with the person, and reviewed after the last fall, admission or change? Do the daily notes show the care in the plan being given? Is there a record of preferences and of any that could not be met?
• Medicines: do MAR charts match stock and prescriptions; are refusals, missed doses and “when required” doses recorded with reasons; are controlled drugs reconciled; are staff who give medicines assessed as competent?
• Falls, accidents and incidents: was each one recorded, reviewed and followed by a care plan change; were incidents that met the threshold notified to CQC without delay; is there a pattern by time, place or person?
• Safeguarding: was each concern referred to the local authority where needed, with the outcome recorded; do staff know the route, including out of hours?
• Nutrition, hydration and skin: are weights recorded and acted on; are food and fluid charts complete where needed; are pressure injuries graded, reported and reviewed?
• Consent, capacity and liberty: are capacity assessments decision-specific; are best-interests decisions recorded; are DoLS applications made and conditions met?
• Infection prevention and control: the infection control audit covers cleanliness, hand hygiene, laundry, sharps and clinical waste, and staff practice observed, not only reported.
• Staffing: rotas against dependency; agency and bank use; training, supervision and appraisal up to date; recruitment files complete before start dates.
• Premises, environment and equipment: hazards found on a walk-round, water temperature logs, legionella controls, hoist and sling examinations, moving and handling equipment and plans, bed rails, call bells, fire doors and the fire risk assessment actions. A failure or malfunction of fire alarms or other safety devices lasting longer than a continuous period of 24 hours, or an interruption to electricity, gas, water or sewerage of the same length, is notifiable to CQC under Regulation 18 of the Care Quality Commission (Registration) Regulations 2009.
• People’s experience: what each resident and family says when asked, how easy it is to raise a concern, complaints and compliments, and what changed as a result.
• Records and data protection: are records accurate, complete and contemporaneous, stored securely and accessible only to those who need them?

Who audits matters as much as the tool: the manager auditing her own home is necessary, but an independent check by someone from outside the home, at least for the higher-risk areas, is what lets the provider trust the results. Sample sizes matter more than the form. Three care plans chosen by the auditor, not the person whose plans they are, tell you more than twenty chosen by the unit lead. And an audit that has scored full marks for a year is more often a weak tool than a perfect service.

The action log and provider oversight

The action log is where quality assurance becomes evidence. Keep one, not one per audit, with a line for every finding from every source and these columns: the date found; the source (audit, incident, complaint, feedback, inspection); the finding; the risk; the action; the owner; the deadline; the evidence that it was done; the date closed and by whom; and whether a re-check showed it worked. CQC’s guidance says providers “must monitor progress against plans to improve the quality and safety of services, and take appropriate action without delay where progress is not achieved as expected”, and an action log with carried-forward items that never close is the most common way to show the opposite.

Provider oversight closes the loop. A monthly governance meeting in the home should review the audit results, the open actions and any trend; the owner, nominated individual or quality lead should visit regularly, talk to people and staff, check a sample of the evidence themselves and write down what they found; and whoever holds overall responsibility should see the audit results and the action log, not a summary. CQC’s governance, management and sustainability quality statement expects that “information is used effectively to monitor and improve the quality of care” and that “data or notifications are consistently submitted to external organisations as required”, and lists “governance, quality assurance and management” among its subtopics.

Once a year, pull it together into a short quality report: what the audits found, what changed, what people said, the trends in falls, pressure injuries, infections and complaints, and the priorities for next year. It is the document a provider reaches for when CQC asks how it assures quality, and the honest version is more convincing than a polished one. The Regulation 17 guide covers what a board or owner should receive and how to show challenge.

The action that was closed in a message

Look at how audit actions are actually closed in most homes. The monthly falls audit finds a broken sensor mat in room 4; the deputy posts in the staff group chat that a new one has been ordered, and the maintenance worker replies with a photo when it is fitted. The owner approves the spend for a replacement hoist by text on a Saturday. The quality lead’s feedback after a provider visit arrives as a voice note to the manager’s personal phone.

Each of those is the evidence the action log needs: what was found, who decided, what was done and when. In the log they become a tick and the word “done”. The messages that would show it sit on personal phones, in apps the provider cannot open, and they leave when the deputy or the quality lead does.

ComplyChat gives those conversations a channel the provider owns. A mobile number verified by SMS is the identity, so an owner, a maintenance contractor or a bank carer without a work account can take part; everyone in it is told it is on the record; and messages are recorded on the server as they are sent. On paid plans the lasting record files into the provider’s own Microsoft 365 once the tenant is connected, under its own retention rules. It is not an audit tool or a quality management system and does not hold the action log; it keeps the conversations in which the actions were agreed and closed.

A question for the next governance or board meeting: of the actions marked closed on our log last quarter, how many were closed on evidence the provider holds?

Questions people ask

What are the 5 CQC standards?

The five are CQC’s key questions, asked of every health and social care service: is it safe, effective, caring, responsive to people’s needs and well-led? Its assessment framework sets quality statements under each, and a care home’s quality assurance programme should test all five; the legal standards themselves are the fundamental standards in Regulations 9 to 20A.

What audits need to be done in a care home?

No regulation lists the audits a care home must run: Regulation 17 requires effective systems to assess, monitor and improve quality and safety, and CQC’s guidance says audits “should be baselined against Regulations 4 to 20A”, so the audit schedule has to cover every fundamental standard. A few checks have fixed intervals set elsewhere, such as HSE’s monthly sentinel outlet temperature checks for legionella and the thorough examination of hoists and slings at least every six months under LOLER, unless an examination scheme sets the interval; the rest, typically medicines, falls and incidents, care plans, infection control, nutrition, safeguarding, staffing and recruitment, premises and people’s experience, are set by the provider according to risk.

What must be reported to CQC?

A care home must report to CQC the events set out in the Care Quality Commission (Registration) Regulations 2009, including the death of a person using the service, injuries of the seriousness Regulation 18 defines, abuse or allegations of abuse, incidents reported to or investigated by the police, a registered person’s absence of 28 days or more, changes to the provider, and revisions to the statement of purpose. Our CQC notifications guide sets out each one, its form and its timescale; a quality assurance programme should check every incident against them.

What would trigger a CQC inspection?

Concerning information can trigger a CQC assessment at any time: CQC says evidence it collects or information it receives “at any time can trigger an assessment”, and other assessments are planned in an order based on risk. A quality assurance programme that finds and fixes problems first is the provider’s best protection against the first kind.

Official guidance and your next step

The primary sources are Regulation 17 and CQC’s guidance on Regulation 17; CQC’s guidance on governance and quality assurance policies and its governance, management and sustainability quality statement; and HSE’s guidance on legionella and scalding in health and social care. Quotations are from those pages as published on 3 October 2026. In March 2026, in its initial response to the Better regulation, better care consultation, CQC said it will replace its quality statements with key lines of enquiry and remove scoring. It is piloting the new approach from June to October 2026, and no date for it to take effect had been published when this guide was written; until then, CQC asks providers to keep using its current guidance. Regulation 17 is unaffected.

This guide is a summary for care homes in England, not legal advice; health and safety duties beyond those named here, such as gas and electrical safety, also belong in the calendar.

Then do one thing: put every audit the home ran last month on one page with its findings and actions, and ask whether the owner or board has seen that page. If they have not, start there.