Safeguarding concern form

What a safeguarding concern form is, and the two kinds

The phrase covers two documents that are often confused. The first is the organisation's own record of concern: the form a member of staff or volunteer completes and passes to the designated safeguarding lead whenever they are worried about a child or an adult. Every organisation that works with children or adults at risk should have one. The second is the adult safeguarding concern form that a local authority publishes, usually as an online form, for anyone to tell the council that an adult may be experiencing abuse or neglect. Many councils have one version for professionals and another for the public. The equivalent for a child is a referral to children's social care, often through a multi-agency safeguarding hub, which our guide to MASH referrals covers.

The duty behind the first is in statutory guidance. Keeping children safe in education 2026 (KCSIE 2026), which schools and colleges must follow, says: "All concerns, discussions and decisions made, and the reasons for those decisions, should be recorded in writing" (paragraph 74). Working Together to Safeguard Children 2026 asks every voluntary, faith-based and private organisation working with children to have safeguarding policies and "systems ... in place to ensure compliance". For adults, the Care and support statutory guidance says that "whenever a complaint or allegation of abuse is made, all agencies should keep clear and accurate records" (paragraph 14.180).

The duty behind the second is section 42 of the Care Act 2014. It applies where a local authority "has reasonable cause to suspect" that an adult in its area "has needs for care and support", "is experiencing, or is at risk of, abuse or neglect" and, as a result of those needs, "is unable to protect himself or herself". The council must then make "whatever enquiries it thinks necessary" to decide what action should be taken. The concern form is how the council gets to reasonable cause to suspect; it is not the enquiry itself, and the person raising it does not have to be sure the three conditions are met.

When a form should be completed

The threshold for writing a concern down is deliberately low. It is not "I think this child is being abused"; it is "I noticed something, and it worried me". The Care and support statutory guidance describes how concerns arise: "The adult may say or do things that hint that all is not well. It may come in the form of a complaint, a call for a police response, an expression of concern, or come to light during a needs assessment. Regardless of how the safeguarding concern is identified, everyone should understand what to do, and where to go locally to get help and advice" (paragraph 14.37). KCSIE says that "if in doubt about recording requirements, staff should discuss with the designated safeguarding lead (or a deputy)" (paragraph 75).

In practice a form should be completed whenever someone:

• hears a disclosure, from the child or adult themselves or from someone else about them;
• sees an injury, a mark or a change in behaviour, appearance or mood that has no clear explanation;
• notices a pattern: repeated absence, missed visits, money going missing, a new "friend" who is always present;
• is told something by a parent, carer, neighbour or colleague that raises a worry;
• sees something online or in a message that suggests harm or exploitation;
• has a concern about the behaviour of a colleague or volunteer towards a child or adult, which goes to the person the policy names for allegations, and may be a low-level concern rather than an allegation.

One form per concern, not one per person. A single worrying observation may mean nothing; the same observation recorded on five forms by three people over two months is exactly the pattern the designated lead needs to see, and the reason the first form matters even when it seems trivial. Where the worry is about an adult who works with children, the low-level concerns guide sets out how that record differs.

What a good concern form contains

KCSIE asks that records include "a clear and comprehensive summary of the concern", "details of how the concern was followed up and resolved" and "a note of any action taken, decisions reached and the outcome". The NSPCC's records retention and storage guidelines (updated September 2026) give the fuller list most organisations build their form from, and recommend "a standard electronic form for recording concerns" so that "all the necessary information is collected consistently". Putting the two together with what council adult forms ask, a good form has these parts:

1. About the person: name, date of birth or age, address, and for a child the parents or carers and any siblings; for an adult, any care and support needs, health conditions or disabilities, communication needs, and who else is involved in their care.
2. What happened: what was seen, heard or said, in the person's own words where they spoke, with any injury described by size, colour and position (a body map helps).
3. When and where: the date and time of the incident or disclosure, and separately the date and time it was reported.
4. Who: everyone involved, including the person alleged to have caused harm if known, and any witnesses.
5. The person's views: for an adult, whether they know the concern is being raised, what they want to happen and whether they agree to it being shared; for a child, what they said about it.
6. Safety now: whether the person is safe at this moment, whether anyone else may be at risk, and what has been done since to keep them safe.
7. Action and decision: who the form was passed to and when, any referral made (to children's social care, the council's adult safeguarding team, the police, the LADO), the reference number given, and if no referral was made, the reasons why.
8. The author: name, role, signature, and the date and time the form was completed.

The item most often left blank is the reason for a decision not to refer. The NSPCC list includes "the reasons why the organisation decided not to refer those concerns to a statutory agency (if relevant)", and KCSIE's first sentence on record keeping asks for "the reasons for those decisions". A decision not to refer can be right; a decision with no recorded reason cannot later be shown to have been right.

The council's adult form asks many of the same questions, and council online forms typically make several of them mandatory: whether the adult knows the concern is being raised, whether they are safe now, what the impact has been on them, whether there were witnesses, and what has been done since. Filling in your own record first makes the council's form a matter of copying, and gives you a copy of what you sent.

Most councils publish the adult form on their website, in the adult social care pages, with a phone number for the adult social care team and an out-of-hours number beside it. Some accept a downloadable template by secure email instead. Before you press the button to submit an online form, save or print a copy, because many do not send one back, and note the date, time and any reference the council gives you. If the adult is in immediate danger, call 999 first; the form is not an emergency route.

Writing it so that it holds up

A concern form may be read by the designated lead that afternoon, a social worker the next day, a police officer next month, and a court or an inquiry years later. The rules for writing it are consistent across the guidance:

• Facts first, opinion labelled. KCSIE 2026 says safeguarding records "should be clear, factual, and distinguish between observed concerns, professional opinion, and historic information". The NSPCC puts it the same way: "Make sure the report is as factual as possible and avoid opinions. Any interpretation or inference drawn from what was observed, said or alleged should be clearly reported as such."
• Their words, not yours. On a disclosure of sexual violence or harassment, KCSIE says staff should "record only what the child says, without interpretation or personal opinion". The same discipline suits every disclosure. "He hit me with the belt" is evidence; "child disclosed physical abuse" is a conclusion.
• Listen first, write straight after. KCSIE suggests that "ideally, staff should wait until the end of the conversation to write a detailed summary, allowing the staff member to give the child their full attention", and that "it is essential a written record is made". Keep any notes made at the time; do not rewrite them neatly and throw the originals away.
• Do not investigate. Ask open questions only, do not ask the person to repeat it for someone else, and do not approach the person alleged to have caused harm. The form records what was said; working out what happened is for the statutory agencies.
• Do not promise secrecy. KCSIE says staff "should never promise confidentiality when receiving a report". Tell the person what you will do with what they have told you.
• Sign, date and time it. A late entry says it is a late entry and why. A correction is crossed through once, not erased.

After the form: where it goes and who may see it

The form goes to the designated safeguarding lead, or the person the policy names, the same day. If a child or adult is in immediate danger, the police and emergency services come first and the form afterwards. The lead decides whether to refer and records the decision; KCSIE expects concerns and referrals to be kept "in a separate child protection file for each child", and for adults the Care and support guidance expects each agency to incorporate "all relevant records into a file to record all action taken". Over time the forms become the source for a safeguarding chronology, which is why a date, a time and a name on every form matters so much.

Sharing the form, or what is in it, is governed by data protection law but not blocked by it. For adults, the Care and support guidance says practitioners "should wherever practicable seek the consent of the adult before taking action", but that "whether or not the adult has capacity to give consent, action may need to be taken if others are or will be put at risk if nothing is done or where it is in the public interest to take action because a criminal offence has occurred" (paragraph 14.95). For children, consent is not normally the lawful basis for sharing to safeguard a child. Paragraph 18 of Schedule 1 to the Data Protection Act 2018 allows safeguarding processing without consent where it cannot be given, cannot reasonably be obtained or would prejudice the protection. The Data (Use and Access) Act 2025 has amended UK GDPR and the 2018 Act, with all its data protection changes now in force while the ICO reviews some of its guidance, so check the date on any ICO page you rely on, and record what was shared, with whom and why.

Registered care providers have a separate duty to notify the Care Quality Commission of abuse or allegations of abuse, which a council safeguarding concern does not discharge; see our guide to CQC notifications. Forms are stored securely, with access limited to those who need it, and kept for the period your retention schedule sets: for schools, the child protection file is normally kept until the child is 25.

The concern that never reaches the form

The form has a field for the date and time a concern was first raised, and in most organisations the honest answer is not on the form at all. A care worker messages her supervisor from the car after a visit: "Mrs B said something about her son and her bank card, can we talk?" The supervisor replies with a thumbs-up and a call is arranged for the morning. A teaching assistant posts in the staff group chat that a pupil flinched when she touched his arm. A volunteer texts the charity's safeguarding lead a photograph of a message a young person sent her. The form, when it is written the next day, says "reported to manager", and the words the person first used, the time and the reply are on two personal phones.

Those messages are part of the record the guidance describes. They are the first account, closest to the event, and they show when the organisation first knew. The NSPCC's guidelines say that staff and volunteers "should never use their own devices to make and store records unless there is a clear reason established by the organisation", yet in almost every organisation that is where the first record is made, because a phone is what a care worker in a car or a volunteer at home has in their hand. When a social worker, a police officer or an inquiry asks what was said and when, an organisation cannot produce messages held in an app it does not run, on phones it does not own, from people who may have left.

The answer is not a longer form. It is to decide where the first message goes. ComplyChat gives an organisation channels it controls, in which everyone added is told the channel is on the record and can object or leave, and in which staff and volunteers without a work account join with a mobile number verified by SMS. Messages are recorded on the server as they are sent. On paid plans, once the organisation's Microsoft 365 tenant is connected, the lasting record files into that tenant under its own retention rules, so the first message can be found and attached to the form. ComplyChat is not a safeguarding case management system and does not replace the concern form or the referral; a message is not a referral, and an urgent concern still needs a phone call.

A question for the next leadership or trustees' meeting: for the last five concern forms, where was each concern first raised, and could the organisation produce that first message today?

Official guidance and your next step

The primary sources are Keeping children safe in education 2026 (paragraphs 74 and 75, Part five and Annex B), Working Together to Safeguard Children 2026, the Care and support statutory guidance (chapter 14, especially paragraphs 14.37, 14.95 and 14.180 to 14.182), section 42 of the Care Act 2014, and the NSPCC's records retention and storage guidelines. Your local safeguarding children partnership and safeguarding adults board publish the local referral routes and, usually, the council's concern form. Quotations are from those documents as read in September 2026.

This guide is a practical summary for England, not legal advice, and not a substitute for your own safeguarding policy or your designated lead's judgement on an individual concern.

Then do one thing: take your organisation's concern form and check it against the eight parts above. The two most often missing are the person's own views and the reason for a decision not to refer.