Most providers searching for a CQC governance document template are asking a fair question: what does CQC expect us to have written down, and what does it need to say? The honest answer is that a template is a useful start and a poor finish. CQC does not stop at the document. It follows whether the governance the document describes is actually happening, and whether the records can show it.
Download the CQC governance document template
Start with the Good governance policy template. It gives an independent provider a downloadable framework for accountability, risk, audit, feedback, records, meetings and improvement. Adapt the named roles, review cycle, escalation routes and records to match the service you actually run. For the wider set, the free CQC policy and template library has an adaptable template for each core topic, every one paired with an audit checklist.
Then test the working trail, not only the wording. The risk management and risk register checklist checks whether risks are owned, reviewed and acted on. The record keeping and confidentiality checklist checks whether care, decisions and management records are accurate, current, secure and retrievable. Together, the policy and checklists give you the written framework and the questions a CQC inspector is likely to follow.
That distinction is the whole game. A provider can hold a tidy governance policy and still be rated inadequate for governance, because the policy describes a system that does not run. Another provider can have plainer paperwork and evidence strong governance, because the records show the system working week after week. The document is the map. CQC follows the road.
A practical governance evidence set for an independent provider
For a CQC-regulated independent provider, the useful starting set is usually a governance policy or framework, a current risk register, an audit and monitoring schedule, an improvement action log, governance meeting records, record-keeping standards, and the operational registers that feed governance: incidents, complaints, safeguarding, training, supervision, medicines and notifications. That is not a magic list. It is the practical evidence set that lets a registered manager show how quality, safety, risk and improvement are reviewed.
The important point is that each governance document has to do a job. A governance policy explains the system. A risk register shows known risks and controls. Audits show what has been checked. Action logs show what changed. Meeting records show who made decisions. Operational registers show the raw signals that governance is responding to.
If you are starting from blank paper, begin with the good governance policy template, then test the live evidence against the risk management and risk register checklist and the record keeping and confidentiality checklist. The template gives the structure. The checklists ask whether the structure is actually running.
What Regulation 17 actually asks for
Governance sits under Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, good governance. Regulation 17 asks whether the provider operates systems and processes that do three things: assess, monitor and improve the quality and safety of the service; assess, monitor and mitigate risks to people; and maintain an accurate, complete and contemporaneous record for each person, alongside records of the provider's own management.
Read that carefully and you see why a single template cannot satisfy it. Regulation 17 is about systems that run and records that accumulate. It is satisfied by what the provider does repeatedly, not by what it wrote down once.
How the governance documents work together
There is no single inspection document list that fits every CQC provider. Registration requirements vary by service, and CQC may require particular supporting documents. The core set below is sector-neutral, but the emphasis shifts with the service: the governance trail a CQC-registered aesthetic clinic keeps, for instance, leans on patient selection, consent and complication records. At inspection, the important test is whether the provider can show a connected picture. In a single-site service that usually means a handful of living records:
- A governance framework that explains who is accountable for quality and safety, what gets reviewed, how often, and where decisions are recorded. This is the spine the rest hangs from.
- A risk register that is current, owned and reviewed, not a document that was written at registration and never reopened.
- An audit or monitoring schedule with the results, so quality is checked on a cycle rather than only when something goes wrong.
- An improvement or action log that shows what was found, who owns the fix, and whether it was closed.
- Records of governance meetings, however small the service, showing what was discussed, decided and followed up.
- The operational records that feed all of this: incidents, complaints, safeguarding concerns, the training matrix and the policy set.
Each of these can start from a template. None of them is finished until it carries dated, owned, real entries.
How to adapt a governance document template
A useful governance document should describe your service, not an imaginary larger organisation. Before approving the template, replace generic wording with five local decisions:
- name the person accountable for each governance area and who covers their absence
- state which risks, audits, incidents, complaints, staffing signals and feedback reach the governance meeting
- set a review cadence the service can keep, with a clear route for urgent matters between meetings
- define where decisions and actions are recorded, who owns them and how overdue work is escalated
- record how the provider checks that an action worked before it is closed
This is where many downloaded documents lose value. The words look complete, but nobody can say which meeting receives an overdue audit, who updates the risk after an incident or where the completed action is evidenced. If the route is unclear to staff, it will also be unclear when CQC samples the record.
Why the template alone fails an inspection
The common pattern a CQC inspector sees is a service with good documents and a thin trail. The risk register exists but has not changed in a year. The audit schedule lists audits that were never run. The meeting template has no minutes behind it. The action log records issues opened but never closed.
None of that is dishonest. It is what happens when governance is treated as a folder to assemble rather than a habit to keep. The template gave the provider a false sense of completion. The inspection asks the next question the template cannot answer: did the system actually work, and can you show me?
What a CQC inspector follows from the document
A CQC inspector will usually test the document by selecting a live issue and following it. A complaint may lead to a risk, an audit, a meeting decision and an improvement action. A vehicle defect may lead to an incident review, a fleet check and a change to the maintenance schedule. A missed training renewal may lead to a deployment restriction, supervision and a wider training-matrix review.
The records should agree on what happened, who decided, what changed and whether the action was effective. A policy that promises monthly review while the meeting records show a six-month gap weakens the whole trail. A plainer policy backed by current records is more credible because it describes the system the provider can actually demonstrate. The Regulation 17 good governance explainer sets out the statutory test behind that inspection method.
How to turn a document into evidence
The services that evidence governance well share a simple discipline. Every governance record is dated, has a named owner, has a review point, and links to the thing it is about. A risk links to the action that addresses it. An audit links to the improvement it triggered. A complaint links to the change it produced. The provider is not assembling a story at the end of the quarter. The story is already written by the ordinary records, in order, with names and dates.
That is also the difference between a template and a system. A template is a blank shape. A system is the shape kept full, on a cycle, by the people doing the work. CQC can tell the difference in minutes, because the second one answers follow-up questions and the first one stops at the cover page.
So start with the template if it helps. Then do the harder and more valuable thing: keep it alive, connect it, and let the record speak before you have to.
Governance is not a folder. It is whether risks, audits, incidents, complaints, safeguarding, training and improvement actions are talking to each other week by week. Verivius holds them in one trail so that picture stays current. Providers tend to notice the operational benefit first: patterns surface earlier, and fewer things fall into the gap between two people who each assumed the other had it. The inspection conversation gets easier as a consequence, not as the aim.
If you are deciding whether software could help with that working record, the software buyer checklist covers the buying questions. This article answers a different question: what governance documents and live records a provider needs to put in place and keep current.
Related guidance
- Regulation explainer: Regulation 17 good governance
- Sample policy: Good governance policy template
- Checklist: Risk management and risk register checklist
- Checklist: Record keeping and confidentiality checklist
- Article: Governance, leadership and culture in good care
- Article: Governance economics across locations
- Tool: Risk register
- Tool: Clinical audit
- Tool: Improvement action plans