Sample policy · Reg 17

Action Plan and Improvement Tracking Policy

Statutory anchor: Regulation 17 (good governance), Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (SI 2014/2936). · primary source

Download the PDF

The PDF version of this template is the same content, formatted for adaptation in your document control system. The disclaimer above is repeated on the PDF cover.

Download PDFTalk to a consultant

Verivius pack version v1.1, 2026-07-19

1. What the regulation says

Systems or processes must be established and operated effectively to ensure compliance with the requirements in this Part. (Regulation 17(1))

assess, monitor and improve the quality and safety of the services provided in the carrying on of the regulated activity (including the quality of the experience of service users in receiving those services) (Regulation 17(2)(a))

assess, monitor and mitigate the risks relating to the health, safety and welfare of service users and others who may be at risk which arise from the carrying on of the regulated activity (Regulation 17(2)(b))

maintain securely an accurate, complete and contemporaneous record in respect of each service user, including a record of the care and treatment provided to the service user and of decisions taken in relation to the care and treatment provided. (Regulation 17(2)(c))

The full text of the regulation is at https://www.legislation.gov.uk/uksi/2014/2936/regulation/17. Where this policy and the regulation diverge, the regulation wins.

2. Plain-English summary

You have to run effective systems and processes to comply with everything else in Part 3. The regulation lists six things those systems must enable in particular: quality assessment and improvement, risk management, accurate service-user records, accurate employment and management records, seeking and acting on feedback, and continually evaluating and improving how you process all this. If CQC requests a written report on quality and risk plus your improvement plans, you have 28 days from the day after the request.

3. Purpose

The purpose of this policy is to make sure that improvement actions are recorded, owned, completed, checked and evidenced.

The service recognises that identifying a problem is not enough. A plan is not enough. The provider must be able to show what action was taken, by whom, by when, what evidence proves completion, and whether the action improved safety, quality or experience.

This policy supports Regulation 17 good governance and helps the service demonstrate learning, accountability and continuous improvement.

4. Policy warning

No improvement action should be recorded without an owner, due date and evidence requirement.

An action must not be marked complete unless there is evidence that the required work has been done.

Where the action was intended to reduce risk or improve care, completion alone is not enough. The service must check whether the action worked.

Repeated overdue actions, unowned actions or actions closed without evidence must be treated as governance concerns.

5. Scope

This policy applies to actions arising from:

5.1 Local arrangements before adoption

Before adoption, the provider records:

The provider must test that staff can trace one finding from its source through ownership, evidence, effectiveness review and final closure. Separate spreadsheets or meeting notes must not create competing versions of the action plan.

6. Definitions

An action is a defined task intended to correct, improve, reduce risk or provide assurance.

An owner is the person responsible for completing the action or coordinating completion.

Evidence of completion is the record, document, audit, training log, communication, observation or other proof showing that the action was done.

An effectiveness check is the review that asks whether the completed action had the intended impact.

7. Responsibilities

All staff must complete actions assigned to them within the agreed timescale or escalate early if they cannot.

Managers must assign clear actions, monitor progress, support completion and challenge weak evidence.

The Registered Manager is responsible for maintaining oversight of the action plan, reviewing overdue actions and ensuring that completed actions are checked where required.

The Nominated Individual or provider representative is responsible for reviewing significant, overdue, repeated or high-risk actions at provider level.

8. Operational workflow: from finding to verified improvement

The service follows this sequence for every improvement finding:

  1. Capture the source: record the finding against the incident, complaint, safeguarding concern, audit, risk, inspection feedback or governance decision that created it. Take immediate protective action first where people may be at risk.
  2. Triage: decide the priority, regulatory or contractual deadline, immediate controls and whether the matter also requires a risk-register entry, safeguarding referral or external notification.
  3. Define the action: state the change required, intended outcome and evidence that will demonstrate completion. Split broad findings into separate actions where different owners or deadlines apply.
  4. Assign and agree: name one accountable owner, set a risk-based due date and confirm that the owner has the authority, time and resources to deliver it.
  5. Monitor: record progress, dependencies and barriers at the agreed review interval. Escalate before the due date if completion is at risk rather than waiting for the action to become overdue.
  6. Verify completion: check the referenced evidence against the action requirement. A status update or verbal assurance is not evidence for a high-risk action.
  7. Check effectiveness: after a proportionate interval, use audit, observation, feedback, record review or trend data to decide whether the action achieved the intended outcome.
  8. Close, reopen or replace: record the closure decision and rationale. Reopen the action or create a stronger action if the control was not implemented, the risk did not reduce or the problem recurred.

The detailed controls below apply throughout this workflow.

8.1 Creating an action

Every action must include:

The action must be specific enough that another person could understand what needs to happen without further explanation.

Weak action: "Improve medicines."

Stronger action: "Audit the last 20 MAR charts for missed signatures, record findings, brief staff on errors found, and repeat audit in four weeks."

9. Prioritising actions

Actions must be prioritised according to risk and impact.

High-priority actions include those linked to:

High-priority actions must have shorter timescales and closer monitoring.

10. Due dates

Due dates must be realistic but should reflect the level of risk.

Where action is needed to protect people from immediate harm, the due date must be immediate or within a clearly justified short period.

Where the action depends on external input, the owner must record what has been requested, from whom, and by when.

Due dates must not be extended repeatedly without manager review.

11. Evidence required

The action record must state what evidence will prove completion.

Evidence may include:

A verbal statement that an action was done is not enough for high-risk actions.

12. Monitoring progress

The Registered Manager must review open actions at least monthly, and more often for high-risk actions.

The review must consider:

Progress reviews must be recorded.

13. Escalation of overdue actions

An overdue action must be escalated where:

Escalation may include reassignment, additional support, provider review, formal performance action, risk-register entry or external notification where required.

14. Completing an action

Before an action is marked complete, the manager or action owner must record:

For low-risk administrative actions, manager review may be proportionate. For high-risk actions, the Registered Manager or delegated senior person must review the evidence before closure.

15. Effectiveness checks

An effectiveness check is required where an action was intended to reduce risk, prevent recurrence or improve safety, quality or experience.

The check may include:

The effectiveness check must answer: did the action work?

If the action did not work, the action must be reopened or a new action created.

16. Linking actions to governance

Actions must be linked to their source wherever possible.

Examples:

This allows the service to show a clear evidence trail from issue to action to improvement.

17. Action plan review

The Registered Manager must review the full action plan at least monthly.

The review must identify:

The provider or Nominated Individual must review the action plan at least quarterly.

18. CQC and external action plans

Where actions arise from CQC inspection, local authority review, commissioner feedback, safeguarding enquiry or other external scrutiny, the action plan must be especially clear.

It must show:

The service must not describe an action as complete to an external body unless it has evidence to support that statement.

19. Staff accountability and support

Staff must be supported to complete actions assigned to them.

Where actions are repeatedly missed because of workload, unclear instructions, lack of training or lack of authority, the manager must address the system issue.

Where actions are missed because of refusal, neglect, dishonesty or poor performance, the manager must consider supervision, capability, conduct or disciplinary processes.

20. Records

The service must retain action records securely and in a way that allows them to be produced during inspection, audit or governance review.

Action records must include:

21. Audit

The Registered Manager must audit the action plan at least quarterly.

The audit must check:

Audit findings must be reviewed through the governance process.

22. Related policies in this pack

This policy should be read with:

23. Review

This policy will be reviewed annually, or sooner following a CQC finding, serious incident, safeguarding concern, repeated overdue actions, provider governance concern, or change in legal or regulatory expectations.

24. Sources and further reading

This template is based on CQC's guidance for providers and managers, the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, and other topic-specific legislation and guidance listed below. It is a starting point for adaptation, not a substitute for legal, clinical, HR, safeguarding or specialist professional advice.

25. When to seek further advice

Seek specialist advice where the issue involves serious harm, safeguarding, deprivation of liberty, restraint, children, professional misconduct, controlled drugs, radiation, termination of pregnancy, infection outbreak, water safety, employment dismissal, DBS barring referral, or regulatory enforcement.

26. Document control

Version Date Author Changes
v1 2026-06-10 Verivius (sample) Initial sample template, conformed to the Verivius policy standard.
v1.1 2026-07-19 Verivius (sample) Added local action-register decisions and an end-to-end workflow from finding through evidence, effectiveness review and closure.

This sample policy template was issued by Verivius. It is a template, not a substitute for legal advice or the provider's own policy-development process. Where this template and live law or regulator guidance diverge, the live source wins.

What good looks like here

Written from an ex-CQC inspector's chair, but the point is safe, well-led care your team can stand behind. Each row shows what strong evidence looks like, what thin evidence looks like, and where the expectation comes from.

Every entry on an action register starts life as something that already went wrong or nearly did: a medicines error, a complaint about being left waiting for personal care, an audit that found care plans months out of date. That makes this policy different from the ones written to prevent a first event, because the risk it manages is the second one: the same person, or the next person, harmed by a problem the service had already identified, written down and then closed on a verbal assurance. An action marked complete without evidence is worse than an open action, because it takes the problem out of view while leaving the risk exactly where it was. There is a workforce cost too. Staff who raise a concern and watch it turn into a closed line on a spreadsheet learn that speaking up changes nothing, and they raise the next one more slowly. Asking whether the action worked, not just whether it was done, is what turns a finding into safer care and stops a service rediscovering the same fault every year.

  1. Every action on the register carries a named owner, a due date and a stated evidence requirement, rather than being a list of intentions nobody is accountable for.

    Strong evidence: The 'Creating an action' required fields (source, owner, due date, priority, evidence required, escalation route) in section 8.1, and the section 4 warning that no action is recorded without an owner, due date and evidence requirement.

    Weak evidence: Register rows that read "improve medicines" or "review staffing", with the owner column filled in as "all staff", "the team" or "manager and deputy", due dates left blank or written as "ongoing", and no column at all for what evidence will prove the work was done. Actions lifted straight out of governance minutes as bare bullet points, so nobody can say who is delivering them or what finished looks like.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  2. Actions are closed on evidence that the work was done, not on a status update or a verbal assurance that it was.

    Strong evidence: The completion record (what was done, evidence attached or referenced, whether the intended outcome was achieved) in section 14, the section 11 rule that a verbal statement is not enough for high-risk actions, and workflow step 6 which verifies the referenced evidence against the action requirement (section 8).

    Weak evidence: The status column flipped to "complete" with a note such as "discussed at team meeting", "staff reminded" or "owner confirms done", and nothing attached or referenced that a reader could open. High-risk actions about medicines or staffing closed on the owner's word, with the completion record silent on what was actually done and on the date it was done.

    What the regulator expects to see. Not a law in itself, but CQC judges you against it, so an inspector will look for it and expect a reason where you depart from it.

  3. High-risk actions get an effectiveness check that answers 'did the action work?', so improvement is measured by whether the risk to people actually fell rather than by completion alone.

    Strong evidence: The effectiveness check (repeat audit, observation, incident-trend review, feedback, records review) required where an action was meant to reduce risk or prevent recurrence (section 15), with workflow step 8 reopening or replacing the action if the risk did not reduce or the problem recurred (section 8).

    Weak evidence: Every action shows as closed and none carries a repeat audit, observation or trend review afterwards, so the register can prove the task happened but not that the quality improved or the risk fell. A medicines action closed after a staff briefing with the promised repeat audit never run. The giveaway is the same theme reappearing months later, a fresh action written against it, and no record anywhere asking whether the previous action worked.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  4. A single finding can be traced from its source through ownership, evidence and effectiveness review to closure, so the colleague who picks the work up next opens one record instead of reconciling competing versions held in separate spreadsheets and meeting notes.

    Strong evidence: The single action register and the requirement to link each action back to its incident, complaint, audit, risk or inspection source (sections 5.1 and 16), tested by tracing one finding end to end through the register (section 5.1).

    Weak evidence: Three competing versions of the plan: an inspection action plan in a document, a spreadsheet on the manager's own machine, and further actions living only inside meeting minutes. When someone needs to trace one complaint from the original concern through owner, evidence and effectiveness review to closure, staff start searching their email instead of opening a single record.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  5. Overdue or repeatedly extended actions are escalated and stay visible, not quietly rolled forward while the risk the action was written to reduce is still live.

    Strong evidence: The section 10 rule that due dates are not extended repeatedly without manager review, the escalation triggers for overdue actions (section 13), and the at-least-monthly review of overdue actions and repeated extensions (sections 12 and 17).

    Weak evidence: Due dates quietly rewritten two or three times with no note of who agreed each extension or why, and overdue actions sitting in the register with no escalation entry against them. Monthly review minuted as "action plan discussed" with no count of open, overdue or repeatedly extended actions and no named senior person told about the ones that are stuck.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  6. An action described as complete to the Care Quality Commission or another external body is backed by completion evidence.

    Strong evidence: Section 18's requirement not to describe an action as complete to an external body without evidence to support it, alongside its external action-plan fields (finding, action, person responsible, due date, evidence required, date completed and evidence of completion).

    Weak evidence: An action plan sent back to the Care Quality Commission, a commissioner or a safeguarding team with "completed" in the final column and the evidence column empty. Elsewhere, evidence described only as "training delivered" or "policy updated", with no attendance record, version, date or competency check behind it that the provider could produce if the claim were tested.

    What the regulator expects to see. Not a law in itself, but CQC judges you against it, so an inspector will look for it and expect a reason where you depart from it.

Related

Last verified 20 July 2026

Spotted something to improve?

These are sample templates, not the last word. If you would change a wording, or want to help us confirm a detail, tell us and we will look at it.

Related Verivius content

Want help adapting this to your service?

A Verivius consultant can read your adapted policy against the live regulation and your service shape. The work fits inside a Mock Inspection engagement or a shorter consulting brief. A 20-minute conversation is the fastest way to find out whether the fit is right.

Get started free

Free to start, no card. A 14-day trial when you subscribe.

Last reviewed 19 July 2026