1. What the regulation says
Systems or processes must be established and operated effectively to ensure compliance with the requirements in this Part. (Regulation 17(1))
assess, monitor and improve the quality and safety of the services provided in the carrying on of the regulated activity (including the quality of the experience of service users in receiving those services) (Regulation 17(2)(a))
assess, monitor and mitigate the risks relating to the health, safety and welfare of service users and others who may be at risk which arise from the carrying on of the regulated activity (Regulation 17(2)(b))
maintain securely an accurate, complete and contemporaneous record in respect of each service user, including a record of the care and treatment provided to the service user and of decisions taken in relation to the care and treatment provided. (Regulation 17(2)(c))
The full text of the regulation is at https://www.legislation.gov.uk/uksi/2014/2936/regulation/17. Where this policy and the regulation diverge, the regulation wins.
2. Plain-English summary
You have to run effective systems and processes to comply with everything else in Part 3. The regulation lists six things those systems must enable in particular: quality assessment and improvement, risk management, accurate service-user records, accurate employment and management records, seeking and acting on feedback, and continually evaluating and improving how you process all this. If CQC requests a written report on quality and risk plus your improvement plans, you have 28 days from the day after the request.
3. Purpose
The purpose of this policy is to make sure that improvement actions are recorded, owned, completed, checked and evidenced.
The service recognises that identifying a problem is not enough. A plan is not enough. The provider must be able to show what action was taken, by whom, by when, what evidence proves completion, and whether the action improved safety, quality or experience.
This policy supports Regulation 17 good governance and helps the service demonstrate learning, accountability and continuous improvement.
4. Policy warning
No improvement action should be recorded without an owner, due date and evidence requirement.
An action must not be marked complete unless there is evidence that the required work has been done.
Where the action was intended to reduce risk or improve care, completion alone is not enough. The service must check whether the action worked.
Repeated overdue actions, unowned actions or actions closed without evidence must be treated as governance concerns.
5. Scope
This policy applies to actions arising from:
- incidents
- near misses
- complaints
- safeguarding concerns
- duty of candour reviews
- audits
- risk assessments
- risk register reviews
- staff supervision
- training gaps
- service-user feedback
- family or advocate feedback
- CQC inspection findings
- commissioner or local authority feedback
- professional advice
- governance meetings
- business continuity events
- policy reviews
6. Definitions
An action is a defined task intended to correct, improve, reduce risk or provide assurance.
An owner is the person responsible for completing the action or coordinating completion.
Evidence of completion is the record, document, audit, training log, communication, observation or other proof showing that the action was done.
An effectiveness check is the review that asks whether the completed action had the intended impact.
7. Responsibilities
All staff must complete actions assigned to them within the agreed timescale or escalate early if they cannot.
Managers must assign clear actions, monitor progress, support completion and challenge weak evidence.
The Registered Manager is responsible for maintaining oversight of the action plan, reviewing overdue actions and ensuring that completed actions are checked where required.
The Nominated Individual or provider representative is responsible for reviewing significant, overdue, repeated or high-risk actions at provider level.
8. Creating an action
Every action must include:
- source of the action
- date created
- action title
- clear description
- intended outcome
- owner
- due date
- priority
- linked risk or issue where relevant
- evidence required
- review date where required
- escalation route if overdue
The action must be specific enough that another person could understand what needs to happen without further explanation.
Weak action: "Improve medicines."
Stronger action: "Audit the last 20 MAR charts for missed signatures, record findings, brief staff on errors found, and repeat audit in four weeks."
9. Prioritising actions
Actions must be prioritised according to risk and impact.
High-priority actions include those linked to:
- immediate safety risk
- safeguarding
- serious incident
- duty of candour
- medicine safety
- repeated complaint theme
- CQC breach or warning notice
- regulatory notification
- staffing risk
- infection control risk
- serious record-keeping failure
High-priority actions must have shorter timescales and closer monitoring.
10. Due dates
Due dates must be realistic but should reflect the level of risk.
Where action is needed to protect people from immediate harm, the due date must be immediate or within a clearly justified short period.
Where the action depends on external input, the owner must record what has been requested, from whom, and by when.
Due dates must not be extended repeatedly without manager review.
11. Evidence required
The action record must state what evidence will prove completion.
Evidence may include:
- updated care plan
- completed risk assessment
- audit report
- training attendance record
- competency assessment
- supervision record
- repaired equipment record
- contractor report
- team briefing record
- meeting minutes
- revised policy
- completed referral
- CQC notification record
- family or advocate communication record
- repeat audit or observation
A verbal statement that an action was done is not enough for high-risk actions.
12. Monitoring progress
The Registered Manager must review open actions at least monthly, and more often for high-risk actions.
The review must consider:
- actions due soon
- overdue actions
- actions without evidence
- actions linked to high risks
- actions with repeated extensions
- actions blocked by another person or organisation
- actions that may need escalation
- actions that require effectiveness checks
Progress reviews must be recorded.
13. Escalation of overdue actions
An overdue action must be escalated where:
- it is high priority
- it is linked to safeguarding, serious incident, medicine safety, staffing or infection control
- it has passed its due date without clear reason
- it has been extended more than once
- the owner cannot complete it
- delay increases risk to people using the service
- the action was required by CQC, commissioner, safeguarding, professional advice or provider governance
Escalation may include reassignment, additional support, provider review, formal performance action, risk-register entry or external notification where required.
14. Completing an action
Before an action is marked complete, the manager or action owner must record:
- what was done
- date completed
- evidence attached or referenced
- whether the intended outcome was achieved
- whether further action is required
- whether an effectiveness check is needed
For low-risk administrative actions, manager review may be proportionate. For high-risk actions, the Registered Manager or delegated senior person must review the evidence before closure.
15. Effectiveness checks
An effectiveness check is required where an action was intended to reduce risk, prevent recurrence or improve safety, quality or experience.
The check may include:
- repeat audit
- observation of practice
- review of incident trend
- feedback from people using the service
- staff competency check
- supervision discussion
- review of records
- spot check
- governance meeting review
The effectiveness check must answer: did the action work?
If the action did not work, the action must be reopened or a new action created.
16. Linking actions to governance
Actions must be linked to their source wherever possible.
Examples:
- incident action linked to the incident record
- complaint action linked to the complaint record
- safeguarding action linked to the safeguarding record
- audit action linked to the audit report
- risk action linked to the risk register
- CQC action linked to the inspection finding
- training action linked to staff records
This allows the service to show a clear evidence trail from issue to action to improvement.
17. Action plan review
The Registered Manager must review the full action plan at least monthly.
The review must identify:
- number of open actions
- number of overdue actions
- high-risk actions
- repeated themes
- actions waiting for external input
- actions without evidence
- completed actions awaiting effectiveness check
- actions that should be escalated to the provider or risk register
The provider or Nominated Individual must review the action plan at least quarterly.
18. CQC and external action plans
Where actions arise from CQC inspection, local authority review, commissioner feedback, safeguarding enquiry or other external scrutiny, the action plan must be especially clear.
It must show:
- the external finding or concern
- the action required
- the person responsible
- due date
- evidence required
- date completed
- evidence of completion
- whether the improvement has been checked
- any communication back to the external body where required
The service must not describe an action as complete to an external body unless it has evidence to support that statement.
19. Staff accountability and support
Staff must be supported to complete actions assigned to them.
Where actions are repeatedly missed because of workload, unclear instructions, lack of training or lack of authority, the manager must address the system issue.
Where actions are missed because of refusal, neglect, dishonesty or poor performance, the manager must consider supervision, capability, conduct or disciplinary processes.
20. Records
The service must retain action records securely and in a way that allows them to be produced during inspection, audit or governance review.
Action records must include:
- original issue
- action details
- owner
- due date
- progress updates
- evidence
- completion decision
- effectiveness check
- escalation record where relevant
21. Audit
The Registered Manager must audit the action plan at least quarterly.
The audit must check:
- whether actions are clear
- whether owners and due dates are present
- whether evidence is attached
- whether overdue actions were escalated
- whether high-risk actions were completed promptly
- whether effectiveness checks were completed
- whether repeated themes were added to the risk register
- whether completed actions actually changed practice
Audit findings must be reviewed through the governance process.
22. Related policies in this pack
This policy should be read with:
- Incident Reporting, Investigation and Learning Policy
- Risk Management and Risk Register Policy
- Good Governance Policy
- Clinical Audit and Quality Assurance Policy
- Complaints Policy
- Safeguarding Policy
- Duty of Candour Policy
- Staffing Policy
- Training and Competency Policy
- CQC Statutory Notifications Policy
23. Review
This policy will be reviewed annually, or sooner following a CQC finding, serious incident, safeguarding concern, repeated overdue actions, provider governance concern, or change in legal or regulatory expectations.
24. Sources and further reading
This template is based on CQC's guidance for providers and managers, the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, and other topic-specific legislation and guidance listed below. It is a starting point for adaptation, not a substitute for legal, clinical, HR, safeguarding or specialist professional advice.
- CQC Regulation 17: Good governance
- CQC inspection and enforcement correspondence
- Commissioner action plans
- Audit and incident findings
- CQC assessment framework and sector-specific guidance, as updated by CQC from time to time
- Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (https://www.legislation.gov.uk/uksi/2014/2936/regulation/17)
25. When to seek further advice
Seek specialist advice where the issue involves serious harm, safeguarding, deprivation of liberty, restraint, children, professional misconduct, controlled drugs, radiation, termination of pregnancy, infection outbreak, water safety, employment dismissal, DBS barring referral, or regulatory enforcement.
26. Document control
| Version | Date | Author | Changes |
|---|---|---|---|
| v1 | 2026-06-10 | Verivius (sample) | Initial sample template, conformed to the Verivius policy standard. |
This sample policy template was issued by Verivius. It is a template, not a substitute for legal advice or the tenant's own policy-development process. Where this template and live law or regulator guidance diverge, the live source wins.