Sample policy · Reg 20

Duty of candour policy template

Statutory anchor: Regulation 20 (duty of candour), Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (SI 2014/2936). This policy also engages Regulation 12 (safe care and treatment) and Regulation 17 (good governance), and sits alongside Regulation 16 of the Care Quality Commission (Registration) Regulations 2009 (notification of death) and the other statutory notifications. · primary source

Download the PDF

The PDF version of this template is the same content, formatted for adaptation in your document control system. The disclaimer above is repeated on the PDF cover.

Download PDFTalk to a consultant

Verivius pack version v1, 2026-06-10

1. What the regulation says

As soon as reasonably practicable after becoming aware that a notifiable safety incident has occurred a registered person must notify the relevant person...

The notification... must include an apology.

The notification given under paragraph (2)(a) must be followed by a written notification given or sent to the relevant person...

harm that requires a moderate increase in treatment, and significant, but not permanent, harm.

a permanent lessening of bodily, sensory, motor, physiologic or intellectual functions, including removal of the wrong limb or organ or brain damage, that is related directly to the incident and not related to the natural course of the service user's illness or underlying condition.

an expression of sorrow or regret in respect of a notifiable safety incident.

The full text of the regulation is at https://www.legislation.gov.uk/uksi/2014/2936/regulation/20. Where this policy and the regulation diverge, the regulation wins.

A notifiable safety incident is a specific legal term, and the threshold that triggers the duty differs by provider type. Regulation 20 sets one definition for health service bodies and a separate definition for other registered persons. The service must apply the correct Regulation 20 definition for its own provider type, and must not assume that the wording used by another type of provider applies to it.

2. Plain-English summary

When something goes wrong that meets the Regulation 20 notifiable safety incident threshold for your provider type, you must tell the relevant person (the patient, or the person acting on their behalf) in person as soon as reasonably practicable, give a truthful account, offer support, apologise, and follow up in writing. The threshold itself differs by provider type: Regulation 20 sets one notifiable safety incident definition for health service bodies and a separate definition for all other registered providers, so the service must apply the correct definition for its own type rather than assume another provider type's wording applies. The regulation does not set a number-of-days deadline for the written stage; any specific deadline you see in Verivius is an operational default, not a legal duty.

Regulation 20 is the duty to the patient. It sits alongside the duty to notify the regulator under the Care Quality Commission (Registration) Regulations 2009 (for example, notification of death under Regulation 16), but it is a separate obligation. Honouring one does not satisfy the other.

3. Scope

This policy applies to all clinical and care staff at , every regulated activity the provider is registered for, every service-user pathway, and every incident that meets the Regulation 20 notifiable safety incident threshold for the service's provider type. It applies regardless of whether the incident was preventable; the regulation is triggered by the harm threshold, not by blame.

(Tenant updates the angle-bracket placeholder.)

4. Roles and responsibilities

(Tenant updates the named role-holders.)

5. Procedure

The duty-of-candour procedure operationalises Regulation 20 across the lifecycle from harm identification to written-notification closure. It runs as a sub-lifecycle inside the source incident record in Verivius.

  1. Harm assessment at incident logging. Every incident's initial harm assessment is reviewed against the Regulation 20 threshold for the service's provider type. The harm categories and threshold must be checked against the current Regulation 20 wording before opening or declining the duty-of-candour lifecycle. The triage decision is recorded on the incident.
  2. Open the duty-of-candour panel. Where the threshold is met, the candour panel opens on the source incident. The deadline clock starts ("as soon as reasonably practicable" in the regulation; the tenant SLA layer sets the operational target).
  3. Identify the relevant person. The patient is the default. Where the patient cannot consent or is bereaved, the relevant person is identified per Regulation 20(6): a person lawfully acting on the patient's behalf, the bereaved family per the priority list.
  4. Verbal notification. A face-to-face conversation (where reasonably practicable) or a phone call (where face-to-face is not). The conversation captures: an accurate factual account of what happened so far as known at the time, what further enquiries the provider considers appropriate, the apology, the offer of support. The conversation is recorded on the candour panel with date, time, attendees, location, summary of what was said. The apology is not "we are sorry that you feel"; it is "we are sorry that this happened".
  5. Written follow-up. A written notification follows the verbal as soon as reasonably practicable. The written must contain the matters discussed verbally, the results of further enquiries (or a statement that they are ongoing), an apology, the steps the provider is taking. The letter is drafted, reviewed (typically by the Registered Manager), sent through a channel the recipient has agreed (post, email, in-person hand-over).
  6. Record evidence of sending. The written notification is attached to the candour record (an email confirmation, a printed-letter scan with date stamp, a hand-over signature). The send timestamp and the sending user are captured.
  7. Track outcomes. Where the relevant person responds, the response is recorded against the candour record. Where further enquiries produce new information after the initial written, a supplementary written notification is sent.
  8. Closure. The candour record closes when the duty has been honoured end-to-end (verbal done; written sent; any outcome captured). The closure paragraph names what was done and the closing user.
  9. Cross-link to the statutory notification. Many Regulation 20 incidents also meet a statutory-notification trigger under the Care Quality Commission (Registration) Regulations 2009 (for example, notification of death under Regulation 16). The two records are linked but run their own lifecycles. The Registration Regulations notification does not satisfy Regulation 20 and vice versa.
  10. Pattern review. The aggregate candour pattern (count, harm-distribution, time-from-incident-to-verbal, written-letter quality) is reviewed at the monthly governance meeting.

6. Training requirement

Training records are held in the tenant's training matrix register.

7. Audit

Compliance with this policy is monitored by the Registered Manager:

Audit findings recorded in the tenant's audit register; actions logged in the improvement-actions register.

8. Record-keeping

Duty-of-candour records (sub-lifecycle inside the source incident) are held for a minimum of 8 years from the date of the last entry, aligned to the NHS Code of Practice on Records Management and the related clinical record. Written-notification copies and any reply correspondence are attached to the candour record and travel with it.

Verivius preserves the per-record audit trail indefinitely while the workspace is active.

9. Related policies in this pack

10. Sources and further reading

This template is based on CQC's guidance for providers and managers, the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, and other topic-specific legislation and guidance listed below. It is a starting point for adaptation, not a substitute for legal, clinical, HR, safeguarding or specialist professional advice.

11. When to seek further advice

Seek specialist advice where the issue involves serious harm, safeguarding, deprivation of liberty, restraint, children, professional misconduct, controlled drugs, radiation, termination of pregnancy, infection outbreak, water safety, employment dismissal, DBS barring referral, or regulatory enforcement.

12. Document control

Version Date Author Changes
v1 2026-05-19 Verivius (sample) Initial sample template.
v1.1 2026-06-01 Verivius (sample) Filled out Sections 3 to 8 with concrete content. Section 4 names the typical role allocation (Registered Manager sign-off, Clinical Lead in-the-room responsibility, Designated Candour Drafter). Section 5 expanded to a 10-step lifecycle (harm assessment, panel open, identify relevant person, verbal notification, written follow-up, evidence of sending, outcome tracking, closure, statutory-notification cross-link, pattern review) tied to the platform's candour sub-lifecycle on incidents. Section 6 names the training tiers (awareness for all clinical staff, delivery training for the Manager + Clinical Lead + Drafter, apology-language training). Section 7 names the per-incident sign-off audit and the quarterly candour-record review. Section 8 references the NHS Code of Practice.
v1 (2026-06-10) 2026-06-10 Verivius (sample) Re-conformed to the current Verivius policy standard, preserving the original content. Restored the original verbatim Regulation 20 quotes in Section 1 exactly as first issued; added the provider-type clarification that the notifiable safety incident threshold differs by provider type and the service must apply the correct Regulation 20 definition for its own type; corrected the Section 2 summary so it applies the provider-type threshold consistently rather than stating "moderate harm or worse" as a universal trigger; added the header policy owner / applies-to line, the Sources and further reading section, and the When to seek further advice block.

This sample policy template was issued by Verivius. It is a template, not a substitute for legal advice or the tenant's own policy-development process. Where this template and live law or regulator guidance diverge, the live source wins.

What good looks like here

Written from an ex-CQC inspector's chair, but the point is safe, well-led care your team can stand behind. Each row shows what strong evidence looks like, what thin evidence looks like, and where the expectation comes from.

Duty of candour is tested at the worst possible moment for a service: someone has already been harmed, and the instinct is to wait until the facts are clear, or to soften the account. The risk this policy guards against is a service that goes quiet exactly when a patient or a bereaved family most needs a truthful, timely explanation and a genuine apology. Being told openly and early is part of how a person rebuilds trust and makes sense of what happened, and a defensive silence lands as a second injury on top of the first. Two details decide whether the duty is honoured well. The first is provider type: Regulation 20 sets one notifiable safety incident definition for health service bodies and a different one for every other registered person, and most independent providers sit in the second group, where moderate harm is not the trigger. Reading the wrong definition means the wrong incidents get opened, or the right ones never are. The second is the apology itself, which the regulation defines as an expression of sorrow or regret in respect of the incident, not regret that the person feels upset. The recorded conversation, the captured apology and the retained copy of the written follow-up are not paperwork for an inspector. They are the proof the person was treated honestly.

  1. Every incident is tested against the Regulation 20 notifiable-safety-incident threshold that applies to your own provider type, the health service body definition or the separate definition for any other registered person: a defined statutory bar (moderate or severe harm, death, or prolonged pain or psychological harm), applied incident by incident, with the reasoning recorded for the ones ruled out as well as the ones taken forward.

    Strong evidence: The threshold decision recorded on the incident with the provider-type definition and the legal source checked, and the not-opened decisions explaining why the threshold was not met.

    Weak evidence: The incident's log-time harm rating carried straight through as the candour decision, with no separate Regulation 20 test and no recorded reasoning for the incidents ruled out. The sharpest tell is a provider that is not a health service body applying the health-service-body wording and treating 'moderate harm' as its trigger. Moderate harm appears only in the health-service-body definition; every other registered person is tested against impairment lasting at least 28 days, changes to the structure of the body, prolonged pain or prolonged psychological harm, shortening of life expectancy, or treatment needed to prevent death or such an injury. Read the wrong definition and the wrong incidents cross the line, in both directions.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, reg 20(8) (health service bodies) and reg 20(9) (any other registered person)

  2. For an incident that meets the notifiable-safety-incident threshold, the person is told what happened as soon as reasonably practicable, and the record shows when the conversation happened, who was present, and the exact wording of the apology, not just a line saying the family was informed.

    Strong evidence: A conversation note recording that it was done as soon as reasonably practicable, the attendees, and a genuine apology captured in the record (an expression of sorrow or regret, not "sorry you feel").

    Weak evidence: A single line reading 'family informed' with no date, no note of who was present and no record of what was actually said. The apology logged as 'sorry you feel that way' rather than an expression of sorrow or regret that the incident happened. The failure that matters most is a notification given by telephone or email with nothing explaining why it was not given in person, and, where the person could not be reached or declined to speak, no written record of the attempts made to contact them.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, reg 20(2)(a) and reg 20(3)(a), (d) and (e); "apology" defined in reg 20(7); contact attempts under reg 20(5)

  3. The written follow-up actually reaches the person, and the record proves it was sent, not just drafted.

    Strong evidence: The written notification that reflects the conversation and includes an apology, with the evidence of sending stored.

    Weak evidence: A letter sitting in drafts with 'sent' ticked but nothing attached: no email confirmation, no scan of the posted letter, no hand-over signature, and no retained copy of the correspondence. Or a written notification that no longer matches the verbal account, or one that quietly drops the apology or omits the results of the further enquiries that were promised in the conversation.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, reg 20(4)(a)-(d) and reg 20(6)

  4. The relevant person is identified from the regulation's own test: the service user has died, was under 16 and not competent to decide about their own care, or lacked capacity in relation to the matter. The authority the representative is acting under is recorded, not assumed from whoever answered the phone.

    Strong evidence: The relevant-person identification note with the capacity or bereavement and representative-status record.

    Weak evidence: The notification addressed to whoever was easiest to reach, with no note of why that person is the relevant person. The regulation reaches a representative only where the service user has died, is under 16 and not competent to decide about their own care, or is 16 or over and lacks capacity in relation to the matter, so the weak record is one with no capacity assessment, no bereavement note, and nothing showing the basis on which the person is lawfully acting on the service user's behalf, such as a lasting power of attorney or a court appointment. A service that ranks bereaved relatives against a house 'priority order' is applying something the regulation does not contain.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, reg 20(7), definition of "relevant person"; capacity assessed under Mental Capacity Act 2005 ss.2-3

  5. The Regulation 20 duty is owed to the person and is discharged by telling the person. It is not a notification to CQC, and a notification to CQC does not discharge it. Where the same incident is also notifiable under the Care Quality Commission (Registration) Regulations 2009, that notification runs as its own record, opened or ruled out on its own terms.

    Strong evidence: The separate CQC statutory-notification record and decision (under the CQC Registration Regulations), cross-linked to but distinct from the candour record.

    Weak evidence: The candour record treated as if telling the person also tells the regulator, with no separate statutory notification opened or reasoned out as not required. Regulation 20 is owed to the person and is never itself a notification to CQC. The reverse tell is a submitted notification with the candour panel left empty because someone assumed that telling the regulator discharged the duty. Where both were done, a candour record that does not connect to the notification record leaves no way to show the two duties were handled as distinct obligations.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, reg 20(2); Care Quality Commission (Registration) Regulations 2009, regs 16 to 18

  6. Openness with the person is the norm for any safety incident that affects them, not something switched on only when an incident clears the high Regulation 20 threshold. Candour that starts at the statutory line and stops below it leaves people finding out through a complaint what the service already knew, which is a person-centred and well-led failing whatever the harm rating said.

    Strong evidence: A lower-harm incident where the person was still told what happened and offered an apology, recorded alongside the Regulation 20 cases.

    Weak evidence: Candour records that exist only for incidents meeting the Regulation 20 bar, with nothing for the lower-harm events where the person was still affected. The tell is a clean line at the statutory threshold: openness switches on at the legal trigger and off below it, and no lower-harm incident shows the person was told what happened and offered an apology. Complaints that open with 'nobody told me' about incidents the service already knew of are the same failure seen from the other side.

    What the regulator expects to see. Not a law in itself, but CQC judges you against it, so an inspector will look for it and expect a reason where you depart from it.

Related

Last verified 20 July 2026

Audit this policy

Duty of candour procedure checklist

A policy is the intent; the evidence is what a CQC inspector actually asks to see. This matching checklist turns the policy above into the records to keep, the audit to run, and the places small services most often fall short.

Open the Duty of candour procedure checklist

Spotted something to improve?

These are sample templates, not the last word. If you would change a wording, or want to help us confirm a detail, tell us and we will look at it.

Related Verivius content

Want help adapting this to your service?

A Verivius consultant can read your adapted policy against the live regulation and your service shape. The work fits inside a Mock Inspection engagement or a shorter consulting brief. A 20-minute conversation is the fastest way to find out whether the fit is right.

Get started free

Free to start, no card. A 14-day trial when you subscribe.

Last reviewed 10 June 2026