Duty of candour policy template

1. What the regulation says

As soon as reasonably practicable after becoming aware that a notifiable safety incident has occurred a registered person must notify the relevant person...

The notification... must include an apology.

The notification given under paragraph (2)(a) must be followed by a written notification given or sent to the relevant person...

harm that requires a moderate increase in treatment, and significant, but not permanent, harm.

a permanent lessening of bodily, sensory, motor, physiologic or intellectual functions, including removal of the wrong limb or organ or brain damage, that is related directly to the incident and not related to the natural course of the service user's illness or underlying condition.

an expression of sorrow or regret in respect of a notifiable safety incident.

The full text of the regulation is at https://www.legislation.gov.uk/uksi/2014/2936/regulation/20. Where this policy and the regulation diverge, the regulation wins.

A notifiable safety incident is a specific legal term, and the threshold that triggers the duty differs by provider type. Regulation 20 sets one definition for health service bodies and a separate definition for other registered persons. The service must apply the correct Regulation 20 definition for its own provider type, and must not assume that the wording used by another type of provider applies to it.

2. Plain-English summary

When something goes wrong that meets the Regulation 20 notifiable safety incident threshold for your provider type, you must tell the relevant person (the patient, or the person acting on their behalf) in person as soon as reasonably practicable, give a truthful account, offer support, apologise, and follow up in writing. The threshold itself differs by provider type: Regulation 20 sets one notifiable safety incident definition for health service bodies and a separate definition for all other registered providers, so the service must apply the correct definition for its own type rather than assume another provider type's wording applies. The regulation does not set a number-of-days deadline for the written stage; any specific deadline you see in Verivius is an operational default, not a legal duty.

Regulation 20 is the duty to the patient. It sits alongside the duty to notify the regulator under the Care Quality Commission (Registration) Regulations 2009 (for example, notification of death under Regulation 16), but it is a separate obligation. Honouring one does not satisfy the other.

3. Scope

This policy applies to all clinical and care staff at , every regulated activity the provider is registered for, every service-user pathway, and every incident that meets the Regulation 20 notifiable safety incident threshold for the service's provider type. It applies regardless of whether the incident was preventable; the regulation is triggered by the harm threshold, not by blame.

(Tenant updates the angle-bracket placeholder.)

4. Roles and responsibilities

• Registered Manager: accountable for Regulation 20 compliance across every site. Reads every duty-of-candour record to closure. Signs off the written notification before it is sent on incidents involving severe harm or death. Reviews the aggregate candour pattern at the monthly governance meeting.
• Nominated Individual: holds provider-side accountability for Regulation 20.
• Clinical Lead: typically delivers the verbal notification when the clinical relationship makes that the right choice. Holds the in-the-room responsibility for the candour conversation: accurate factual account, apology, offer of support, agreement on next steps.
• Designated candour drafter: the named person who drafts the written follow-up. May be the same as the verbal-deliverer or different; in larger services typically a governance lead or the Registered Manager drafts and the clinical lead reviews.
• All clinical staff: recognise when an incident may meet the Regulation 20 threshold and surface it to the Registered Manager the same working day. The triage to "in scope or not" is a manager-or-above decision, not a contributor-level one.

(Tenant updates the named role-holders.)

5. Procedure

The duty-of-candour procedure operationalises Regulation 20 across the lifecycle from harm identification to written-notification closure. It runs as a sub-lifecycle inside the source incident record in Verivius.

1. Harm assessment at incident logging. Every incident's initial harm assessment is reviewed against the Regulation 20 threshold for the service's provider type. The harm categories and threshold must be checked against the current Regulation 20 wording before opening or declining the duty-of-candour lifecycle. The triage decision is recorded on the incident.
2. Open the duty-of-candour panel. Where the threshold is met, the candour panel opens on the source incident. The deadline clock starts ("as soon as reasonably practicable" in the regulation; the tenant SLA layer sets the operational target).
3. Identify the relevant person. The patient is the default. Where the patient cannot consent or is bereaved, the relevant person is identified per Regulation 20(6): a person lawfully acting on the patient's behalf, the bereaved family per the priority list.
4. Verbal notification. A face-to-face conversation (where reasonably practicable) or a phone call (where face-to-face is not). The conversation captures: an accurate factual account of what happened so far as known at the time, what further enquiries the provider considers appropriate, the apology, the offer of support. The conversation is recorded on the candour panel with date, time, attendees, location, summary of what was said. The apology is not "we are sorry that you feel"; it is "we are sorry that this happened".
5. Written follow-up. A written notification follows the verbal as soon as reasonably practicable. The written must contain the matters discussed verbally, the results of further enquiries (or a statement that they are ongoing), an apology, the steps the provider is taking. The letter is drafted, reviewed (typically by the Registered Manager), sent through a channel the recipient has agreed (post, email, in-person hand-over).
6. Record evidence of sending. The written notification is attached to the candour record (an email confirmation, a printed-letter scan with date stamp, a hand-over signature). The send timestamp and the sending user are captured.
7. Track outcomes. Where the relevant person responds, the response is recorded against the candour record. Where further enquiries produce new information after the initial written, a supplementary written notification is sent.
8. Closure. The candour record closes when the duty has been honoured end-to-end (verbal done; written sent; any outcome captured). The closure paragraph names what was done and the closing user.
9. Cross-link to the statutory notification. Many Regulation 20 incidents also meet a statutory-notification trigger under the Care Quality Commission (Registration) Regulations 2009 (for example, notification of death under Regulation 16). The two records are linked but run their own lifecycles. The Registration Regulations notification does not satisfy Regulation 20 and vice versa.
10. Pattern review. The aggregate candour pattern (count, harm-distribution, time-from-incident-to-verbal, written-letter quality) is reviewed at the monthly governance meeting.

6. Training requirement

• All clinical staff complete Duty of Candour awareness training at induction and every three years.
• The Registered Manager, the Clinical Lead, and the Designated Candour Drafter complete Duty of Candour delivery training (the in-the-room conversation skills plus the written-letter format) at appointment and every three years.
• Apology training (recognising what counts as the regulation-required apology versus what reads as an expression of feelings about feelings) is included in the delivery training above.

Training records are held in the tenant's training matrix register.

7. Audit

Compliance with this policy is monitored by the Registered Manager:

• Per-incident sign-off: every incident at or above the Regulation 20 threshold for the service's provider type is checked for the candour-panel state at incident closure. Incidents above threshold with no candour panel opened are surfaced.
• Quarterly candour-record review: every candour record closed in the trailing 12 months is reviewed for completeness (verbal done with full details captured; written sent with copy attached; apology language meeting the Regulation 20 standard).
• Annual policy review: the policy itself is re-read against the live Regulation 20 text and any CQC guidance updates.

Audit findings recorded in the tenant's audit register; actions logged in the improvement-actions register.

8. Record-keeping

Duty-of-candour records (sub-lifecycle inside the source incident) are held for a minimum of 8 years from the date of the last entry, aligned to the NHS Code of Practice on Records Management and the related clinical record. Written-notification copies and any reply correspondence are attached to the candour record and travel with it.

Verivius preserves the per-record audit trail indefinitely while the workspace is active.

9. Related policies in this pack

• Safe Care and Treatment Policy
• Good Governance Policy
• Complaints Policy
• Statutory Notifications Policy
• Notification of Death Policy
• Incident Reporting, Investigation and Learning Policy

10. Sources and further reading

This template is based on CQC's guidance for providers and managers, the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, and other topic-specific legislation and guidance listed below. It is a starting point for adaptation, not a substitute for legal, clinical, HR, safeguarding or specialist professional advice.

• CQC Regulation 20: Duty of candour
• CQC Regulation 12: Safe care and treatment
• CQC Regulation 17: Good governance
• Care Quality Commission (Registration) Regulations 2009 (statutory notifications, including notification of death) (https://www.legislation.gov.uk/uksi/2009/3112/contents)
• NHS Resolution "Saying Sorry"
• GMC/NMC/GDC/HCPC professional candour guidance
• NHS Code of Practice on Records Management (retention)
• Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (https://www.legislation.gov.uk/uksi/2014/2936/regulation/20)

11. When to seek further advice

Seek specialist advice where the issue involves serious harm, safeguarding, deprivation of liberty, restraint, children, professional misconduct, controlled drugs, radiation, termination of pregnancy, infection outbreak, water safety, employment dismissal, DBS barring referral, or regulatory enforcement.

12. Document control

This sample policy template was issued by Verivius. It is a template, not a substitute for legal advice or the tenant's own policy-development process. Where this template and live law or regulator guidance diverge, the live source wins.