Sample policy · GP

Significant event analysis policy (gp)

Statutory anchor: Regulation 17 (good governance), Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (SI 2014/2936). This policy also engages Regulation 20 (duty of candour). · primary source

1. What the regulation says

Systems or processes must be established and operated effectively to ensure compliance with the requirements in this Part. (Reg 17(1): the umbrella duty)

assess, monitor and improve the quality and safety of the services provided in the carrying on of the regulated activity (including the quality of the experience of service users in receiving those services) ... assess, monitor and mitigate the risks relating to the health, safety and welfare of service users and others who may be at risk which arise from the carrying on of the regulated activity. (Reg 17(2)(a) and (b): quality and risk)

maintain securely an accurate, complete and contemporaneous record in respect of each service user, including a record of the care and treatment provided to the service user and of decisions taken in relation to the care and treatment provided. (Reg 17(2)(c): accurate service-user record)

Regulation 20 adds the duty of candour that the SEA process must consider for qualifying events:

Registered persons must act in an open and transparent way with relevant persons in relation to care and treatment provided to service users in carrying on a regulated activity. (Reg 20(1): the headline duty)

As soon as reasonably practicable after becoming aware that a notifiable safety incident has occurred a registered person must (a) notify the relevant person that the incident has occurred in accordance with paragraph (3), and (b) provide reasonable support to the relevant person in relation to the incident, including when giving such notification. (Reg 20(2): the notification trigger)

The full text is at https://www.legislation.gov.uk/uksi/2014/2936/regulation/17 and https://www.legislation.gov.uk/uksi/2014/2936/regulation/20. Where this policy and the regulation diverge, the regulation wins.

2. Plain-English summary

You have to run effective systems and processes to comply with everything else in Part 3. The regulation lists six things those systems must enable in particular: quality assessment and improvement, risk management, accurate service-user records, accurate employment and management records, seeking and acting on feedback, and continually evaluating and improving how you process all this. If CQC requests a written report on quality and risk plus your improvement plans, you have 28 days from the day after the request.

Significant event analysis is one of the ways a GP practice meets this duty. Where an event qualifies as a notifiable safety incident under Regulation 20(9), which is the definition that applies to a GP practice, the separate duty of candour also applies: an unintended or unexpected incident that, in the reasonable opinion of a health care professional, appears to have resulted in death related to the incident, impairment lasting or likely to last at least 28 days, changes to the structure of the body, prolonged pain or prolonged psychological harm, or shortened life expectancy, or that requires treatment to prevent death or an injury leading to one of those outcomes. Where it applies, you must be open with the person as soon as reasonably practicable, give a truthful account, offer support, apologise, and follow up in writing.

3. Purpose

This policy sets out how the Practice records, reviews, learns from and closes significant event analysis records in primary care.

The Verivius platform calls these records incidents. Primary-care convention often calls the review process significant event analysis or SEA. This policy uses both terms so staff understand the mapping.

4. Scope

This policy applies to:

The Practice records the event once and uses the SEA process to review it.

5. SEA review workflow

The Practice follows a documented SEA cycle for every event that meets the local review threshold.

5.1 Log the event

Staff record the event as soon as practicable after they become aware of it.

The record includes:

Staff record facts and avoid blame language.

5.2 Triage the event

The Clinical Lead or delegated senior person triages the record.

Triage considers:

The triage decision records whether the event needs immediate action, full SEA discussion or closure with documented learning.

5.3 Review the event

The SEA review identifies what happened and why.

The review considers:

The review records contributing factors, learning and actions.

5.4 Close the event

The Clinical Lead closes the SEA record only when:

The closure note records the reason for closure and any remaining monitoring.

6. SEA meeting cadence

The Practice uses a quarterly SEA review meeting as the Verivius default unless current CQC, NHS England, GMC, contract or local governance source material requires a different rhythm.

The meeting:

The Practice does not describe the quarterly cadence as regulator-mandated unless the current source says so.

7. Learning loop

The Practice shares SEA learning in a way that matches the risk and audience.

Learning may be shared through:

The Practice checks whether learning has changed practice. Learning is not complete until the action has been implemented and reviewed.

8. Responsibilities

8.1 Training and competence

At induction, every worker is shown how to log an event, who triages it and how urgent concerns are escalated when the Practice is closed or the usual lead is unavailable.

People who chair or lead SEA reviews receive training in proportionate, systems-based review, duty of candour, patient and staff involvement, confidentiality and action design. Before a person leads a review alone, the Clinical Lead samples one completed review against this policy and records sign-off in the training matrix.

Locums and temporary staff receive the same reporting route in their first-shift information. The Practice does not assume that previous NHS or primary-care experience means they know the local process.

9. Recording requirements

The Practice keeps the following records:

Records are kept in the Practice governance records and are available for internal review, CQC review and external review where required.

10. Audit cadence

The Practice uses the following Verivius default audit rhythm unless current source material requires more frequent review:

Audit findings are recorded as improvement actions with an owner and review date.

11. Version control and review date

The Practice keeps a controlled copy of this policy. The footer or document-control table records:

12. Related policies and records

Review cadence: annual or on regulatory change, whichever sooner. Owner: Registered Manager.

13. Sources and further reading

This template is based on CQC's guidance for providers and managers, the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, and other topic-specific legislation and guidance listed below. It is a starting point for adaptation, not a substitute for legal, clinical, HR, safeguarding or specialist professional advice.

14. When to seek further advice

Seek specialist advice where the issue involves serious harm, safeguarding, deprivation of liberty, restraint, children, professional misconduct, controlled drugs, radiation, termination of pregnancy, infection outbreak, water safety, employment dismissal, DBS barring referral, or regulatory enforcement.

15. Document control

Version Date Author Changes
v1 2026-06-10 Verivius (sample) Initial sample template, conformed to the Verivius policy standard.
v1.1 2026-07-19 Verivius (sample) Clarified the SEA workflow, added role-specific competence checks and linked the operating records to companion policies.

This sample policy template was issued by Verivius. It is a template, not a substitute for legal advice or the provider's own policy-development process. Where this template and live law or regulator guidance diverge, the live source wins.

What good looks like here

Written from an ex-CQC inspector's chair, but the point is safe, well-led care your team can stand behind. Each row shows what strong evidence looks like, what thin evidence looks like, and where the expectation comes from.

Harm in general practice rarely arrives as one dramatic event. It accumulates quietly in the gaps between people: an abnormal blood result filed without action, an urgent suspected-cancer referral that never left the workflow, a repeat prescription reauthorised without the monitoring bloods, a hospital letter scanned into the record but never read. Each one looks minor on its own and is usually noticed by a single clinician on a single session, so unless the practice writes it down and then looks across the whole year, the same gap keeps catching different patients who have no idea it exists. That is why significant event analysis in a practice staffed by part-time partners, salaried GPs, locums and a reception team stands or falls on whether the record travels beyond the person who found it. When the loop genuinely closes, the patient whose result was missed hears the truth from their own practice rather than from a hospital clinic months later, and the workflow that missed it is fixed for everyone else still on the list.

  1. Significant event analysis (SEA) learning changes practice, rather than an action being written down and never implemented. Actions are completed and re-checked, so the next patient is treated under the changed process rather than the one that caused the event, not so a learning point can be recorded and the file closed.

    Strong evidence: Action completion evidence and the learning-shared-with-staff record, cross-read against the quarterly SEA meeting minutes that check overdue actions and repeat themes (recording requirements; sections 6 and 7).

    Weak evidence: Action wording that cannot be completed or checked, such as "staff reminded at meeting" or "protocol to be updated", with no named owner and no review date. The weakest version is a closed record whose action was never re-checked: the revised safety-netting step for urgent suspected-cancer referrals is still sitting in draft months later, and no later minute confirms anyone is actually working the new way.

    What the regulator expects to see. Not a law in itself, but CQC judges you against it, so an inspector will look for it and expect a reason where you depart from it.

  2. SEA records are closed only against the full closure gate, not marked closed the moment they are logged. Before closure the immediate safety action is complete, learning is agreed, improvement actions have owners, the duty of candour owed to the person has been considered, and, separately, external reporting has been completed or ruled out. A record closed with none of that evidenced tells the colleague who picks it up nothing about what was actually finished.

    Strong evidence: The closure note recording the reason for closure and any remaining monitoring, sitting on the triage decision and review notes behind it (section 5.4; recording requirements).

    Weak evidence: Records closed on the day they were logged, with a closure note reading "discussed" or "no further action needed". Weak files close before the immediate safety action is finished, leave external reporting neither completed nor ruled out in writing, carry improvement actions with no named owner, show no sign the governance group saw the record where the policy required it, and say nothing about what monitoring continues after closure.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  3. A qualifying notifiable safety incident triggers the Regulation 20 duty of candour, which is owed to the person and is not a box to tick. Where the incident met the Regulation 20 threshold that applies to the practice (a GP practice, as a registered person that is not a health service body, uses the all-other-providers threshold in Regulation 20(9), not the health-service-body moderate-harm threshold in Regulation 20(8)), the person is told as soon as reasonably practicable, given a truthful account and an apology, and followed up in writing. Openness below the threshold still engages the practice's person-centred duties.

    Strong evidence: The duty of candour assessment held with each SEA record and the patient communication record (recording requirements; sections 5.1 and 5.4).

    Weak evidence: A ticked duty of candour box with no reasoning about whether the incident met the notifiable safety incident threshold that applies to the practice, or a note that the patient "was aware anyway" because they were in the room at the time. Weak files show no record of what the person was actually told, no apology, no offer of support and no written follow-up. A common error is judging the event against the health-service-body threshold in Regulation 20(8) rather than the all-other-providers threshold in Regulation 20(9) that a GP practice works to. Another is treating a statutory notification to CQC under the Care Quality Commission (Registration) Regulations 2009, or a safeguarding referral to the local authority, as though it discharged the duty. Those two routes are separate from each other, and separate again from candour, which is owed to the patient in its own right and is not a notification.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, reg 20(2), (3) and (9)

  4. Every event is triaged and routed, not just logged and left. The triage decision records severity, actual or potential harm, safeguarding, complaint and data-protection links, and sets the route (immediate action, full SEA discussion, or closure with documented learning). Each of those links carries its own route and its own decision, and logging the event as an SEA settles none of them.

    Strong evidence: The triage decision record for each event (section 5.2; recording requirements).

    Weak evidence: Events sitting in the log for weeks with the triage fields blank, or triage recorded as a single word such as "low" with nothing about actual or potential harm. Weak triage misses the crossovers: a prescribing error that also raises a safeguarding concern, a letter sent to the wrong address that is also a personal data breach, a complaint carrying a safety learning point. If the record does not show which route was chosen (immediate action, full SEA discussion, or closure with documented learning), triage did not happen.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  5. Repeat themes are found across events, rather than each event patched in isolation. The quarterly meeting identifies recurring themes and decides whether a clinical audit or policy change is needed, because a fault in the workflow itself keeps reaching patients until someone looks across the records instead of at one of them.

    Strong evidence: The quarterly SEA meeting minutes recording repeat themes, overdue actions and whether learning was shared, alongside the clinical audit schedule (sections 6 and 10; recording requirements).

    Weak evidence: Every record reads sensibly on its own and nothing looks across them. Weak minutes list the events discussed without ever naming a theme: three separate result-handling events across the year, each closed as a one-off, with no line asking whether the results workflow itself is the fault. Overdue actions rolled forward from meeting to meeting without challenge, and no decision recorded on whether a clinical audit or policy change is warranted, are the other tells.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

Related

Last verified 20 July 2026

Spotted something to improve?

These are sample templates, not the last word. If you would change a wording, or want to help us confirm a detail, tell us and we will look at it.

Related Verivius content

Want help adapting this to your service?

A Verivius consultant can read your adapted policy against the live regulation and your service shape. The work fits inside a Mock Inspection engagement or a shorter consulting brief. A 20-minute conversation is the fastest way to find out whether the fit is right.

Get started free

Free to start, no card. A 14-day trial when you subscribe.

Last reviewed 19 July 2026