Sample policy · Reg 19

Responding to Unsafe Conduct, Fitness Concerns and Referral Duties Policy

Statutory anchor: Regulation 19 (fit and proper persons employed), Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (SI 2014/2936). The duty to make a barring referral to the DBS arises under the Safeguarding Vulnerable Groups Act 2006. This policy also engages Regulation 13 (safeguarding service users from abuse and improper treatment). · primary source

Download the PDF

The PDF version of this template is the same content, formatted for adaptation in your document control system. The disclaimer above is repeated on the PDF cover.

Download PDFTalk to a consultant

Verivius pack version v1.1, 2026-07-19

1. What the regulation says

Regulation 19 sets the fitness requirements for people employed to provide a regulated activity, and the action required where a person no longer meets them:

be of good character, (Reg 19(1)(a) (good character))

have the qualifications, competence, skills and experience which are necessary for the work to be performed by them, and (Reg 19(1)(b) (qualifications + competence))

be able by reason of their health, after reasonable adjustments are made, of properly performing tasks which are intrinsic to the work for which they are employed. (Reg 19(1)(c) (health fitness))

take such action as is necessary and proportionate to ensure that the requirement in that paragraph is complied with, and (Reg 19(5)(a) (enforcement: ensure compliance))

if the person is a health care professional, social worker or other professional registered with a health care or social care regulator, inform the regulator in question. (Reg 19(5)(b) (enforcement: inform the regulator))

Regulation 13 adds the safeguarding duties that this policy operationalises:

Service users must be protected from abuse and improper treatment in accordance with this regulation. (Reg 13(1) (the headline duty))

Systems and processes must be established and operated effectively to investigate, immediately upon becoming aware of, any allegation or evidence of such abuse. (Reg 13(3) (investigation systems))

The full text of the regulation is at https://www.legislation.gov.uk/uksi/2014/2936/regulation/19. Where this policy and the regulation diverge, the regulation wins.

2. Plain-English summary

Everyone you employ to provide a regulated activity must be of good character, suitably qualified and competent for the work, and capable in health (with reasonable adjustments). You have to operate effective recruitment procedures. For each employee you have to hold the Schedule 3 information, plus any other records required by law. Where the person is a volunteer, Regulation 19(3A) removes the requirement to obtain the Schedule 3 paragraph 7 full employment history with written explanation of gaps, unless Regulation 4, 6 or 7 applies. The identity requirement, including proof of identity and a recent photograph, still applies. Providers may still request employment history for volunteers where they consider this necessary for the role. Staff requiring professional registration must hold it. Where a person no longer meets these requirements, you must take action that is necessary and proportionate, and where they are a registered professional you must inform their regulator. Alongside this, you must protect people using the service from abuse and improper treatment, with effective systems to prevent abuse and to investigate any allegation or evidence of abuse immediately on becoming aware of it.

3. Purpose

The purpose of this policy is to protect people using the service from staff who may be unfit or unsafe to work with them.

It sets out how the service meets the Regulation 19 fitness requirements, the Regulation 13 safeguarding duties, and the duties to refer to the DBS and to professional regulators where a person may have caused harm or be unfit to practise.

The service must be able to act quickly, fairly and proportionately where a fitness or conduct concern arises, and to make the referrals the law requires.

4. Policy warning

The service must act immediately on a fitness or conduct concern. A delay can leave people using the service exposed to harm.

Protective action taken while a concern is assessed is a safety measure, not a finding of guilt.

Safeguarding, police and urgent professional-regulator action must not be delayed while internal HR or disciplinary processes are completed. The DBS threshold assessment also starts promptly and runs alongside the internal process. A DBS referral is made when the provider has gathered enough information to establish that the legal duty is met. An allegation or suspension alone does not automatically establish that threshold, and the person leaving does not end the provider's duty to complete the decision.

5. Scope

This policy applies to all staff, volunteers, agency workers, contractors and professionals involved in the regulated activities carried on by the service.

It covers concerns relating to:

Local adoption decisions

Before adoption, the provider records:

6. Principles

The service applies the following principles when responding to a fitness or conduct concern:

7. Responsibilities

All staff are responsible for raising fitness and conduct concerns immediately and for cooperating with any investigation.

Managers are responsible for taking immediate protective action, completing risk assessments, gathering evidence and escalating concerns to the Registered Manager.

The Registered Manager is responsible for deciding on protective action, overseeing investigations, making safeguarding, DBS, professional-regulator, police and CQC referral decisions, and recording the rationale for each.

The Nominated Individual or provider representative is responsible for oversight of serious or persistent concerns and for ensuring the service has the capacity and authority to act on referral duties.

8. Unsafe-conduct and fitness-concern workflow

The service will act immediately where there is concern that a staff member, volunteer, agency worker, contractor or professional may not be fit or safe to work with people using the service.

The safety of people using the service takes priority over staffing convenience.

  1. Receive and record. The person receiving the concern records what was reported, by whom, when, the people potentially affected and any evidence that must be preserved. They do not investigate beyond what is needed to make the situation safe.
  2. Protect and triage. The manager completes an immediate risk assessment, protects people and staff, and considers urgent safeguarding, police, clinical, professional-regulator and CQC action.
  3. Open the evidence trail. A concern record is created and linked to any incident, safeguarding or complaint record. A conflict-free investigation lead, decision maker and timescale are named.
  4. Investigate fairly. Evidence is gathered, the staff member is told the concern and supported to respond unless another authority requires delay, and contact with external bodies is documented.
  5. Decide each threshold separately. Safeguarding, DBS, police, professional-regulator and CQC thresholds are tested against current guidance. A referral reference or a reasoned decision not to refer is recorded for each applicable route.
  6. Decide fitness and employment action. The Registered Manager records whether the person remains fit and proper, any restrictions, supervision, retraining, redeployment, removal or dismissal, and who approved the decision.
  7. Close governance actions. Learning is linked to the risk, training, supervision and improvement-actions registers. The concern closes only when referrals, protective actions and review dates have named owners.

9. Immediate protective action

Where there is an allegation, concern or evidence of unsafe conduct, the Registered Manager must complete an immediate risk assessment and decide whether protective action is required.

Protective action may include:

Protective action is not a finding of guilt. It is a safety measure while concerns are assessed.

10. Investigation and evidence

The service must gather and retain clear evidence, including:

The service must continue the investigation as far as reasonably possible even if the person resigns, leaves, retires or stops attending work.

11. Safeguarding referral

The Registered Manager must make a safeguarding referral where there is concern that a person using the service has experienced, or is at risk of, abuse, neglect, exploitation or avoidable harm.

This includes concerns involving:

Safeguarding referral must not be delayed while internal HR processes are completed.

12. DBS barring referral

The service will make a DBS barring referral where the legal duty to refer is met.

The service begins gathering evidence as soon as the concern arises. It does not treat an allegation or temporary suspension alone as proof that the legal duty is met. Once the relevant facts establish both the regulated-activity removal condition and the applicable relevant-conduct, harm-test or relevant-offence condition, the referral is made without avoidable delay. The decision is completed even if the person resigns, retires or otherwise leaves.

This includes situations where the service withdraws permission for a person to work in regulated activity, or would have withdrawn permission but the person resigns, retires, is redeployed or leaves, and the service believes the person has:

The duty to refer to DBS is separate from any referral to the local safeguarding authority, police, CQC or professional regulator. Making one referral does not remove the need to consider the others.

The Registered Manager must record either:

13. Professional-regulator referral

Where the person is registered with a professional regulator, the Registered Manager must consider whether the concern should be referred to that regulator.

This may include referral to bodies such as the NMC, GMC, HCPC, GDC, GPhC, Social Work England or another relevant professional regulator.

Referral must be considered where there are concerns about:

Where the service decides not to refer, the rationale must be recorded.

14. Police contact

The service must contact the police where there is an allegation or evidence that a criminal offence may have been committed.

This includes, but is not limited to, assault, sexual offence, theft, fraud, wilful neglect, ill-treatment, coercive behaviour or deliberate harm.

15. CQC notification

The Registered Manager must consider whether the concern triggers a statutory notification to CQC.

This may include notifications relating to abuse or allegations of abuse, serious injury, police involvement, events that affect the safe running of the service, or other notifiable incidents.

The decision to notify or not notify must be recorded.

16. Return to work or removal from role

Before a person returns to normal duties after a fitness or safeguarding concern, the Registered Manager must record:

Where the person is no longer fit for the role, the service must take necessary and proportionate action. This may include dismissal, withdrawal from regulated activity, redeployment, referral to DBS, referral to a professional regulator, or notification to relevant authorities.

17. Records and evidence

The service must record, for each fitness or conduct concern:

Records must be kept securely and in line with the service's information-governance and retention arrangements.

The concern record is cross-linked to the relevant incident, safeguarding, complaint or person record. Referral references, risk controls and corrective actions are linked to the risk, training, supervision, audit and improvement-actions registers so that the provider can show the complete response trail without relying on one staff file.

18. Audit

The Registered Manager must audit fitness, conduct and referral handling at least annually.

The audit must check:

Audit findings must be recorded in the audit register. Corrective actions have an owner and due date in the improvement-actions register, and unresolved systemic risks are linked to the risk register.

19. Review

This policy will be reviewed annually, or sooner following a relevant event such as a serious fitness or conduct concern, a safeguarding referral, a DBS or professional-regulator referral, a CQC inspection finding, a significant service change, or a change in the law or regulator guidance.

20. Related policies in this pack

This policy should be read with:

21. Sources and further reading

This template is based on CQC's guidance for providers and managers, the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, and other topic-specific legislation and guidance listed below. It is a starting point for adaptation, not a substitute for legal, clinical, HR, safeguarding or specialist professional advice.

22. When to seek further advice

Seek specialist advice where the issue involves serious harm, safeguarding, deprivation of liberty, restraint, children, professional misconduct, controlled drugs, radiation, termination of pregnancy, infection outbreak, water safety, employment dismissal, DBS barring referral, or regulatory enforcement.

23. Document control

Version Date Author Changes
v1 2026-06-10 Verivius (sample) Initial sample template, conformed to the Verivius policy standard.
v1.1 2026-07-19 Verivius (sample) Added the end-to-end concern workflow, local adoption decisions and linked governance records. Clarified when the DBS legal-duty decision is made and that leaving does not end the provider's duty to complete it.

This sample policy template was issued by Verivius. It is a template, not a substitute for legal advice or the provider's own policy-development process. Where this template and live law or regulator guidance diverge, the live source wins.

What good looks like here

Written from an ex-CQC inspector's chair, but the point is safe, well-led care your team can stand behind. Each row shows what strong evidence looks like, what thin evidence looks like, and where the expectation comes from.

A fitness or conduct concern is unlike most other quality problems because the subject of it keeps turning up for shifts while the process runs. The people most exposed are usually those receiving personal care, medicines or help with their money, often alone with one member of staff and often least able to say what happened or to be believed when they do. That is why protective action is separated from blame in this policy: restricting duties while a concern is assessed keeps the person receiving care safe without pre-judging the member of staff, and it makes a fair investigation possible rather than a rushed one. The referral routes are deliberately separate because each protects a different group of people. A safeguarding referral protects the person in front of you now, a Disclosure and Barring Service (DBS) barring referral protects people at the next employer, and a professional-regulator referral protects patients anywhere that registration is used. A statutory notification to CQC is none of those; it tells the regulator what happened and protects nobody by itself. The moment this policy earns its keep is the resignation letter, because that is the point at which the internal process loses its purpose and the duty owed to everyone downstream is all that is left.

  1. Each threshold is tested separately (safeguarding referral, Disclosure and Barring Service barring referral, professional-regulator referral, police contact and the statutory notification to CQC), with a referral reference or a reasoned decision not to refer recorded for every applicable route. These are independent duties, so one referral is never treated as covering the others, and a decision not to refer is reasoned and recorded rather than left blank.

    Strong evidence: The concern record showing, for each route, the referral date and reference or the recorded rationale for not referring (the workflow 'decide each threshold separately' step, and sections 12, 13, 15 and 17).

    Weak evidence: One safeguarding referral number pasted into the concern record with every other route left blank, or a single tick-box row reading "referrals: considered" with no reference against it. Weak too where a route was ruled out in silence: "not referred" with no reason, no named decision maker and no date, so nobody can tell whether the Disclosure and Barring Service (DBS) barring threshold, the professional-regulator threshold and the police threshold were tested at all, or whether a statutory notification to CQC was needed. Weakest where the file shows one referral being treated as having covered the rest.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  2. The Disclosure and Barring Service barring-referral duty is completed even when the person resigned, retired or left, not dropped because they had gone. The risk does not leave with the person, so the barring decision is finished rather than abandoned on departure.

    Strong evidence: The Disclosure and Barring Service referral record, or the reasoned decision that the legal threshold was not met, together with evidence the investigation continued after the person left (sections 4, 10 and 12).

    Weak evidence: The concern file stops on the resignation date, with a closing line such as "left employment, no further action" or "resolved on departure" and no barring-threshold decision anywhere. Also weak where the file states the threshold was not met but never says which condition failed, so there is no way to see whether the regulated-activity removal condition and the applicable relevant-conduct, harm-test or relevant-offence condition were both considered.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Safeguarding Vulnerable Groups Act 2006, s.35 (duty to refer to DBS), including the s.35(1) limb that applies where the provider would have removed the person from regulated activity had they not resigned or otherwise left, and the s.35(4) relevant-conduct / risk-of-harm / relevant-offence conditions

  3. Safeguarding, police and urgent professional-regulator action run immediately and in parallel, not held until the internal HR or disciplinary process finishes. People can be at risk while an employment process runs its course, so these external routes are not delayed behind it.

    Strong evidence: The immediate risk assessment and the record showing the safeguarding referral was made without waiting for internal HR to complete (sections 4, 9 and 11).

    Weak evidence: A chronology in which the safeguarding referral date falls after the disciplinary hearing outcome, or an email saying the service will refer once the internal investigation concludes. Weak too where the only trace of the concern while the employment process runs is human-resources correspondence, with the risk to the people using the service recorded nowhere until the outcome letter.

    What the regulator expects to see. Not a law in itself, but CQC judges you against it, so an inspector will look for it and expect a reason where you depart from it.

  4. Immediate protective action is taken and recorded while the concern is assessed, framed as a safety measure rather than a finding of guilt. A known concern is never left with no protective control in place, so the people using the service are kept safe while the facts are established.

    Strong evidence: The immediate risk assessment and the protective-action decision recorded against the concern (sections 9 and 17).

    Weak evidence: A concern logged with no immediate risk assessment against it, or a risk assessment written up later once the paperwork was being tidied. Also weak where protective measures were agreed verbally on shift with nothing recording which duties were restricted, by whom and until when, or where the person stayed on lone working, medicines or personal care while the concern was assessed because the rota could not absorb the change.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  5. The professional regulator is informed where a registered professional no longer meets the fitness requirement, as Regulation 19(5)(b) requires. This duty stands on its own. A safeguarding referral to the local authority and a barring referral to the Disclosure and Barring Service do not discharge it, and a fitness concern such as dishonesty or practice outside competence is referred or reasoned out rather than left to human resources.

    Strong evidence: The professional-regulator referral record or the recorded rationale for not referring (section 13, against the Regulation 19(5)(b) duty to 'inform the regulator in question').

    Weak evidence: A registration number held on the staff file and nothing at all recording whether the professional regulator was told. Weak too where the file records a decision not to escalate with no reasoning set against the concern actually in hand, or where the record assumes that the local authority safeguarding referral or the Disclosure and Barring Service (DBS) barring referral has already dealt with the registration question. Weak as well where the concern plainly went to fitness to practise, such as dishonesty or practice outside competence, and the only entry is that human resources handled it.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, reg 19 (fit and proper persons employed): the duty, where an employed health care professional, social worker or other registrant no longer meets the fitness requirement, to 'inform the regulator in question'

  6. A return to duties records that the person remains fit and proper, any restrictions and who approved it, rather than an informal return once the immediate concern has passed. The safety of the people using the service depends on that decision, so a quiet return on a changed rota is not enough.

    Strong evidence: The return-to-work or removal record (outcome, fit-and-proper decision, restrictions, referrals made, who approved) and the annual audit of whether outcomes and return-to-work or removal decisions were recorded (sections 16 and 18).

    Weak evidence: The person is quietly back on the rota and the first evidence of it is a changed duty roster, with a supervision note reading "returned to normal duties" and no fit-and-proper decision, no restrictions and no named approver. The audit side is weak where the yearly review records "all concerns handled appropriately" without naming the concerns sampled or carrying a single corrective action with an owner and a due date.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

Related

Last verified 20 July 2026

Spotted something to improve?

These are sample templates, not the last word. If you would change a wording, or want to help us confirm a detail, tell us and we will look at it.

Want help adapting this to your service?

A Verivius consultant can read your adapted policy against the live regulation and your service shape. The work fits inside a Mock Inspection engagement or a shorter consulting brief. A 20-minute conversation is the fastest way to find out whether the fit is right.

Get started free

Free to start, no card. A 14-day trial when you subscribe.

Last reviewed 19 July 2026