Sample policy · Reg 17

Whistleblowing and Raising Concerns Policy

Statutory anchor: Public Interest Disclosure Act 1998 and Employment Rights Act 1996 (whistleblowing protections in employment law). This policy also engages Regulation 17 (good governance), Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (SI 2014/2936). · primary source

Download the PDF

The PDF version of this template is the same content, formatted for adaptation in your document control system. The disclaimer above is repeated on the PDF cover.

Download PDFTalk to a consultant

Verivius pack version v1.1, 2026-07-19

1. What the regulation says

The whistleblowing protections that underpin this policy come from the Public Interest Disclosure Act 1998 and the Employment Rights Act 1996. The CQC regulation this policy operationalises is Regulation 17 (good governance):

Systems or processes must be established and operated effectively to ensure compliance with the requirements in this Part. (Reg 17(1): the umbrella duty)

assess, monitor and improve the quality and safety of the services provided in the carrying on of the regulated activity (including the quality of the experience of service users in receiving those services) ... assess, monitor and mitigate the risks relating to the health, safety and welfare of service users and others who may be at risk which arise from the carrying on of the regulated activity. (Reg 17(2)(a) and (b): quality and risk)

The full text of the regulation is at https://www.legislation.gov.uk/uksi/2014/2936/regulation/17. Where this policy and the regulation diverge, the regulation wins.

2. Plain-English summary

You have to run effective systems and processes to comply with everything else in Part 3. The regulation lists six things those systems must enable in particular: quality assessment and improvement, risk management, accurate service-user records, accurate employment and management records, seeking and acting on feedback, and continually evaluating and improving how you process all this. A safe, well-understood route for people to raise concerns about unsafe, unlawful or poor practice, with protection from victimisation, is part of how a service evidences good governance, surfaces risk early, and meets its whistleblowing duties under employment law.

3. Purpose

The purpose of this policy is to make sure that people working in or with [Service Name] can raise concerns about unsafe, unlawful, dishonest or poor practice without fear of victimisation.

The service wants concerns to be raised early, listened to properly and acted on. Speaking up is part of safe care and good governance.

This policy supports Regulation 17 good governance, Regulation 12 safe care and treatment, safeguarding duties, the duty to protect people from abuse and improper treatment, and whistleblowing protections under employment law.

4. Policy warning

No person must be bullied, threatened, victimised, dismissed, disadvantaged, ignored or treated unfavourably because they raised a genuine concern.

A manager who suppresses, ignores or retaliates against a concern may be subject to disciplinary action.

A concern about abuse, neglect, unsafe care or criminal conduct must not be treated as an ordinary grievance only. It must be assessed for safeguarding, regulatory, professional or police escalation.

5. Scope

This policy covers concerns about:

This policy is not intended to replace the grievance procedure for personal employment complaints, unless the issue also raises wider public-interest, safety, legal or governance concerns.

5.1 Local routes before adoption

Before adoption, the service publishes:

Unless the service adopts a stricter target, immediate-risk concerns are triaged on receipt, other concerns are acknowledged within 2 working days, the reporter receives a handling update within 10 working days and further updates at least every 20 working days while the matter remains open. These are service standards, not statutory deadlines.

6. What is whistleblowing?

Whistleblowing is raising a concern about wrongdoing, risk or malpractice that affects others or the public interest.

A protected disclosure may relate to:

The person raising the concern does not need to prove the concern before speaking up. They must raise it honestly and with a reasonable belief that the information tends to show wrongdoing or risk.

7. Principles

The service will:

7.1 Roles and responsibilities

8. Internal reporting workflow

  1. Receive and protect: listen, identify immediate danger and take urgent safeguarding, clinical or emergency action first.
  2. Record and acknowledge: create a restricted record, confirm what was understood and explain confidentiality limits and next contact.
  3. Triage: separate whistleblowing, grievance, complaint, safeguarding, conduct and criminal routes without allowing one label to block another necessary response.
  4. Assign safely: appoint a conflict-free decision-maker or escalate outside the normal management line.
  5. Investigate and update: preserve evidence, take proportionate steps and keep the reporter informed without disclosing other people's confidential information.
  6. Decide and act: record findings, referrals, protective measures and improvement actions, including any retaliation concern.
  7. Close and learn: give appropriate closure feedback, test completed actions and review themes through governance without exposing the reporter's identity.

A concern may be raised with:

Concerns may be raised verbally or in writing.

Where the concern is raised verbally, the manager receiving it must make a written record and check that the record is accurate.

9. Anonymous concerns

The service will consider anonymous concerns.

Anonymous concerns may be harder to investigate, but they must not be ignored.

The manager must assess:

10. Confidentiality

The service will keep the identity of the person raising the concern confidential as far as reasonably possible.

Confidentiality cannot be guaranteed where disclosure is necessary to protect people, comply with legal duties, investigate properly, or cooperate with safeguarding, police, CQC or professional-regulator processes.

The person raising the concern should be told if their identity may need to be disclosed, unless doing so would increase risk or compromise an investigation.

11. Immediate action

Where a concern suggests that people using the service may be at immediate risk, the manager must act without delay.

Immediate action may include:

Immediate action must be recorded.

12. Investigation

The Registered Manager or another suitable senior person must decide how the concern will be investigated.

The investigation must be proportionate to the concern and may include:

Where the Registered Manager is implicated, the concern must be escalated to the Nominated Individual, provider representative or external body.

13. External reporting

The service recognises that staff may raise concerns externally where appropriate.

External bodies may include:

Staff do not have to raise concerns internally first where they reasonably believe external reporting is appropriate.

14. Protection from victimisation

The service will not tolerate victimisation of a person who raises a concern.

Victimisation may include:

Any allegation of victimisation must be investigated and may result in disciplinary action.

15. Malicious or knowingly false allegations

The service recognises that most concerns are raised in good faith.

Where a person knowingly makes a false allegation maliciously, the service may take action under the conduct policy.

A concern that is not substantiated is not the same as a malicious concern.

16. Feedback to the person raising the concern

Where possible, the service will tell the person raising the concern:

The service may not be able to share confidential information about other people or employment action.

17. Records

The service must keep records of:

Records must be stored securely.

18. Learning and governance

The Registered Manager must review concerns for learning.

The review must consider:

Whistleblowing themes must be reviewed through governance without identifying individuals unnecessarily.

19. Staff training

Staff must be told how to raise concerns during induction and through periodic refresher training.

Training must cover:

Managers must be trained in how to receive and act on concerns.

20. Related policies

This policy should be read with:

21. Audit

The Registered Manager must review the use and effectiveness of this policy at least annually.

The review must consider:

22. Review

This policy will be reviewed annually, or sooner following a serious concern, safeguarding matter, CQC finding, staff survey result, employment-law change, or evidence that staff do not feel safe to speak up.

23. Sources and further reading

This template is based on CQC's guidance for providers and managers, the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, and other topic-specific legislation and guidance listed below. It is a starting point for adaptation, not a substitute for legal, clinical, HR, safeguarding or specialist professional advice.

24. When to seek further advice

Seek specialist advice where the issue involves serious harm, safeguarding, deprivation of liberty, restraint, children, professional misconduct, controlled drugs, radiation, termination of pregnancy, infection outbreak, water safety, employment dismissal, DBS barring referral, or regulatory enforcement.

25. Document control

Version Date Author Changes
v1 2026-06-10 Verivius (sample) Initial sample template, conformed to the Verivius policy standard.
v1.1 2026-07-19 Verivius (sample) Updated the protected-disclosure examples and added local routes, named ownership and a timed handling workflow.

This sample policy template was issued by Verivius. It is a template, not a substitute for legal advice or the provider's own policy-development process. Where this template and live law or regulator guidance diverge, the live source wins.

What good looks like here

Written from an ex-CQC inspector's chair, but the point is safe, well-led care your team can stand behind. Each row shows what strong evidence looks like, what thin evidence looks like, and where the expectation comes from.

The concerns that are hardest to raise in a small independent service are the ones about the person who runs it. Where a single Registered Manager holds the rota, the appraisals and the references, a care worker who has seen rough handling weighs all of that before speaking, and an escalation route that runs back through the implicated person means the concern is simply never raised. The second risk is quieter. A disclosure about a concealed medicine error or an unsafe restraint gets labelled a staff grievance, travels into a personnel file, and never reaches the local authority safeguarding team or the Care Quality Commission, so the person at the centre of it stays in the same worker's care while the paperwork looks tidy. Staff also read very carefully what happens to the first colleague who speaks up, and if that person quietly loses shifts or is frozen out, the next concern arrives months later, usually after someone has already been harmed. A named alternative route, an honest triage decision recorded when the concern is received, and visible proof that speaking up changed something are what keep small warning signs arriving while they are still small.

  1. A concern that is really about abuse, neglect or unsafe care is triaged into safeguarding, regulatory, professional or police routes, not logged and handled as an ordinary grievance. One label given to it does not block another response that the person's safety needs.

    Strong evidence: The restricted concern record showing the triage, the risk assessment and any immediate action, safeguarding referral or CQC notification taken (sections 8, 11 and 17).

    Weak evidence: The concern sits in the human resources folder as "staff attitude on nights", closed with a line saying the worker was spoken to, and nothing records whether abuse, neglect or unsafe care was ever considered. There is no restricted concern record, no risk assessment of the people who were in that worker's care, and no separate decision against each external route, so the file cannot show whether the local authority safeguarding threshold was tested, whether a statutory notification to the Care Quality Commission was due, or whether the police or a professional regulator should have been told. The only paperwork is a management or disciplinary outcome.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, reg 13(3); Care Quality Commission (Registration) Regulations 2009, reg 18(2)(e)

  2. There is a usable route to raise a concern when the line manager, Registered Manager or owner is the subject, not an escalation that runs back through the implicated person. The alternative route and the out-of-hours route both work in practice for the worker who needs them.

    Strong evidence: The published named internal recipients and alternative route, plus the recorded escalation to the Nominated Individual or provider where the Registered Manager is implicated (sections 5.1 and 12).

    Weak evidence: The policy tells staff to go to their line manager and then the Registered Manager, and the alternative route is a generic line such as "contact head office" with no name, no number and no hours. Ask a bank or agency worker who they would ring at nine on a Sunday evening about the manager and nobody can answer, nothing shows the Nominated Individual has ever received a concern, and every escalation in the file was in fact handled by the person the concern was about.

    What the regulator expects to see. Not a law in itself, but CQC judges you against it, so an inspector will look for it and expect a reason where you depart from it.

  3. Where someone who raised a concern later suffered detriment, that detriment is investigated, not just answered with a policy that promises protection. Real protection from victimisation is what lets the next person feel safe to speak up.

    Strong evidence: The route for reporting and investigating suspected retaliation, and the annual audit line on whether any person reported victimisation (sections 5.1, 14 and 21).

    Weak evidence: There is a firm paragraph promising no detriment and not a single record ever created under it, while the annual audit line reads "no victimisation reported" year after year with nothing behind the words. The reporter's hours dropped, they were moved to nights, or colleagues stopped speaking to them soon after the concern, and nothing on file shows that anyone asked whether the treatment and the disclosure were connected, or who decided that they were not.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Employment Rights Act 1996, s.47B (with s.43B protected disclosure; s.103A on dismissal)

  4. The reporter is acknowledged, updated and told the outcome at the service's own stated targets, not left in silence. Someone who spoke up hears back, rather than their concern going unanswered.

    Strong evidence: Records of the feedback provided and the response-time review in the annual audit (sections 16, 17 and 21).

    Weak evidence: The concern log shows a date received and a date closed with an empty middle: no acknowledgement recorded, no handling update, no closure feedback, and no note of what the reporter was told or why something could not be shared. The service has published its own acknowledgement and update targets but the annual audit never measures response times against them, so the only evidence that the reporter heard anything is the manager's memory.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  5. Concerns are reviewed for themes through governance and lead to learning or action, not filed and forgotten. When the same worry comes up more than once, something actually changes as a result.

    Strong evidence: The learning and governance review of whistleblowing themes and any resulting risk-register or action-plan update (sections 18 and 21).

    Weak evidence: Governance minutes carry a single count such as "three concerns raised, all closed", with no theme named, no link to the risk register and no action owner. The same worry about staffing levels or medicines appears in three separate concern records across the year, each investigated in isolation and each closed as unsubstantiated, and nothing in the training plan, the rota or the risk register changed as a result.

    What the regulator expects to see. Not a law in itself, but CQC judges you against it, so an inspector will look for it and expect a reason where you depart from it.

  6. An anonymous concern is assessed for seriousness and risk rather than dismissed because no name was attached. A real risk to someone using the service is followed up even when the person who raised it stayed anonymous.

    Strong evidence: The manager's recorded assessment of an anonymous concern covering seriousness, risk to people, whether there is enough to investigate and whether protective or external reporting action is needed (section 9).

    Weak evidence: An unsigned note or an anonymous message sits on file annotated "no name given, unable to action", and there the trail ends. Nothing records whether the manager weighed how serious the allegation was, whether anyone using the service was at risk, whether there was enough detail to look into it, or whether protective action, a safeguarding referral or another external report was needed before the matter was set aside.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

Related

Last verified 20 July 2026

Spotted something to improve?

These are sample templates, not the last word. If you would change a wording, or want to help us confirm a detail, tell us and we will look at it.

Related Verivius content

Want help adapting this to your service?

A Verivius consultant can read your adapted policy against the live regulation and your service shape. The work fits inside a Mock Inspection engagement or a shorter consulting brief. A 20-minute conversation is the fastest way to find out whether the fit is right.

Get started free

Free to start, no card. A 14-day trial when you subscribe.

Last reviewed 19 July 2026