What CQC inspectors actually look for in incident records

I spent thirteen years sampling incident records as a CQC inspector. The standard sample was five records, picked at random from the trailing twelve months. I would sit with a printout or a screen at the side of the registered manager's desk, and walk each one end to end, asking questions as I went. By the time I had read the fifth record I had a working theory of how the service handled what went wrong, which was the actual question.

I was not particularly interested in whether the recording was tidy. I was interested in whether the record was evidence of a service that learns. There is a difference and inspectors notice it almost immediately.

CQC inspectors do not read every incident record. We sample. Five records was the standard, sometimes seven on a longer inspection, occasionally as few as three on a focused visit. The sampling logic is the same that the rest of regulated life uses: a small random sample is enough to tell you whether the system is operating, because a system that operates properly produces consistent records and a system that does not produces tells in almost any sample you pick.

What we were looking at, in each record, in the order I usually read them.

First, the brief facts. What happened, when, who was present, what was the immediate response. This part was almost always present and almost always fine. Teams write the initial entry the same day or the next morning, while the event is fresh. It is the part of the record that takes the least conscious effort because the team is still inside the event.

Second, the investigation work. Two weeks after the event, sometimes three, the assigned owner is supposed to have looked into what happened. Notes from conversations with people present. Evidence attached: photographs of the scene, witness statements, equipment-fault records, related clinical observations. Findings recorded against the event. This is the part where the records start to split. Services that learn from incidents have substantial entries here. Services that do not, do not.

Third, the closure. The paragraph or paragraphs that wrap the record up: what the investigation concluded, what action will be taken, who owns the action, when it will be done. The closure paragraph is the single most diagnostic field in an incident record. If I am being honest, this is the field I read first sometimes, before I had even understood what the incident was. The closure paragraph tells me how seriously the team took the record.

Fourth, the chain to action. If the closure named an improvement action, the chain to where the action actually got delivered. The action record itself. The evidence that the action was completed. The evidence that the change to practice stuck.

Fifth, the cross-links. Did the incident also generate a statutory notification to CQC where one was required? Was the duty-of-candour conversation recorded where the harm threshold was met? Was a safeguarding concern raised where the event had a safeguarding element? The cross-links are the evidence that the team is seeing the incident in its full regulatory shape, not just as a clinical event in isolation.

Past the structural pieces, there were a handful of small signals that mattered more than people expected. These are the ones I would explain to a new inspector during their shadow period.

The temporal shape of the record. A good incident record looks like a stretched chord. Brief opening entry within 24 hours. Investigation notes accumulating over the next one to three weeks. Closure paragraph dated within four to six weeks of the original event. Action entries opened at closure and completed over the next one to three months with evidence attached. If a record was opened and closed on the same day, with no investigation notes in between, I was reading a paperwork-closure, not an investigation. If a record opened in March was still showing “under investigation” in August, I was reading a forgotten record.

The voice of the closure. Closures written in the passive voice (“learning was disseminated to the team”, “staff were reminded of the importance of”) signal that the work was paperwork. Closures that name a specific change to practice (“the local anaesthetic SOP has been revised to require a second-clinician check; circulated to the clinical team 14 March”) signal that something actually happened. I do not mean inspectors penalise the passive voice; I mean the passive voice is a tell, and we get used to reading for it.

The honesty of the harm assessment. An incident scored as low-harm where the records make clear it should have been moderate-harm is a Reg 20 problem in waiting. The duty-of-candour panel opens at moderate harm and above. A service that systematically under-scores harm at log-time is avoiding the candour conversation. Inspectors are sensitive to this; the under-scoring shows up in the sample because the harm description in the narrative does not match the harm grade in the field.

The consistency of the trail across the sample. Five records is a small sample. But five records all showing the same shape (good opening, thin investigation, paperwork closure, no action) is a consistent pattern. Five records all showing different shapes (some thorough, some thin) is a different pattern: a service where some team members care and others do not, which is its own kind of well-led concern.

Across thirteen years, four incident-record patterns recurred in services that came out with concerns or compliance actions. Three of them produced Requires-Improvement-or-worse ratings on safe or well-led directly. The fourth produced the rating indirectly, through what it implied about the broader culture.

Closure as paperwork.The closure paragraph says “no further action required” with no reasoning. The investigation notes above are thin or absent. The team has logged that they considered the event and decided nothing needed to be done, without anywhere recording what they considered or why nothing needed to be done. This is the single most common Reg 12 finding I made and the most recoverable: the work to fix it is twenty minutes per record going forward.

Actions opened, never completed. The closure paragraph names actions. The improvement-actions register shows the actions sitting at “open” four months later with no progress notes. A single overdue action is forgivable; everyone has had a quarter where the action slipped. A pattern of overdue actions across many closed incidents reads as a service where the register is decorative.

Learning that does not connect to a change.The closure names learning. The learning is “remind staff to be more careful” or “reinforce the importance of” or “refresh awareness of”. Generic learning is a tell. Specific learning names a specific change: a policy revised, a training topic added to next month's induction, a piece of equipment replaced, a checklist updated. The inspector looks for the named specific.

The duty-of-candour and notification chain missing. An incident with moderate harm and no candour panel opened. An incident with a Reg 18 trigger and no notification record spawned. These are not gentle findings. The duty-of-candour gap is a Reg 20 compliance failure; the missed notification is a Reg 18 compliance failure of the Registration Regulations. Inspectors check both at sample time and the absence shows up immediately.

The services I sampled that came out compliant on safe and well-led were not doing anything magical with their incident records. They were doing the same thing as everyone else, finishing the sentences. The opening entry happened the same day, because in a busy service the team has built the habit. The investigation notes accumulated week by week because the assigned owner had named themselves owner. The closure paragraph named what changed in two or three sentences. The actions opened from closure landed in the actions register the same week. The next month's governance meeting read the actions register against the closed incidents from the month before, and that produced the following month's agenda.

None of that is impressive in isolation. It is impressive in aggregate. A service that does that for the trailing twelve months produces a sample where every record I picked told the same story: the team noticed, the team investigated, the team decided, the team acted, the team checked it had worked. That story is what “good” reads like.

Reading incident records as an inspector taught me the shape of what good evidence looks like. Building Verivius the way I did is what that shape looks like operationally. The incident record is opened with the owner named at log-time, not assigned later. The investigation section accumulates notes against the same record, dated and named. The closure paragraph is a structured field that prompts for the change-to-practice; if you write “no further action” without reasoning the field accepts it but flags the record for second-pair-of-eyes review at the next governance meeting. The duty-of-candour panel and the Reg 18 notification check fire at log-time when the harm or trigger thresholds are met, so the cross-link is built in.

None of that turns a paperwork-closure into a substantive one. The substantive bit is still the human conversation at investigation. What the platform does is make the chain readable to a future inspector without anyone having to reconstruct it under pressure.

If you are a registered manager reading this who knows your last six months of closures would not survive a sample, the fastest fix is the same one I would suggest for the Reg 17 minutes problem. Write three good closure paragraphs this month, on the three most recent incidents you can revisit. Name the change to practice. Open the action in the register the same week. At the next governance meeting, read those three actions back. Do that for three months. The records will be a different shape by the time anyone is sampling them.

On the duty-of-candour chain that runs from incident to candour record: what does Duty of Candour actually require?. On the statutory-notifications chain that runs from incident to CQC submission: CQC notification mistakes that get providers downgraded. The Reg 12 sample policy template: Reg 12 Safe care and treatment. The incident-reporting lifecycle marketing page: /incident-reporting.