Regulation 17: Good governance

Reg 17(1) sets the headline duty: providers must establish and operate effective systems and processes to ensure compliance with the requirements in Part 3 of the regulations (Reg 17 is, in effect, the regulation that requires the system that runs the rest of the regulations). Reg 17(2) lists six things those systems must enable in particular: assessing and improving the quality and safety of the service, assessing and mitigating the risks to service users, maintaining an accurate and contemporaneous record for each service user, maintaining accurate records of employment and management, seeking and acting on feedback, and continually evaluating the processes themselves.

Reg 17(3) gives CQC the power to require a written report on quality, safety, risks, and improvement plans on 28 days' notice. The 28-day clock starts the day after the request is made. Most providers never receive a Reg 17(3) request; the ones who do are usually those whose ratings or reports already suggest the governance system is not visible.

CQC inspects Reg 17 through the well-led key question. Inspectors expect to see a leadership team that knows what its service is doing, has a working cadence of review meetings, holds a live risk register, runs an audit programme that produces visible change, and can describe what the team learned from the last quarter without rehearsing it. The well-led question is essentially: does the leadership team know what its service is doing, and is it acting on what it knows.

The records the inspector samples are the meeting minutes, the risk register, the improvement-actions register, the clinical-audit programme, the complaints log aggregate view, the safeguarding-pattern view, the staffing-currency dashboard. Reg 17 is the regulation that ties all of them together; absent evidence on any one of them produces a Reg 17 finding even when the underlying lifecycle (incidents, complaints, etc.) is operating cleanly.

The Reg 17 patterns that surfaced repeatedly in thirteen years of CQC inspections come from the meeting trail more often than the individual registers. The most common: meetings scheduled in the policy but actually meeting four times in the last twelve months when the policy says monthly; minutes that record what was discussed but not what was decided; decisions that produced no corresponding improvement actions; standing agenda items that quietly disappeared because nothing was being found (the inspector reads the disappearance as the team stopping looking, not as the service improving); the risk register where every entry was scored eighteen months ago and not reviewed since. Each of these is a well-led finding on its own. The aggregate pattern is the rating signal. Services rated Outstanding on well-led almost always show a meeting trail where decisions get documented, actions get opened, completions get evidenced, and patterns get reviewed in the open.

Verivius drives this regulation through the risk-register lifecycle, the clinical-audit cycle, and the improvement-actions register. Governance meetings carry attendance, decisions, and cross-linked actions in the platform's governance-meeting register, so the meeting trail inspectors read is reconstructable in the platform rather than scattered across email threads and shared drives.

Sample policy template: Reg 17 Good governance. Article worth reading alongside: the governance meeting cadence that actually works.