CQC Regulation 17: Good Governance Explained

Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 is the "good governance" fundamental standard, and it is one of the regulations CQC leans on hardest when things go wrong. In practice, it requires every registered provider to have effective systems and processes in place to run a safe, well-managed service — everything from how you monitor quality to how you keep records. For a broader look at what good governance means day to day, our guide to general governance principles in health and social care is a useful companion piece. This post focuses specifically on what Regulation 17 itself legally requires, how CQC assesses it, and how providers evidence compliance.

What Regulation 17 actually requires

Regulation 17(1) sets out the core obligation in plain terms: providers must establish and operate systems or processes effectively to ensure compliance with the other requirements of Part 3 of the regulations — in other words, governance is the mechanism that makes every other fundamental standard work in practice, not a standalone box to tick.

Regulation 17(2) then breaks this down into specific things a registered person must be able to do. Systems and processes must enable the provider to:

• Assess, monitor and improve the quality and safety of the services provided, including the experience of people using the service.
• Assess, monitor and mitigate risks relating to the health, safety and welfare of service users and others who may be at risk.
• Maintain securely an accurate, complete and contemporaneous record for each person using the service.
• Maintain securely such other records as are necessary in relation to staff employed and the management of the regulated activity.
• Seek and act on feedback from relevant persons — people using the service, their representatives and staff — for the purposes of continually evaluating and improving the service.
• Evaluate and improve practice in how that information is processed, stored and used, in line with data protection legislation.

Regulation 17(3) adds a further, less well-known duty: if CQC asks for a written report on how a provider is meeting these requirements, it must be supplied within 28 days, setting out how compliance is being achieved and, where relevant, an improvement plan. Notably, CQC guidance makes clear that failing to submit a report when requested can lead directly to prosecution without a prior warning notice, because delay could stop the provider taking timely corrective action.

How CQC assesses governance in practice

Regulation 17 doesn't sit in isolation from CQC's day-to-day assessment activity. Under the Single Assessment Framework, governance is primarily evidenced through the "Well-led" key question, which is built around a set of quality statements — including one specifically titled "Governance, management and sustainability." Inspectors and assessors use this quality statement, alongside others such as leadership, culture, learning and improvement, and partnership working, to judge whether a provider's systems genuinely deliver safe, effective care rather than simply existing on paper. If you want the full breakdown of how each quality statement is structured and scored, see our guide to the Single Assessment Framework quality statements. In short: Regulation 17 is the legal requirement, and Well-led (with its governance quality statement) is the lens CQC uses to assess whether that requirement is actually being met on the ground.

Why Regulation 17 is so often cited in enforcement action

Regulation 17 breaches turn up repeatedly in CQC enforcement activity, and there's a straightforward reason why: governance failures are rarely the root cause reported by inspectors in isolation — they are usually the explanation for why other problems (missed risk assessments, poor record-keeping, unaddressed complaints, weak incident follow-up) were allowed to continue unnoticed or uncorrected. A service can have one bad incident without necessarily breaching Regulation 17; but if there is no system to catch it, learn from it and stop it recurring, that absence of a functioning governance system is itself the breach. This is also why weak governance features so heavily in analyses of why providers fail CQC inspections — it tends to be the underlying factor connecting several separate concerns raised in a single report. Where CQC considers the risk to people significant, Regulation 17 breaches can lead to warning notices requiring specific, time-limited improvement, and in more serious cases to wider enforcement action.

Practical steps providers take to evidence good governance

Meeting Regulation 17 is less about a single policy document and more about demonstrable, working systems. Providers that evidence compliance well typically have:

• A clear governance structure — defined roles and reporting lines from care staff through to registered manager and, where applicable, a board or senior management team, so accountability for quality and safety is never ambiguous.
• A structured audit schedule covering medicines, care plans, health and safety, infection control and staffing, with findings recorded, actions tracked to completion and re-audited to confirm improvement.
• A functioning incident and complaints review process that doesn't just log events but analyses trends, identifies root causes and feeds lessons learned back into practice and training.
• Regular management and, where relevant, board-level oversight of quality and risk data, rather than governance information sitting unread in a folder.
• Accurate, contemporaneous record-keeping systems for care records, staff records and incident logs, kept securely and reviewed for completeness — directly reflecting the Regulation 17(2)(c) and (d) requirements.
• Active feedback loops — surveys, resident and family meetings, staff feedback channels — with evidence that feedback actually changes practice, not just that it was collected.

These systems also need to connect with the other fundamental standards a provider must meet, since governance is what ties day-to-day practice back to legal compliance across the board.

Frequently asked questions

Is Regulation 17 a fundamental standard?

Yes. Regulation 17 (Good Governance) is one of the fundamental standards set out under the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, alongside standards such as safe care and treatment, safeguarding, and staffing.

What's the difference between Regulation 17 and "Well-led"?

Regulation 17 is the legal requirement providers must meet. "Well-led" is the key question within CQC's Single Assessment Framework used to assess whether that requirement — and related aspects of leadership and culture — is being met in practice, primarily through the "Governance, management and sustainability" quality statement.

Can CQC take enforcement action for a Regulation 17 breach alone?

Yes. Where CQC identifies a breach of Regulation 17, it can issue a warning notice requiring specific improvements within a set timeframe, and in more serious circumstances can pursue further enforcement action, including where a provider fails to submit a requested compliance report within 28 days as required under Regulation 17(3).

Does Regulation 17 apply to small and home care providers, not just care homes?

Yes. Regulation 17 applies to all providers registered with CQC for a regulated activity, regardless of size or setting, though the scale and formality of the governance systems expected will reasonably reflect the size and complexity of the service.

Good governance under Regulation 17 is ultimately about proving your systems work, not just that they exist. If your team needs a structured way to build that understanding across managers and staff, Learnsignal's CPD courses for health and social care cover CQC compliance topics including governance, risk and record-keeping in more depth.