How Providers Can Evidence That CQC Assurance Checks Are Finding the Right Risks

Assurance checks should help providers find the risks that matter most to people’s safety, experience and outcomes. CQC may not be reassured by checks that are frequent but superficial, or by audits that repeatedly confirm compliance while other evidence shows unresolved issues. For wider context, see our CQC evidence and assurance guidance, CQC quality statements resources and CQC compliance knowledge hub.

Strong providers can show that assurance checks are targeted. They explain why a check was completed, what risk it tested, what was found and how leaders acted on the result.

Why this matters

This matters because assurance activity can create false confidence if it does not test the right risks. A completed audit may look positive while staff practice, care records or feedback show a different picture.

It also matters because CQC and commissioners expect providers to understand their own risk profile. Assurance should focus on current service pressure, known weaknesses, changing needs and areas where people could be harmed or poorly supported.

Clear framework for risk-focused assurance

The first requirement is risk selection. Providers should show why each assurance check matters and which quality, safety or experience risk it is testing.

The second requirement is evidence comparison. Findings should be checked against care records, audits, feedback and staff practice. This reflects what good evidence looks like under CQC’s assurance expectations, because good evidence is strongest when different sources support the same conclusion.

The third requirement is responsive action. Assurance should lead to operational change when risk is found, not simply a completed checklist.

Operational example 1: Assurance checks target risks in high-dependency support

Step 1: The Quality Lead reviews dependency changes, care records and recent incidents, records the priority risk area in the high-dependency assurance tracker, then identifies which people need focused assurance checks.

Step 2: The Registered Manager compares dependency evidence with staffing and equipment records, records the findings in the risk assurance note, then confirms whether current controls match people’s needs.

Step 3: The Deputy Manager observes support for people with higher dependency, records staff actions in the validation sheet, then checks whether care is delivered safely and consistently.

Step 4: The Team Leader updates staff on any changed dependency controls, records the briefing in the shift communication log, then checks that staff apply the controls during support.

Step 5: The Registered Manager reviews high-dependency assurance at governance meeting, records the judgement in the assurance summary, then escalates if controls, staffing or equipment remain insufficient.

What can go wrong is that assurance checks focus on general care-plan completion rather than the people whose needs have changed most. Early warning signs include delayed equipment requests, staff uncertainty and incidents linked to changed dependency. Escalation may involve urgent care review, senior staffing support or professional input. Consistency is maintained by directing checks towards the highest current risk.

Governance should audit dependency changes, staffing alignment, equipment availability and observed practice. The Registered Manager reviews monthly, senior leaders review quarterly, and action is triggered by unmet dependency needs, unsafe variation or repeated incidents. The baseline issue is assurance not targeted at changing dependency. Measurable improvement includes safer support, better equipment control and clearer staff confidence. Evidence sources include care records, audits, feedback and staff practice.

Operational example 2: Assurance checks test whether night-time risks are visible

Step 1: The Quality Lead reviews night records, falls data and call-bell activity, records night-time risk themes in the assurance tracker, then identifies whether routine checks miss risks outside office hours.

Step 2: The Registered Manager compares night-time evidence with staffing and handover records, records the analysis in the governance note, then decides whether night assurance needs additional validation.

Step 3: The Deputy Manager samples night-shift records and speaks with night staff, records findings in the validation sheet, then confirms whether risks are escalated and recorded clearly.

Step 4: The Night Team Leader reviews identified risks with staff, records agreed actions in the night shift log, then checks that escalation routes are followed during the shift.

Step 5: The Registered Manager reviews night assurance evidence at governance meeting, records the current risk judgement, then escalates if night evidence remains weaker than day evidence.

What can go wrong is that assurance systems rely heavily on daytime checks and miss night-time variation. Early warning signs include sparse night notes, repeated early morning incidents and night staff uncertainty about escalation. Escalation may involve night observation, revised handover or additional senior oversight. Consistency is maintained by testing quality across the full operating period.

Governance should audit night records, incident timing, handover quality and staff feedback. The Registered Manager reviews monthly, senior leaders review quarterly, and action is triggered by weak night evidence, repeated incidents or unclear escalation. The baseline issue is limited assurance of night-time risk. Measurable improvement includes stronger night records, clearer escalation and fewer avoidable night-time incidents. Evidence sources include care records, audits, feedback and staff practice.

Operational example 3: Assurance checks identify risks hidden behind positive feedback

Step 1: The Quality Lead reviews compliments, surveys and informal feedback, records positive themes in the assurance log, then checks whether any groups or services are underrepresented.

Step 2: The Registered Manager compares feedback with complaints, reviews and care records, records the findings in the experience assurance note, then identifies whether positive feedback is masking gaps.

Step 3: The Deputy Manager gathers targeted feedback from less-heard people or representatives, records responses in the validation sheet, then confirms whether the original feedback picture is balanced.

Step 4: The Team Leader follows up any newly identified concern, records action in the local improvement log, then confirms that the person receives a clear response.

Step 5: The Registered Manager reviews feedback assurance at governance meeting, records the balanced evidence judgement, then escalates if underrepresented voices reveal repeated concerns.

What can go wrong is that providers rely on positive feedback without testing who is missing from the evidence. Early warning signs include repeated responses from the same families, limited feedback from people with communication needs and unresolved informal concerns. Escalation may involve advocacy support, accessible engagement or targeted review. Consistency is maintained by checking feedback coverage, not only feedback positivity.

Governance should audit feedback representation, complaint themes, review evidence and action follow-up. The Registered Manager reviews monthly, senior leaders review quarterly, and action is triggered by narrow feedback, repeated gaps or weak evidence of response. The baseline issue is assurance over-reliant on positive feedback. Measurable improvement includes broader participation, clearer concern resolution and stronger experience evidence. Evidence sources include care records, audits, feedback and staff practice.

Commissioner expectation

Commissioners expect assurance checks to focus on the risks most likely to affect people and service reliability. They look for providers that understand where quality could fail and can show how those areas are monitored.

They also expect assurance to change when risks change. A static audit schedule may not be enough if dependency, workforce pressure, complaints or incidents are shifting.

Regulator / Inspector expectation

CQC assessors expect assurance checks to find meaningful risks. They may compare audit findings with records, feedback, staff accounts and incidents to see whether the provider’s checks are identifying the right issues.

Inspectors usually gain confidence when assurance is targeted and responsive. They lose confidence when checks are completed but obvious risks remain unidentified or unexplained.

Conclusion

CQC assurance is strongest when it finds the right risks. Providers should avoid relying only on routine checks that confirm activity. Instead, assurance should test current pressure points, changing needs, hidden variation and areas where people’s safety or experience may be affected.

Governance gives this work structure. Assurance trackers, risk notes, validation sheets, shift logs and feedback records should show why checks were chosen, what they found and how leaders acted. Outcomes are evidenced through safer high-dependency support, stronger night-time assurance, broader feedback and clearer staff practice.

Consistency is maintained when every assurance check follows the same route: identify the risk, gather current evidence, test live practice, act on gaps and review whether the risk has reduced. That helps providers show CQC that assurance is not just frequent, but focused on what matters most.

---