Managing CQC Risk Evidence When Door Codes and Entry Systems Restrict Movement

Door codes, keypads, fobs and controlled entry systems are often used to manage security, environmental safety and safeguarding risk. They may protect people from unauthorised visitors, unsafe exits or community harm. However, they can become restrictive when people cannot leave, enter communal areas or access outdoor space without staff permission or support.

Providers using CQC risk and safeguarding evidence should show how door controls are assessed and reviewed. A strong CQC governance and compliance framework should connect environmental safety, capacity, consent, care planning, safeguarding and least restrictive practice.

This also supports CQC quality statement evidence, because inspectors will expect providers to protect people without creating hidden restrictions on liberty.

Why this matters

Door systems can restrict movement even when staff do not intend to control people. A person may be unable to remember a code, operate a keypad, use a fob, ask for help or understand why the door is locked.

Inspectors may ask who can leave independently, who needs staff support, how restrictions are authorised and whether people are subject to unnecessary environmental control.

Strong providers evidence the purpose of each door system. They show whether controls are environmental security, individual risk management or restrictive practice requiring legal and governance review.

A practical framework for door control evidence

The framework should begin by mapping movement. Leaders should know which doors are controlled, who is affected, why controls exist and whether people can leave or access spaces independently.

Managers should then review individual impact. A keypad may be neutral for one person but restrictive for another if they cannot use it without staff assistance.

Governance should test whether controls remain proportionate. Evidence should show whether alternatives, prompts, personalised access arrangements or supported independence have been considered.

This links directly with effective CQC risk management evidence, because movement restrictions must be linked to clear risk, rationale, review and outcome evidence.

Operational example 1: A person cannot leave because they do not know the door code

The baseline issue is that a person repeatedly asked staff to open the front door because they did not know the code, but records did not show whether this restricted liberty. The measurable improvement is 100% review of door-code impact within eight weeks, evidenced through care records, access reviews, audits, feedback and staff practice.

Five-step operational response

1. The deputy manager reviews front-door access records and staff handover notes, then records who needs staff assistance, why support is needed and how often requests occur in the access tracker.
2. The key worker discusses leaving routines with the person using their preferred communication method, then records wishes, confidence, understanding and preferred access support in care documentation.
3. The registered manager reviews capacity, safeguarding risk and liberty impact, then records whether the door code is environmental security or individual restriction requiring further review.
4. Support staff follow the agreed access plan, then record requests to leave, response time, staff support, refusals and any distress in daily notes.
5. The quality lead audits door-access evidence monthly, then records whether people can move freely or whether restrictions require escalation.

What can go wrong is that staff see door assistance as routine rather than restriction. Early warning signs include repeated requests, waiting at exits, distress, staff delays and no individual access plan. The registered manager reviews liberty impact, while the key worker identifies practical support. Consistency is maintained by recording access requests as movement evidence, not casual interaction.

The audit reviews daily notes, access records, care plans, capacity evidence and feedback. The quality lead reviews monthly, and the registered manager reviews liberty-related themes. Action is triggered by repeated staff-dependent exits, distress, unexplained delays, missing capacity evidence or people being unable to leave without review.

Operational example 2: Door controls are used after night-time wandering

The baseline issue is that door controls were tightened after night-time wandering, but the provider did not evidence whether this was proportionate or time-limited. The measurable improvement is reviewed and least restrictive night access control within twelve weeks, evidenced through night notes, risk assessments, audits and staff practice.

Five-step operational response

1. The night lead reviews night movement records and door alerts, then records timing, route, risk indicators and staff response in the night access review file.
2. The registered manager reviews falls, capacity, consent and environmental safety evidence, then records whether door restriction is necessary, proportionate and subject to review.
3. The key worker explores reasons for night movement with the person, then records comfort needs, routines, pain indicators and preferred reassurance in care documentation.
4. Night staff use agreed least restrictive support before limiting access, then record reassurance, environmental checks, movement patterns and outcomes in night notes.
5. The safeguarding lead reviews night access controls fortnightly, then records whether controls can reduce or require legal, clinical or safeguarding advice.

What can go wrong is that night risk creates a locked-door response without exploring why the person is moving. Early warning signs include agitation at doors, poor sleep, repeated alerts, staff uncertainty and no review date. The key worker identifies unmet needs, while the safeguarding lead checks whether restriction is emerging. Consistency is maintained by linking door controls to night-time wellbeing evidence.

The audit reviews night notes, alert records, risk assessments, care plan updates and staff explanations. The safeguarding lead reviews fortnightly during active concern, and the registered manager reviews monthly themes. Action is triggered by distress, repeated door attempts, falls risk, unclear rationale, absence of consent evidence or restriction continuing without reduction review.

Where a person understands community risk and wishes to leave independently, providers should consider positive risk-taking in adult social care. Inspectors will expect providers to avoid blanket controls where supported independence can manage risk proportionately.

Operational example 3: Garden access depends on staff holding the fob

The baseline issue is that people could only access the garden when staff held the fob, reducing spontaneous outdoor time and creating informal restriction. The measurable improvement is 90% improved access to outdoor space within twelve weeks, evidenced through activity records, care notes, audits, feedback and staff practice checks.

Five-step operational response

1. The activity coordinator reviews garden access records and feedback, then records missed opportunities, staff-dependent access and affected people in the outdoor access tracker.
2. The registered manager reviews environmental safety and individual risk, then records whether independent, supported or supervised garden access is appropriate for each person.
3. Key workers discuss outdoor routines with people affected, then record preferences, mobility support needs, risks and agreed access arrangements in care documentation.
4. Support staff follow agreed garden access arrangements, then record outdoor time, support provided, refusals, incidents and wellbeing outcomes in daily notes.
5. The quality lead audits outdoor access monthly, then records whether access is ordinary, safe and not unnecessarily controlled by staff availability.

What can go wrong is that outdoor access becomes dependent on staffing convenience rather than assessed need. Early warning signs include people waiting for staff, reduced outdoor activity, complaints, low mood and no access timetable. The registered manager reviews environmental safety, while key workers evidence preferences. Consistency is maintained by auditing access to outdoor space as quality-of-life evidence.

The audit reviews activity records, care notes, feedback, risk assessments and staff practice. The activity coordinator reviews monthly, and the registered manager reviews access themes. Action is triggered by reduced outdoor access, staff-dependent restrictions, distress, avoidable isolation or evidence that fob control limits ordinary movement.

Commissioner expectation

Commissioners expect providers to manage door systems transparently. They may ask whether controlled entry is for environmental safety, individual protection or restrictive practice.

A credible update explains the door control, who is affected, the risk being managed, consent or capacity evidence, alternatives considered and review outcome. It should include access records, care plans, risk assessments, incident logs, audits, feedback and provider oversight.

Commissioners may be concerned where door systems are normalised without individual review. Strong providers show that movement, access and independence are actively considered.

Regulator and inspector expectation

Inspectors expect providers to recognise environmental restrictions. They may ask whether people can leave freely, access outdoor areas, move around the service and understand any controls in place.

If door codes restrict people without evidence, inspectors may question whether liberty and rights are protected. If records show rationale, impact review and least restrictive planning, assurance is stronger.

Strong providers can explain how door systems protect safety without creating hidden blanket restrictions.

Conclusion

Managing CQC risk evidence when door codes and entry systems restrict movement requires providers to look beyond the physical door. The issue is whether people experience the system as security, support or restriction. That depends on capacity, access, staff response, alternatives and review.

Outcomes are evidenced through care records, access logs, risk assessments, capacity evidence, incident reports, audits, feedback and provider oversight. These sources should show whether people can move freely, whether risk is managed and whether restrictions are reduced where possible.

Consistency is maintained when managers regularly review controlled doors through safeguarding, rights and quality governance. This gives commissioners, regulators and inspectors confidence that environmental controls are safe, lawful, proportionate and not allowed to become hidden restrictions on ordinary life.

---