CQC & Governance — Partners Playbook

1. Where CQC is now (July 2026)

If your mental model of CQC is the pre-2023 inspection visit — the phone call, the frantic fortnight, the team in the meeting room — it is out of date. If your mental model is the single assessment framework that replaced it, that is out of date too. Here is the honest picture.

From November 2023

The single assessment framework rolls out in phases — the South first, all regions by early 2024. One framework for all sectors, quality statements, evidence categories, and rolling assessment instead of the familiar inspection visit.

2024

The Dash review finds significant failings in how CQC operates — interim findings in July 2024, the full report in October. Wes Streeting, then Health Secretary, calls the regulator “not fit for purpose”. Routine GP assessment activity falls away while CQC rebuilds.

2025

Rebuild year, with turbulence at the top: Sir Julian Hartley, chief executive from December 2024, steps down in October 2025, and Dr Arun Chopra steps in as interim chief executive. Very little routine assessment in general practice; many practices still hold ratings from years-old inspections.

June 2026

A new assessment framework designed for GP practices pilots from June to October 2026, with implementation planned from the end of 2026 (CQC update). This is where we are now.

To come

Implementation from the end of 2026. How the rollout will be phased, the ratings approach, and how often practices will be assessed are not yet settled.

What is actually settled

CQC is piloting a new assessment framework for GP practices from June to October 2026, with implementation planned from the end of 2026 — that much is published by CQC itself.
Your registration duties have not changed: registered provider, registered manager, statutory notifications, and the regulations underneath them all still apply.
The five key questions — safe, effective, caring, responsive, well-led — remain the shape of how quality is judged.

What is not settled

How the rollout from the end of 2026 will be phased across practices.
How ratings will work under it — including what happens to the rating your practice currently holds.
How often practices will be assessed, and in what depth.

We are not going to pretend otherwise, and you should be wary of anyone who does. Some compliance products are already selling certainty about a framework that is still in pilot.

The anti-panic principle

Every framework CQC has ever used asks versions of the same questions: is care safe, do you learn when things go wrong, and do the leaders actually lead? Evidence habits built around those questions survive framework changes. Chasing each new framework document does not — and is exhausting. Build the habits in sections 3 and 4, then let the framework come to you.

2. Who is accountable for what

Three registration roles cause most of the confusion. Two of them probably apply to your practice; one probably does not.

The accountability map for a GP partnership
Role	Who it usually is in a GP partnership	What CQC holds them to
Registered provider	The partnership itself — all partners jointly, named on the registration	Legal responsibility for meeting the regulations. The registration is in the partnership’s name, so a change of partners is a change of provider.
Registered manager	A partner or the practice manager	Day-to-day management of the regulated activities. Must be assessed as fit for the role, and is usually interviewed at assessment.
Nominated individual	Only applies where the provider is an organisation (for example, a limited company). Most GP partnerships do not have one.	Supervising the management of the regulated activity on the organisation’s behalf.

The point partners miss

In a partnership, the partners are the provider. Registration is not something the practice manager holds on your behalf — the legal responsibility for meeting the regulations sits with the partnership, which means with you. A registered manager runs the regulated activities day to day, but appointing one does not transfer the provider's accountability anywhere.

The registered manager can be a partner or the practice manager. Either works. What does not work is nobody being sure who it is — check your certificate of registration today if you have any doubt, and check the statement of purpose still describes the practice you actually run.

When partners join or leave

Because the partnership is the provider, a change of partners is a change to the registration itself — not an administrative footnote. It needs notifying in good time, alongside the PCSE and contractual steps. The full sequence, including timescales, lives in our Partner Exits guide — we will not repeat it here.

Statutory notifications are separate

Beyond registration changes, providers must notify CQC without delay about certain events — including some deaths, serious injuries, and incidents that stop the service operating safely. These are separate from NHS incident reporting. Make sure your significant-event process includes the question "does this need a CQC notification?" — that one line in a template closes a common gap.

3. Evidence as a habit, not panic prep

The practices that find assessment easy are not the ones with the biggest policy libraries. They are the ones where the evidence already exists because the work is actually being done and recorded as it happens. The eight areas below are organised by what assessors reliably probe in general practice. Each has a self-check — your progress saves in your browser, so you can work through them over weeks, not in one sitting.

How to use these checklists

Not as a pre-assessment cram. Pick one area a fortnight, give it to the right person, and fix what you find. Two unticked boxes you know about and are fixing is a stronger position than eight ticks nobody has verified.

3.1 Safeguarding

Assessors probe whether safeguarding is a living system: who leads, who is trained, whether vulnerable patients are visible in your records, and whether concerns move.

Named safeguarding leads, with deputiesOne lead for children, one for adults (can be the same person), each with a deputy. Everyone in the building — including reception — knows who they are.
Training at the right level for each roleRecords in one place, mapped to the intercollegiate guidance for each role. Know which staff need which level, and chase gaps before they age.
Vulnerable patients coded consistentlyChildren with plans, adults at risk, looked-after children — coded so a search actually finds them. An uncoded register is invisible at assessment and in real life.
Regular safeguarding meetings, minutedA standing practice meeting item or a dedicated meeting — with health visitors or school nurses where you can get them. Minutes show cases discussed and actions taken.
Policy current, findable, and usable out of hoursStaff can find the policy and it tells them how to refer — including evenings and weekends. A policy no one can locate is the same as no policy.

3.2 Significant events and learning culture

The question behind the question is always the same: when something goes wrong here, does anything change?

A live significant-event logEvents recorded as they happen, not reconstructed later. Near misses count — a practice that only logs disasters is not looking hard enough.
Every event discussed at a recorded meetingMinutes show who was there, what was decided, and who owns each action with a date. Blame-free in tone — the point is the system, not the person.
The learning loop closedEvidence that something changed: a protocol amended, a template updated, a rota adjusted. “Discussed, no action” every time is a red flag to an assessor.
Duty of candour applied where the threshold is metWhere a notifiable safety incident has occurred: a prompt apology, an explanation, and a record of both. Saying sorry is required, not risky.
Themes reviewed at least annuallyStep back once a year: are events clustering around prescribing, results handling, communication? Patterns are where the real learning lives.

3.3 Complaints handling

Complaints are probed less for volume than for process and learning. A practice with zero complaints looks implausible; a practice with complaints and a working loop looks honest.

Complaints lead named, process visible to patientsOn the website and in the waiting room. Patients should not need to ask how to complain.
Acknowledgement within three working daysThe NHS complaints regulations require acknowledgement within three working days of receipt. Build it into the workflow so it happens without heroics.
Responses signpost the OmbudsmanEvery final response tells the complainant they can go to the Parliamentary and Health Service Ombudsman if unsatisfied. Standard paragraph, every time.
Verbal complaints captured tooThe grumble at reception that was resolved on the spot still goes in the log. It feeds the themes and shows the practice listens.
Complaints feed the same learning loopReviewed alongside significant events at least annually. Themes discussed at a partners’ meeting, with minutes to show it.

3.4 Medicines management

The most consistently examined clinical area in general practice — and within it, high-risk drug monitoring is the classic finding. If you only have energy for one checklist this month, make it this one.

High-risk drug monitoring searches, run on a scheduleDMARDs, lithium, warfarin, amiodarone and the rest: regular searches for overdue monitoring, an owner for the overdue list, and evidence it shrinks. This is one of the most reliably probed areas in general practice.
Repeat prescribing protocol that matches realityWho authorises, reauthorisation intervals, medication review recalls, and how unmatched requests are handled. If the written protocol and actual practice differ, fix one of them.
Safety alerts received, actioned, and recordedMHRA and CAS alerts land with a named person, relevant patients are searched for, action is recorded. An assessor may pick a recent alert and ask what you did.
Cold chain under controlFridge temperatures logged each working day, a breach protocol staff actually follow, and calibrated thermometers. Vaccine incidents are expensive in every sense.
Emergency drugs and equipment checked on scheduleIn date, complete, checks documented — and a written risk assessment for any item you have decided not to stock. Not stocking something can be defensible; not deciding is not.
Controlled drugs governance in orderStandard operating procedures, register and balance checks if you hold CDs, and destruction arrangements. Small volumes in most practices — but a classic file-and-forget area.
PGDs and PSDs in date and signedWhere nurses or pharmacists work under patient group directions: current versions, individually signed, with training recorded.

3.5 Infection prevention and control

IPC evidence is mostly about logs and closed actions — dull, cheap, and entirely within your control.

Named IPC lead with time to do the jobA lead in name only is worse than none — it looks like assurance without being any.
Annual IPC audit with actions closedThe audit is the easy half. The evidence that matters is the action list from last year’s audit, completed and signed off.
Cleaning schedules and logsClinical rooms, curtains, toys, couches — schedules that say what, how often, by whom, with logs to match.
Sharps and clinical waste handled properlyBins labelled, dated, not overfilled, stored securely; waste consignment notes retained.
Staff immunisation status recordedHepatitis B status for exposure-prone roles, and a record of what is held for whom. Occupational health records count — you just need to know where they are.

3.6 Staff files, DBS and training records

Staff files are where assessments are lost on paperwork alone, because sampling is easy and gaps are unambiguous. The fix is standardisation, not effort.

One checklist, every file the sameA single front-sheet checklist per file covering the recruitment records the regulations require. If files differ, an assessor will find the weakest one.
DBS decisions risk-assessed per roleCQC does not require a DBS check for every member of staff — it expects a defensible, risk-assessed decision for each role, documented. See the GP mythbusters before you pay for checks nobody needs.
Professional registration and indemnity checkedGMC, NMC and other registrations verified at induction and re-checked annually, with indemnity confirmed. Two minutes per clinician per year.
A training matrix the whole team appears onMandatory training in one grid — everyone, including partners. Gaps visible and chased. Partners who are exempt-in-practice from their own training matrix set the tone, and not in a good way.
Appraisals for all staff, not just cliniciansReception and admin included. An appraisal system that stops at the clinical team suggests the practice does not see the whole team as the service.
Employment history gaps exploredReferences taken, gaps in history asked about and the answer noted. It is the asking and recording that matters.
Locums and temporary staff assured proportionatelyID, registration, indemnity — held by you or verifiably by the agency. “The agency deals with it” needs to be checkable, not assumed.

3.7 Health, safety and premises

Premises evidence is a stack of dated documents: risk assessments, test logs, service certificates. Assemble the stack once, then maintain it.

Premises risk assessment reviewed on scheduleA general risk assessment that reflects the building you actually occupy, reviewed at a stated interval — not the one from the previous decade.
Fire safety currentFire risk assessment, alarm tests logged, drills done and recorded, extinguishers serviced. Dates on everything.
Legionella risk assessed and monitoredA risk assessment plus the monitoring it prescribes — usually temperature checks and flushing of little-used outlets, logged.
Equipment calibrated and testedMedical devices calibrated (scales, BP monitors, spirometers, fridges); electrical testing per your policy. Keep the certificates together.
COSHH basics in placeData sheets for the substances you hold, sensible storage, and staff who know where both live.
Accidents recorded, RIDDOR understoodAn incident book that gets used, and someone who knows which incidents must be reported externally.

3.8 Business continuity

Rarely the headline finding, always the easy win — and the one area where the self-check pays off on an ordinary Tuesday when the clinical system goes down, whether or not CQC ever asks.

A written continuity plan that names namesPremises loss, IT failure, phone failure, mass staff absence — who does what, with deputies. Generic template text with no local names is not a plan.
Contact cascade tested in the last yearNumbers go stale. A ten-minute test cascade once a year keeps the plan honest.
Clinical system downtime procedures printedYou can run a surgery on paper for a morning: downtime forms, a printed appointment list process, and staff who have seen the procedure before the day it is needed.
Tomorrow-morning answer for premises lossIf the building is out of action tonight, where do patients go tomorrow? Branch site, neighbouring practice, federation space — agreed in advance, in writing.
The plan survives the failure it plans forA continuity plan stored only on the server that just failed has a certain irony. Printed copy plus an off-site copy.

4. Well-led, for partners specifically

Safe, effective, caring and responsive are mostly about your systems and your team. Well-led is about you. In our experience it is the domain where partnerships find the least to show an inspector — informality leaves no evidence trail — and the one a partner can do most about personally, because the evidence it needs is generated in the room where partners meet.

What well-led actually means at partner level

Strip the framework language away and well-led asks four things of a partnership:

A governance rhythm: partners meet regularly, decisions are minuted, actions have owners, and the minutes show quality and safety being discussed — not just money and rotas.
Delegation clarity: the partner–practice manager boundary is written down. Who decides what, up to what spend, and what must come back to the partnership.
Oversight of clinical quality: an audit programme partners see, significant-event themes partners discuss, and monitoring searches partners know exist.
Staff voice: a team that can raise concerns, and at least one story of something that changed because they did.

Minutes are your best evidence — and your best tool

A year of partnership minutes showing safety on the agenda, decisions made, and actions closed is worth more than any purchased policy library. It is also, not coincidentally, how a practice is actually run well. This is the recurring theme of CQC preparation: the evidence and the good practice are the same thing.

The failure pattern to avoid

The commonest well-led failure in partnerships is not neglect — it is informality. Decisions made in corridor conversations, delegation that lives in custom and habit, audit that happens but is never collated, concerns raised over coffee and lost. The practice may be genuinely well run, but nothing can demonstrate it — and under pressure, informal systems are the first to drop things. Formalising the rhythm is not bureaucracy; it is making the goodness of your practice visible and durable.

Well-led self-check

5. Preparing without buying it

There is a sizeable industry around CQC anxiety: compliance toolkits at £445+VAT a year, mock inspections at £1,000 or more a day. Some of it has its place. Most of what it sells, a partnership can do itself with a practice manager, a rhythm, and a few hours a quarter.

The quarterly rhythm

Cycle through the evidence areas from section 3 across the year, one theme a quarter. Same slot each quarter, prepared by the practice manager, reviewed and signed off by a partner:

1

Quarter 1 — Safe

Work through the safeguarding and medicines checklists above. Run the high-risk monitoring searches, check the alerts log, review the fridge records, spot-check the emergency drugs.

Roughly 90 minutes: practice manager prepares, one partner reviews and signs off. Log what you found and fixed.

2

Quarter 2 — People

Staff files, training matrix, appraisals, IPC. Sample three staff files against your front-sheet checklist. Check the training grid for gaps. Confirm last year’s IPC audit actions are closed.

Sampling beats completeness: three files done properly teaches you more than thirty skimmed.

3

Quarter 3 — Premises and continuity

Health and safety, fire, legionella, equipment calibration, and the business continuity plan. Run the contact cascade test this quarter.

Walk the building with the checklist rather than reading it at a desk — corridors hold findings that spreadsheets hide.

4

Quarter 4 — Well-led

Minutes, audit programme, complaints and significant-event themes, risk register, policy cycle. Then a short walkabout: pick three staff and ask what they would do with a safeguarding concern, a complaint, an IT failure.

If your team answers those three questions well, you are in better shape than most practices that paid for a mock inspection.

Why quarterly works

A quarterly cycle means every area gets looked at annually, no single session is overwhelming, and — crucially — findings get fixed in weeks rather than discovered in a pre-assessment panic. It also generates its own paper trail: four dated self-check records a year, each showing problems found and closed, is exactly the learning culture assessors are looking for.

When a paid mock inspection is worth it — and when it is not

The £1,000 question
Your situation	Is a paid mock inspection worth it?
New partners or a new practice manager — nobody has lived through an assessment	Possibly. A one-off external run-through can teach the rhythm and take the fear out of it. Buy it once, learn from it, then run the cycle yourselves.
Previous rating of Requires improvement or Inadequate	Yes, usually. External eyes on the specific breach areas are worth paying for — and re-assessment is coming either way.
Major change: merger, new premises, list dispersal absorbed	Maybe. Consider a targeted review of the changed areas rather than a full mock.
Established team, quarterly self-check running, evidence habits in place	No. Your own cycle already does what the mock would do. Spend the money on protected admin time instead.
General anxiety because an assessment might be coming	No. Anxiety is not a gap analysis. Run one quarter of the self-check first — it will either reassure you or show you exactly what to fix.

If you do buy one: agree the scope in writing, insist on a written report against the current framework position (and ask them directly how they are handling the unsettled new framework — a confident answer to that question is a red flag), and treat it as training for your own future cycles, not a service to repeat annually.

The free sources worth using

CQC's GP mythbusters— the regulator's own corrections of common myths about what it expects. Free, and the best antidote to compliance-industry folklore ("every staff member needs a DBS check" being a classic).
CQC's update pages — as the new GP framework firms up, the primary source beats every newsletter summarising it.
Your LMC — levy-funded support that includes CQC preparation help and, if it comes to it, help with challenging reports.
Published reports on practices like yours — reading a handful of recent GP reports shows you what assessors actually write up, in a way no toolkit reproduces.

6. When things go wrong

Sometimes an assessment goes badly. Before anything else, make one distinction honestly, because everything that follows depends on it: was this a bad day or a bad system?

A bad day

The fridge log has a gap the week your nurse was off. One staff file is missing a reference. The assessor caught the one morning the duty doctor rota fell over. These are real findings, but they are noise around a working system — the response is context, evidence, and swift correction, using the factual accuracy process where the report overstates them.

A bad system

No high-risk drug monitoring searches exist. Partnership meetings happen rarely and are not minuted. Significant events are logged but nothing ever changes. These findings are signal, not noise — the response is not to fight the report but to fix the practice, with external help if needed. This is the situation where paying for support is money well spent.

The factual accuracy process

After an assessment you receive a draft report and 10 working days to challenge factual errors before publication. The window is short — check the deadline quoted in the letter that accompanies your draft and diarise it the day it arrives. To use it well:

Challenge with evidence, not indignation. Every point you dispute should attach the document, log, or record that proves it. Tone changes nothing; exhibits do.
Go line by line. Small factual errors compound into an unfair overall picture — correct all of them, not just the wounding ones.
Involve your LMC early. They have seen many of these; you have seen few.
Do not miss the deadline for a better-drafted response. A good submission on time beats a perfect one late.

Challenging a rating

After publication, the ratings review route is deliberately narrow: the only ground is that CQC failed to follow its ratings process — not that you disagree with the judgement. You have 15 working days from publication to request one, you get one request per report, and the case must be made in 500 words. That makes the factual accuracy stage your real opportunity; treat the review as a backstop, not a plan. Separately, conduct complaints about how CQC behaved go through its own complaints procedure, and enforcement action carries formal representation and appeal rights of its own — at which point you want the LMC and, for anything beyond a requirement notice, proper legal advice.

The enforcement ladder

Enforcement escalates: requirement notices asking you to fix breaches, warning notices, conditions on registration, and — very rarely, and never as a surprise — suspension or cancellation. Most GP enforcement lives on the bottom rung, and a requirement notice responded to with a solid action plan is a survivable event, not a catastrophe.

A bad report is a bad chapter, not the book

Practices recover from poor ratings routinely: honest diagnosis, a real action plan, evidence of change, re-assessment. The partnerships that struggle are the ones that spend the recovery period litigating the last report instead of building the evidence for the next one. Fix forward.

7. AI and new technology under CQC

If your practice has adopted an AI tool — a scribe, a triage assistant, anything touching clinical workflow — expect the question: how did you assure it? Not whether the tool is clever, but whether you governed its introduction the way you would govern any other change to how care is delivered.

The evidence that answers it is a short, specific stack:

Your DPIA — the data protection impact assessment you completed before switching it on.
Your DCB0160 assessment — your side of the clinical safety work as the deploying organisation.
The vendor's DTAC — their evidence against the NHS digital technology assessment criteria, held by you.
A minuted partnership decision — the adoption agreed, with review built in. This is the well-led thread again: the tool is a governance question, not a technology question.

What each artefact is, who produces it, and how to get them done without a governance department is the business of our AI Tools & Governance guide — the details live there, not here.

Adopted something without the paperwork?

Do the assurance work now, retrospectively, and minute the decision to regularise it. A practice that noticed its own gap and closed it is a learning culture; a practice that waits to be asked is not. Start with the DPIA.

8. Glossary

CQC

Care Quality Commission

The independent regulator of health and social care in England. Registers providers, assesses quality, and can enforce where care falls below standards.

Registered provider

The legal entity registered with CQC to carry on regulated activities. For most GP practices this is the partnership itself, with all partners named — which is why partnership changes are registration changes.

Registered manager

The person registered as managing the regulated activities day to day. In general practice, usually a partner or the practice manager. Must be assessed as fit for the role.

Nominated individual

A role required only where the provider is an organisation (such as a limited company) — the person supervising the management of the regulated activity. Most GP partnerships do not need one.

Regulated activities

The categories of care a provider is registered to deliver — for GP practices, typically treatment of disease, disorder or injury; diagnostic and screening procedures; surgical procedures; maternity and midwifery services; and family planning.

Single assessment framework

CQC’s 2023 framework applying one set of quality statements across all sectors, with ongoing assessment rather than periodic inspection visits. Heavily criticised in the 2024 Dash review; a GP-specific replacement began piloting in June 2026.

Key questions

The five headline questions CQC asks of every service: is it safe, effective, caring, responsive, and well-led. Ratings and reports are organised around them.

Well-led

The key question about leadership, governance and culture — for partners, the one that is most directly about you rather than your systems. Often the domain partnerships find hardest to evidence, because so much of it happens informally.

GP mythbusters

CQC’s own series of short articles correcting common myths about what it does and does not expect from GP practices. Free, written by the regulator, and the best antidote to compliance-industry folklore.

Factual accuracy check

The formal window after a draft report in which the provider can challenge factual errors, with evidence, before publication. Your main lever over the report’s content.

Ratings review

The post-publication route for challenging a rating. The only ground is that the inspector failed to follow the published process — disagreeing with the judgement is not enough.

Statutory notifications

Events a provider must tell CQC about without delay — including certain deaths, serious injuries, and incidents that stop the service running safely. Separate from, and in addition to, NHS reporting routes.

Duty of candour

The regulatory duty to be open and honest when a notifiable safety incident occurs — a prompt apology, an explanation of what happened, and a written record of both.

DPIA

Data Protection Impact Assessment

The UK GDPR assessment required before processing likely to result in high risk to individuals — which introducing an AI tool into clinical workflow usually is. Part of your evidence that new technology was assured, not just adopted.

DCB0160

The NHS clinical risk management standard that applies to health organisations deploying health IT — your practice’s side of the clinical safety assessment when you adopt a system, including AI tools.

DTAC

Digital Technology Assessment Criteria

The NHS baseline assessment for digital health technologies, covering clinical safety, data protection, technical security, interoperability, and usability and accessibility. Completed by the vendor; you hold their evidence.

9. Sources and further reading

Last reviewed: 9 July 2026. All links checked at that date.