Clinical governance: the 7 pillars, how to run them, and what CQC Regulation 17 requires

Published lists of the pillars differ. The National Audit Office sorted the parts of clinical governance into three groups in its 2003 report, and the NHS regulations for community pharmacies name components of their own, including information governance and premises standards. The seven below are the components the Commission for Health Improvement examined in every NHS trust it reviewed, as the National Audit Office set them out in that report. The pillars organise the work, and for a CQC-registered provider the legal duty behind them is Regulation 17.

The pillars work as one system. An incident can reveal a risk the register missed, show that a policy no longer matches current guidance, send staff for retraining and give the next audit something to check. In the 193 reviews the Commission had reported on by November 2002, its main concerns included audit with no link to risk management and research, and boards that “often did not receive and disseminate the information from clinical governance and service activities that allowed them to be proactive and strategic”.

1. Patient and public involvement

In a provider: people who use the service, their families and staff can give feedback and raise complaints, and the provider shows what changed as a result. Regulation 17 requires providers to “seek and act on feedback” on their services.

The evidence it leaves:

• A log of feedback and complaints, with the response to each and what changed
• Survey results, and the actions they led to
• Minutes that show the governance meeting discussed feedback
• How you tell people what changed because of their feedback

2. Clinical audit

In a provider: a planned programme of audits checks current practice against a set standard, and each audit leads to action and a re-audit. CQC’s guidance says audits “should be baselined against Regulations 4 to 20A”, and its dental guidance describes clinical audit as a review of current practice against “expected published standards”.

The evidence it leaves:

• The audit programme for the year, with owners and dates
• Each audit’s findings, its action plan and the actions completed
• Re-audit results that show whether the change held

3. Risk management

In a provider: the provider finds and scores the risks to people using the service and to staff, puts controls in place and learns from incidents. Regulation 17 requires systems to “assess, monitor and mitigate the risks relating to the health, safety and welfare of service users and others”, and CQC’s guidance expects measures “within a timescale that reflects the level of risk”.

The evidence it leaves:

• A risk register with an owner, a score, controls and a review date for each risk
• An incident log, with the response to each incident and the learning
• Records of each notifiable safety incident under the duty of candour (our duty of candour guide sets out the steps)
• A log of the statutory notifications sent to CQC

4. Clinical effectiveness

In a provider: care follows current evidence. Someone tracks new guidance and safety alerts, decides what changes in the service and checks outcomes. CQC’s guidance says providers “should read and implement relevant nationally recognised guidance”, and its GP guidance lists the monitoring and adoption of best practice, such as NICE guidance and medicines alerts, among the information to gather.

The evidence it leaves:

• A log of new guidance and alerts: who reviewed each one, the decision and any change to practice
• The outcomes you measure, and what you did when they fell short
• Peer review, where you use it

5. Staffing and staff management

In a provider: enough suitably qualified staff work each shift, recruitment checks are complete and managers deal with poor performance. Regulation 18 requires “sufficient numbers of suitably qualified, competent, skilled and experienced persons”, and CQC’s guidance says staffing levels and skill mix “must be reviewed continuously”.

The evidence it leaves:

• Reviews of staffing levels and skill mix, and what you changed
• Employment records for every member of staff, including the checks Regulation 19 requires
• Supervision and appraisal records
• How you handled concerns about a member of staff’s performance

6. Education and training

In a provider: every role gets the training it needs, refreshers stay in date, and professional staff get support to show their regulator they still meet its standards. Regulation 18 requires staff to “receive such appropriate support, training, professional development, supervision and appraisal as is necessary” for their duties.

The evidence it leaves:

• A training matrix by role, with dates and gaps
• Induction records for new starters
• Retraining after an incident or a policy change, with proof the staff involved completed it

7. Use of information

In a provider: leaders see reliable data on quality and safety, and care records stay accurate and secure. CQC’s guidance says information should be “up to date, accurate and properly analysed and reviewed by people with the appropriate skills and competence to understand its significance”, and Regulation 17 requires “an accurate, complete and contemporaneous record in respect of each service user”.

The evidence it leaves:

• A regular quality report to the board or leadership team, with trends over time
• Audits of care records
• Data security arrangements, including the Data Security and Protection Toolkit where it applies

The framework sets out who owns each part of clinical governance in your service, how you run it and how you meet each part of Regulation 17, in one document ready for your leadership team and your next inspection. It covers:

• Who is accountable: the registered provider, the registered manager, a clinical governance lead and an owner for each pillar
• The 7 pillars: what each one covers in your service and the evidence it leaves
• The governance meeting: its terms of reference and a standing agenda
• The quality report to your board or leadership team
• Regulation 17, part by part: the system that meets each requirement and the evidence it leaves
• The steps from an incident, complaint or audit finding to the re-audit that shows the change held
• A yearly audit programme
• How and when you review the framework

Regulation 17 applies to every provider registered with CQC. Each setting adds rules and guidance of its own.

Hospitals and clinics

Many independent hospitals and clinics engage doctors through practising privileges, so a hospital stays accountable for doctors it does not employ. The Medical Practitioners Assurance Framework, published by the Independent Healthcare Provider Network and refreshed in September 2022, says a provider’s board holds “the ultimate accountability” for the governance of its doctors, “whether employed or working on practising privileges”. It sets out a “ward-to-board” governance structure, with defined roles for the clinical governance committee and the medical advisory committee, and suggests a standing board agenda item on patient safety.

In NHS trusts, executive reviewers support CQC’s assessments of well-led. The Patient Safety Incident Response Framework applies to every service under the NHS Standard Contract, including NHS-funded care from independent providers.

Pharmacies

A registered pharmacy must meet the General Pharmaceutical Council’s standards, and the first principle covers governance: “The governance arrangements safeguard the health, safety and wellbeing of patients and the public.” The GPhC says governance arrangements include clear roles and accountabilities, the arrangements for managing risks, and the way the owner manages and runs the pharmacy.

A pharmacy that provides NHS pharmaceutical services in England must also take part in a clinical governance system under the National Health Service (Pharmaceutical and Local Pharmaceutical Services) Regulations 2013. Its components include patient and public involvement, clinical audit, risk management, clinical effectiveness, staffing and staff management, information governance and premises standards. The risk management programme must include “a clinical governance lead person for each pharmacy”. The audit programme must include at least one clinical audit of the pharmacy’s own choosing each financial year, plus a clinical audit or a policy-based audit that NHS England specifies.

A pharmacy business that also registers a service with CQC has Regulation 17 to meet for that service. Our guide to GPhC inspections covers how the regulator checks its standards.

Dental practices

CQC’s dental guidance describes clinical governance as the system through which organisations are accountable for continuously improving the quality of their services and safeguarding high standards of care, covering “quality assurance, quality improvement and risk and incident management”. The regulator says most breaches it finds in dental practices sit under the well-led key question, and that leaders can be the principal dentist, the nominated individual or a practice manager.

CQC’s dental audit guidance names three essential audits: infection prevention and control (decontamination), at least every 6 months; X-ray audits, which the radiation regulations (IRR17 and IR(ME)R 2017) require; and an accessibility audit under the Equality Act 2010. Audits of antimicrobial prescribing and record keeping are desirable. The regulator also treats peer review as “one of the hallmarks of a well led practice”. Our free dental CQC inspection checklist lists what to check for each quality statement.

Nursing homes

In a nursing home, the clinical side of governance covers the risks the regulations name: the safe management of medicines and infection control under Regulation 12, nutrition and hydration under Regulation 14, and safeguarding under Regulation 13. Regulation 18 requires the provider to enable its registered nurses to show their regulator, the Nursing and Midwifery Council, that they still meet its professional standards.

Care homes must notify the regulator of deaths, serious injuries, abuse and other events, and its Regulation 17 guidance says a 17(3) request could include a Provider Information Return. Our care home audit tool covers every quality statement, and our guides to CQC notifications and Deprivation of Liberty Safeguards cover two more duties.

GP practices

CQC’s GP mythbuster on clinical governance, last updated in December 2022, says the regulator considers a practice’s clinical governance “when we make judgements about how effective and how well-led GP practices are”. It expects senior members of the practice to lead it and all staff to take part. It gives examples of the information to bring to governance discussions: unexpected deaths, new cancers and other life-changing diagnoses, significant events, complaints, NICE guidance and medicines alerts, patient feedback and surveys, prescribing performance, QOF and enhanced service data, clinical audit findings, and education and learning.

Where a practice lacks effective governance, CQC considers whether it meets Regulation 17.