Well-led · KLOE 4
Governance and management
Are there clear roles, responsibilities and systems of accountability to support good governance and manage risks, performance and issues?
CQC wording, draft v9, pages 58 to 61.
Draft, not the current assessment framework
CQC's adult social care draft v9, dated 19 March 2026. The current quality statements remain in use.
CQC draft scope
What this proposed KLOE covers
Scope of this key line of enquiry and topic areas include:
- Roles, responsibilities and accountability
- Governance, quality assurance and management
- Service risk management
- Cyber security and Data Security and Protection Toolkit (DSPT)
- Data security/data protection and General Data Protection Regulation (GDPR)
- Statutory and regulatory requirements
- Workforce planning
- Records/digital records
- Emergency preparedness (including climate events) and business continuity
How would this apply to your service?
The draft applies one framework across adult social care, but useful evidence depends on your service and people.
Source: Adult social care assessment framework, draft v9, 19 March 2026, pages 58 to 61.
HLTH analysis
What this could mean in practice
Clear accountability and effective governance should connect reliable information, risk management, performance oversight and preparedness for disruption.
People should understand their roles, while leaders maintain useful oversight of quality, records, data security, regulatory responsibilities and workforce planning. Governance should identify issues early, support improvement and include credible preparation for emergencies, technology failures and adverse weather.
Evidence and conversations to explore
- Governance, accountability and risk oversight
- Record quality, data security and information use
- Emergency and business continuity preparedness
Questions worth asking
- Can staff explain their responsibilities and routes for escalating risk?
- How does information lead to decisions, action and review?
- How well do continuity plans reflect people's needs and likely disruptions?
HLTH's interpretation of CQC's 19 March 2026 draft. This is not current CQC guidance, an official interpretation, a checklist or a rating prediction. Reviewed 17 September 2026.
CQC draft rating characteristics
How the draft describes each rating
These are CQC's draft characteristics. CQC says rating characteristics guide judgements, they are not a mechanical checklist.
Outstanding
- Governance arrangements are proactively reviewed and reflect good practice. They are supported by rigorous, inclusive systems that empower staff at all levels to identify and drive positive outcomes for people who use the service.
- There is a demonstrated commitment across the service to good practice, service performance and risk management systems and processes. Staff are engaged, respected and supported to use these systems effectively, addressing problems openly and swiftly through collaborative and responsive leadership.
- The service has well-designed, good practice information systems and processes. These provide reliable, timely and relevant information which is used in reporting, performance management and care delivery, facilitating improvement and innovation.
- Emergency preparedness and business continuity plans reflect the service and wider system. Leaders work with partners in the system to achieve cohesive plans that support people and local communities.
Good
- There are clear and effective governance, management and accountability arrangements. Staff understand their roles and responsibilities. Managers can account for the actions, behaviours and performance of staff.
- Data or notifications are consistently submitted to external partners as required.
- There are secure and reliable arrangements for the availability, integrity and confidentiality of data, records and data management systems. Information is used effectively to monitor and improve the quality of care. Staff understand their responsibilities when collecting and sharing information.
- Leaders are aware of relevant quality frameworks, standards, legislation and statutory guidance. These are implemented and used to improve equity and tackle known inequalities.
- Leaders and staff understand regulatory requirements. There are effective processes to keep up-to-date with all relevant changes, and staff understand these.
- The service has an accurate statement of purpose that clearly reflects current service provision.
- There are effective systems for monitoring and managing service performance, risk and learning from incidents that support innovation while maintaining the quality of care at the service.
- People can see that their opinions and experiences are considered in the service’s policies and procedures.
- Staff feel confident and supported to do their job by following the established processes.
- There are thorough business continuity plans in place for emergencies or natural disasters, such as adverse weather events, and staff know how to put these into practice.
Requires improvement
- Governance and accountability arrangements are not consistently reliable, effective or regularly reviewed.
- Processes may be excessive or inaccessible and may inappropriately reduce autonomy of staff.
- Not all staff understand their roles and responsibilities.
- Required data and notification submissions are sometimes missed.
- There are shortfalls in record keeping and data management. Records may be incomplete, inaccurate or out-of-date. Records are not stored appropriately and securely. Not all staff understand data protection requirements where this is relevant. Data is inconsistently collected, stored, used and shared appropriately and legally.
- Information is not regularly available or used effectively to monitor and improve the quality of care.
- There is variability in the recognition, understanding and implementation of relevant quality standards, and legal requirements are not consistently understood or fulfilled.
- Leaders and staff have an inconsistent understanding of regulatory requirements. They do not keep adequately up-to-date or understand relevant changes.
- Risks are inconsistently identified or managed. Systems for managing service performance and risk are inadequate and/or are not regularly reviewed to ensure they are effective.
- Quality assurance arrangements are inconsistently applied or are ineffective. There are gaps in identifying improvements. Action to introduce improvements can be absent, reactive, focused on the short term or not reviewed. Information needs are not regularly reviewed.
- The voice of people with lived experience is not appropriately represented in decision making in the service, including strategic decisions, risk assessments or quality improvement. Engagement may be limited or absent.
- Business continuity plans are minimal or would not meet the needs of people using the service. Not all staff are unaware of them or how to apply them.
Inadequate
- Governance, performance management and accountability arrangements are poor or absent.
- Processes are often excessive or inaccessible for staff. They are implemented or maintained in a way that inappropriately reduces autonomy and obstructs staff from doing their job.
- Roles, responsibilities and accountability arrangements are not clear.
- The service does not recognise the need to submit required data and notifications, or these are usually not submitted.
- Understanding of data protection requirements is poor and there are serious shortfalls in meeting them. There may have been preventable incidents of data breaches.
- There is a poor understanding of relevant mandatory quality frameworks and standards, and some legal requirements are not met.
- Leaders and staff lack understanding of CQC’s regulatory requirements and have a poor track record of meeting them.
- The service does not have an up-to-date or accurate statement of purpose.
- Systems for identifying, capturing and managing service risks and issues are ineffective.
- Quality assurance arrangements are not present or, if they are, they are ineffective.
- Business continuity plans are not in place or do not meet the needs of people using the service. Staff do not understand them or know what to do in an emergency.
Want to know how your service would fare?
Book a mock inspection run against the draft KLOEs, or call 020 8090 5346 to speak to one of our experts.