Well-led · KLOE 5
Management of risk, performance and issues
Are there clear and effective processes for managing risks, performance, and issues?
CQC wording, secondary and specialist hospital care draft v0.6, pages 61 to 63.
Draft, not the current assessment framework
CQC's secondary and specialist hospital care draft v0.6, published March 2026. The current quality statements remain in use.
CQC draft scope
What this proposed KLOE covers
Scope of this key line of enquiry and topic areas include:
- Organisational risk management
- Emergency preparedness (including climate events) and business continuity
- Workforce planning
- Use of resources
- Records / digital records
- Data security / data protection and General Data Protection Regulation (GDPR)
- Cyber security and Data Security and Protection Toolkit (DSPT)
- Statutory notifications
How would this apply to your service?
The draft applies one framework across secondary and specialist hospital care, but useful evidence depends on your service and people.
Source: CQC, Hospitals (secondary and specialist care) assessment framework, draft v0.6, 19 March 2026, pages 61 to 63. Contains public sector information licensed under the Open Government Licence v3.0.
CQC draft rating characteristics
How the draft describes each rating
These are CQC's draft characteristics. CQC says rating characteristics guide judgements, they are not a mechanical checklist.
Outstanding
- The service demonstrates a mature, intelligence-led approach to managing risk, performance and issues.
- The service assures itself that systems are effective through analysis of data and intelligence, focusing on pattens, trends and early warning signals, rather than retrospective reporting.
- Staff are engaged, respected and supported to use performance and risk management systems effectively, with problems addressed openly and swiftly through collaborative and responsive leadership.
- The service invests in innovative and best practice information systems and processes.
- Emergency preparedness and business continuity plans reflect the needs of the service and wider system. Leaders work with other services in the system to achieve cohesive plans that support people and local communities, ensuring system resilience and continuity of care.
- Workforce and contingency planning is rigorous and proactive. Times of increased demand are predicted, planned for and addressed in a calm, cohesive and productive way. Leaders are dynamic in implementing resources and patient outcomes show improvements.
- Cyber security and information governance are treated as strategic risks. Controls are routinely tested, and learning from incidents or near misses is used to strengthen systems.
Good
- The service has clear and effective management and accountability arrangements that support the delivery of safe, high-quality and sustainable care. These processes are well-understood and used to maintain oversight of organisational performance.
- Risk, performance, and outcome data are used to deliver high-quality, sustainable care. The data used in reporting and performance management is consistently found to be accurate, reliable, timely and relevant.
- Systems for managing performance and risk support innovation while maintaining the quality of the service.
- Relevant data and notifications are consistently submitted to external organisations, as required.
- There are rigorous arrangements for the availability, integrity and confidentiality of data, records and data management systems. Information is used effectively to monitor and improve the quality of care.
- Workforce planning is thorough and proactive. It is regularly reviewed and monitored.
- Leaders have a good oversight of workforce learning and development. They monitor completion rates for mandatory training across the service.
- Emergency preparedness and business continuity plans are detailed, tested and sufficient for the size and capacity of the service.
- There are resilient and reliable cyber security arrangements and systems to protect people’s data and maintain secure data services.
Requires improvement
- The service’s approach to service delivery and improvement is reactive and focused on short-term issues.
- Risks, issues and poor performance are not always dealt with appropriately or quickly enough.
- The risk management approach is applied inconsistently or is not linked effectively into planning processes.
- Clinical and internal audit processes are inconsistent in their implementation and impact.
- There are risks to sustaining good quality care because of financial challenges.
- Arrangements for the availability, integrity and confidentiality of patient identifiable data, records and data management systems are not always reliable.
- The information used in reporting, performance management and delivering quality care is not always accurate, reliable, timely or relevant.
- Leaders and staff do not always receive information to enable them to challenge and improve performance. Information is used mainly for assurance and rarely for improvement.
- Required data and notifications are inconsistently submitted to external organisations.
- Workforce planning does not always achieve its purpose, and leaders are reactive to workforce challenges.
- Leaders do not always have a good oversight of workforce learning and development. They do not consistently monitor completion rates for mandatory training across the service.
- Emergency preparedness and business continuity plans are not always appropriate for the type of service or its capacity. They are not tested regularly.
- Cyber security is managed reactively, and there are gaps in maintaining a secure service.
Inadequate
- The information that is used to monitor performance or to make decisions is inaccurate, invalid, unreliable, out-of-date or not relevant.
- Finance and quality management are not integrated to support decision-making.
- There is inadequate access to information about the performance of leaders and staff, and ways to challenge this. There are significant failings in systems and processes to manage how this data is shared.
- There is little understanding or management of risks and issues, and there are significant failures in performance management and audit systems and processes.
- Risk or issue registers and action plans, if they exist at all, are rarely reviewed or updated.
- Meeting financial targets is seen as a priority at the expense of quality.
- Required data and notifications are routinely not submitted to external organisations.
- Workforce planning is inconsistent and fails to achieve its purpose.
- Leaders have a poor oversight of workforce learning and development. They fail to monitor completion rates for mandatory training across the service.
- Emergency preparedness and business continuity plans are inappropriate or insufficiently detailed for the type of service or its capacity. They are not tested and leaders do not understand their value.
- Cyber security is not a priority and there are examples of breaches of cyber and data legislation.
Want to know how your service would fare?
Book a mock inspection run against the draft KLOEs, or call 020 8090 5346 to speak to one of our experts.