Well-led · KLOE 5
Management of risk, performance and issues
Are there clear and effective processes for managing risks, performance and issues?
CQC wording, mental health care draft, pages 70 to 72.
Draft, not the current assessment framework
CQC's mental health care draft, published March 2026. The current quality statements remain in use.
CQC draft scope
What this proposed KLOE covers
Scope of this key line of enquiry and topic areas include:
- Organisational risk management
- Emergency preparedness (including climate events) and business continuity
- Workforce planning
- Use of resources
- Records/digital records
- Data security/data protection and General Data Protection Regulation (GDPR)
- Cyber security and Data Security and Protection Toolkit (DSPT)
- Statutory notifications
- Oversight and reduction of restrictive practice
How would this apply to your service?
The draft applies one framework across mental health care, but useful evidence depends on your service and people.
Source: CQC, Mental health care assessment framework, draft, 19 March 2026, pages 70 to 72. Contains public sector information licensed under the Open Government Licence v3.0.
CQC draft rating characteristics
How the draft describes each rating
These are CQC's draft characteristics. CQC says rating characteristics guide judgements, they are not a mechanical checklist.
Outstanding
- The service demonstrates a mature, intelligence-led approach to managing risk, performance and issues. The service assures itself that systems are effective through analysis of data and intelligence, focusing on pattens, trends and early warning signals rather than retrospective reporting.
- Staff are engaged, respected and supported to use risk management systems effectively, with problems addressed openly and swiftly through working collaboratively and responsive leadership.
- The service invests in innovative and best practice information systems and processes.
- The service works in partnership, sharing accurate and timely data in a transparent and accessible way to improve care outcomes and experiences, and to make a positive difference to the local community and environment.
- Systems are in place to ensure that data about the use of force is collected, reviewed and submitted to the Mental Health Services Data Set. The executive team or equivalent understands which services have the highest use of restrictive practice and where there are significant increases in use. Policies, practice and training are reviewed to take account of the data.
Good
- Workforce planning is thorough and proactive. It is regularly reviewed and monitored.
- Data or notifications are consistently submitted to external organisations as required.
- There are rigorous arrangements for the availability, integrity and confidentiality of data, records and data management systems. Information is used effectively to monitor and improve the quality of care.
- Service risks, performance, and outcome data are used to deliver high-quality, sustainable care.
- Systems for managing performance and service risks support innovation while maintaining the quality of the service.
- Emergency preparedness and business continuity plans are rigorous, tested and sufficient for the size and capacity of the service.
Requires improvement
- Required data or notifications are inconsistently submitted to external organisations.
- Arrangements for the availability, integrity and confidentiality of data that identifies people using the service, records and data management systems are not always rigorous.
- Risks, issues and poor performance are not always dealt with appropriately or quickly enough. The risk management approach is applied inconsistently or is not linked effectively into planning processes.
- The approach to service delivery and improvement is reactive and focused on short-term issues. Clinical and internal audit processes are inconsistent in their implementation and impact. The sustainable delivery of good quality care is put at risk by the financial challenge.
- Emergency preparedness and business continuity plans are not always appropriate for the type of service or its capacity. They are not tested regularly.
Inadequate
- Required data or notifications are routinely not submitted to external organisations.
- The information that is used to monitor performance or to make decisions is inaccurate, invalid, unreliable, out of date or not relevant. Finance and quality management are not integrated to support decision making.
- There is inadequate access to and challenge of performance by leaders and staff. There are significant failings in systems and processes for managing or sharing data.
- There is little understanding or management of risks and issues, and there are significant failures in performance management and audit systems and processes. Risk or issue registers and action plans, if they exist at all, are rarely reviewed or updated. Meeting financial targets is seen as a priority at the expense of quality.
- Emergency preparedness and business continuity plans are not rigorous or appropriate for the type of service or its capacity. They are not tested and leaders do not understand their value.
Want to know how your service would fare?
Book a mock inspection run against the draft KLOEs, or call 020 8090 5346 to speak to one of our experts.