Well-led · KLOE 5
Management of risk, performance and issues
Are there clear and effective processes for managing risks, performance and issues?
CQC wording, primary care and community services draft V6.0, pages 54 to 56.
Draft, not the current assessment framework
CQC's primary care and community services draft V6.0, published March 2026. The current quality statements remain in use.
CQC draft scope
What this proposed KLOE covers
Scope of this key line of enquiry and topic areas include:
- Organisational risk management
- Emergency preparedness (including climate events) and business continuity
- Workforce planning
- Use of resources
- Data security/data protection and General Data Protection Regulation (GDPR)
- Cyber security
- Statutory notifications
How would this apply to your service?
The draft applies one framework across primary care and community services, but useful evidence depends on your service and people.
Source: CQC, Primary care and community services assessment framework, draft V6.0, 19 March 2026, pages 54 to 56. Contains public sector information licensed under the Open Government Licence v3.0.
CQC draft rating characteristics
How the draft describes each rating
These are CQC's draft characteristics. CQC says rating characteristics guide judgements, they are not a mechanical checklist.
Outstanding
- The organisation demonstrates a mature, intelligence-led approach to managing risk, performance and issues.
- The organisation assures itself that systems are effective through analysis of data and intelligence, focusing on pattens, trends and early warning signals, rather than retrospective reporting.
- Staff at all levels are engaged, respected and supported to use performance and risk management systems effectively, with problems addressed openly and swiftly through collaborative and responsive leadership.
- The service invests in innovative and best practice information systems and processes. The information used in reporting, performance management and delivering good quality care is consistently found to be accurate, reliable, timely and relevant.
- The service works well in partnership with others, sharing accurate and timely data in a transparent and accessible way to improve care outcomes and experiences, and to make a positive difference to the local community.
- Emergency preparedness and business continuity plans reflect the needs of the service and wider system. Leaders work with other services in the system to achieve cohesive plans that support people and local communities, ensuring system resilience and continuity of care.
- Workforce and contingency planning is thorough and proactive. Times of increased demand are predicted, planned for and addressed in a calm, cohesive and productive way. Leaders are dynamic in implementing resources and patient outcomes show improvements.
- Cyber security and information governance are treated as strategic risks. Controls are routinely tested, and learning from incidents or near misses is used to strengthen systems.
Good
- The organisation has clear and effective management and accountability arrangements that support the delivery of safe, high-quality and sustainable care. These processes are well-understood and used to maintain oversight of organisational performance.
- Organisational risk, performance, and outcome data are used to deliver high-quality, sustainable care.
- Systems for managing performance and organisational risk support innovation while maintaining the quality of the service.
- Data and notifications are consistently submitted to external organisations, as required.
- There are rigorous data management systems, ensuring the availability, integrity and confidentiality of data. Information is used effectively to identify risk, manage performance and monitor and improve the quality of care.
- Workforce planning is regularly reviewed and monitored.
- Emergency preparedness and business continuity plans are routinely tested and sufficient for the size and capacity of the service.
- There are resilient and reliable cyber security arrangements and systems to protect people’s data and maintain secure data services.
Requires improvement
- The organisation’s approach to service delivery and improvement is reactive and focused on short-term issues.
- Risks, issues and poor performance are not always dealt with appropriately or quickly enough.
- The risk management approach is applied inconsistently or is not linked effectively into planning processes.
- Clinical and internal audit processes are inconsistent in their implementation and impact.
- There are risks to sustaining good quality care because of financial challenges.
- Data management systems are flawed. Data used to monitor performance and manage risks is not always available or accurate. As a result, risks, issues and poor performance are not always dealt with appropriately or quickly enough.
- Leaders and staff do not always receive information to enable them to challenge and improve performance. Information is used mainly for assurance and rarely for improvement.
- Required data and notifications are inconsistently or inaccurately submitted to external organisations.
- Workforce planning does not always achieve its purpose, and leaders are reactive to workforce challenges.
- Emergency preparedness and business continuity plans are not always appropriate for the type of service or its capacity. They are not tested regularly.
- Cyber security is managed reactively, and there are gaps in maintaining a secure service.
Inadequate
- The information that is used to monitor performance or to make decisions is inaccurate, invalid, unreliable, out-of-date or not relevant.
- Finance and quality management are not integrated to support decision making.
- There is inadequate access to information about the performance of leaders and staff, and ways to challenge this. There are significant failings in systems and processes to manage how this data is shared.
- There is little understanding or management of risks and issues, and there are significant failures in performance management and audit systems and processes.
- Risk or issue registers and action plans, if they exist at all, are rarely reviewed or updated.
- Meeting financial targets is seen as a priority at the expense of quality.
- Required data and notifications are routinely not submitted to external organisations.
- Workforce planning is inconsistent and fails to achieve its purpose,
- Emergency preparedness and business continuity plans are inappropriate or insufficiently for the service. They are not tested and leaders do not understand their value.
- Cyber security is not a priority and there are examples of breaches of cyber and data legislation.
Want to know how your service would fare?
Book a mock inspection run against the draft KLOEs, or call 020 8090 5346 to speak to one of our experts.