CQC expects GP practices to have policies and procedures that support safe care, effective governance and compliance with relevant requirements. The documents need to reflect the services provided, remain current and translate into arrangements that staff understand and follow. Inspectors may consider policies alongside staff accounts, records, audits and other evidence of how the practice operates.
Having a policy is only part of the evidence. A document cannot establish that a process works simply because it has been approved or recently reviewed.
For a Practice Manager, the useful question is whether the library describes what should happen, identifies who is responsible and helps staff act appropriately. This article concerns CQC regulation in England; practices elsewhere in the UK should check their own national arrangements.
-
CQC publishes specific document requirements for new provider registration applications. Those requirements should not be treated as a complete policy inventory for every established GP practice. An operating practice needs documents and processes appropriate to its services, risks and applicable obligations.
The current registration list includes complaints, consent, equality and human rights, governance, infection prevention, medicines management, recruitment and safeguarding policies. Additional documents depend on the service being registered. CQC explicitly states that this guidance is for new provider applicants.
For an established practice, assess coverage against the work actually undertaken. Consider clinical processes, premises, staff, information handling and services delivered with other organisations. A registration checklist cannot resolve every local operational question.
Also identify why each document or process is needed. A legal duty, a contractual requirement, CQC guidance and a locally chosen procedure have different origins. Recording the source helps prevent a supplier’s suggested document from being described as a universal CQC requirement.
-
Policy management is particularly relevant to Regulation 17 on good governance, but individual policies may support compliance with other regulations. The subject and the effectiveness of the arrangements matter more than the document’s title. Practices should connect policies with the risks and responsibilities they address.
Regulation 17 requires effective systems to assess and improve quality, monitor and mitigate risks, and maintain appropriate records. An organised policy review process can support those duties.
Regulation 12 concerns safe care and treatment. Its guidance addresses risk management and medicines policies reflecting current legislation and guidance. Regulation 16 requires an effective, accessible complaints system, investigation and appropriate action when failures are identified.
Within CQC’s published assessment framework, often called the Single Assessment Framework, policy management may support the Governance, management and sustainability quality statement. This addresses clear responsibilities, accountability and management of risk.
The framework is being developed further. CQC’s June 2026 update describes pilots running alongside existing inspections, with evaluation planned for November. Check confirmed guidance when preparing for assessment rather than treating draft proposals as requirements already in force.
-
A policy is useful when its content is accurate, relevant and sufficiently clear for the people expected to use it. It should describe the practice’s arrangements and make responsibilities understandable. Document control helps establish which version applies and whether its content has been checked.
As a practical management standard, a policy should make clear:
Its purpose and the services or staff it covers.
Who is responsible for maintaining it and carrying out key tasks.
The actions, escalation routes and supporting procedures staff need.
Relevant source guidance.
Its version, approval status and review arrangements.
This is a suggested structure, not a universal CQC template.
Personalisation needs to go beyond inserting the practice name. Check contacts, clinical systems, local pathways, absence cover and relationships with PCN or external services. Instructions should be workable during an ordinary session, including when the usual lead is unavailable.
CQC’s general governance requirements do not prescribe a blanket annual review date for every policy. Set intervals according to the subject, risk and any specific requirements, and review earlier when circumstances change.
A recent review date should mean that the content has been examined. Moving the date forward without that work provides little assurance.
-
The relevant expectation is that staff are prepared for their roles and understand the instructions they need to carry out their work safely. The CQC guidance cited here does not establish a universal requirement for every employee to sign every policy. Acknowledgements can support evidence of communication, but they do not establish understanding on their own.
Regulation 18 requires appropriate support, training, development, supervision and appraisal. CQC’s guidance also describes an induction programme that prepares staff for their role.
A practical approach is to identify essential reading for everyone, then add documents relevant to particular responsibilities. Include locums, temporary staff and colleagues working through shared services where those instructions affect their work.
Match the communication method to the change. A revised contact number may need a short notification. A change to handling urgent clinical correspondence may require discussion, training and a check that the new process works.
CQC’s GP governance guidance describes speaking to staff at different levels and considering how decisions are communicated. Staff should therefore be able to explain relevant responsibilities in their own words and find the current guidance when needed.
-
Evidence of implementation shows whether the process described in a policy happens reliably. Depending on the subject, that may include completed records, audit results, staff explanations, feedback and actions taken after problems. The most useful evidence comes from normal practice activity.
CQC’s published evidence categories include people’s experience, staff and partner feedback, observation, processes and outcomes. The sources used vary with the service and assessment. This explains why a policy alone cannot provide the whole picture.
The following are practical ways to connect documents with supporting evidence; they are not a universal submission checklist:
Complaints - Records of handling, outcomes, action taken and accessible information for patients.
Test results and correspondence - Workflow checks, relevant audits and evidence that follow-up responsibilities operate effectively.
Staff induction - Role-specific induction records, access checks and follow-up on identified learning needs.
Incident management - Recorded learning, assigned actions and checks on whether changes were effective.
Policy management - Review decisions, approval records, version history and communication of material changes.
CQC’s guidance on test results provides a specific illustration. Practices can develop their own systems, but need to demonstrate effectiveness and audit how they work. See CQC’s test results and correspondence guidance.
Keep evidence retrievable in its appropriate system. There is no practical benefit in copying sensitive records into a general policy folder simply to place them beside the document.
-
Policy evidence is weakened when documents conflict with practice, ownership is unclear or changes fail to reach staff. Presentation matters less than whether the instructions remain reliable. An impressive library can still leave important operational questions unanswered.
Problems worth checking for include unpersonalised templates, references to departed staff, duplicate policies and old versions available through familiar shortcuts. Another is a policy that allocates a task to a role without confirming that someone actually performs it.
A mismatch requires investigation. Staff may have developed a safer process that has not been documented, or they may have drifted away from an appropriate procedure. Establish which before revising the wording.
An overdue review also needs assessment. Check the content and risk, assign an owner and record the action required. Do not backdate approval or roll dates forward to make the register look complete.
Where weaknesses amount to regulatory breaches, consequences depend on their seriousness and impact. CQC’s enforcement guidance considers potential harm and multiple or persistent failures. A policy date alone is insufficient to predict enforcement or a rating.
-
Check whether the practice can explain its key processes, produce the relevant approved documents and demonstrate that arrangements work. Start with higher-risk subjects and recent service changes. The aim is to identify gaps while there is time to address them.
Coverage: do policies address the services actually provided, including shared arrangements?
Accuracy: are responsibilities, contacts, systems and escalation routes current?
Ownership: does each significant policy have an active owner and suitable approval?
Access: can relevant staff find the approved version?
Understanding: can staff explain what they would do within their role?
Implementation: do records and audit findings support what the policy says?
Learning: have incidents, complaints and feedback led to appropriate changes?
Outstanding work: are gaps assessed, allocated and followed through?
Sample several policies with a clinical or operational lead. Follow each from the document to staff understanding and then to relevant records.
If CQC requests information, respond to the scope and instructions given. Identify documents clearly and explain material gaps and the action underway. An honest account of an unresolved issue is more useful than a replacement document that implies work has already been completed.
-
Choose three areas where unreliable instructions could have significant consequences, such as safeguarding, medicines or results handling. Review each with the relevant lead and staff who use the process.
Confirm the current policy and its source requirements.
Check that it reflects local arrangements.
Look for evidence that staff understand and follow it.
Allocate any corrections and verify their completion.
A policy library supports assurance when the practice can show how its documents connect with safe, consistent work.