To prepare a GP practice policy library before a CQC assessment, establish which documents are current, check that they describe how the practice actually works, and connect important policies to evidence of implementation. Prioritise gaps that could affect patient safety, staff responsibilities or service continuity. Make sure staff can find the guidance relevant to their roles.
A recent review date is useful, but it cannot demonstrate that a process is safe or understood. Preparation should test the connection between written instructions and everyday work.
Practice Managers may inherit years of policies, duplicate files and templates with incomplete local details. The practical task is to identify what needs attention, involve the right people and keep an honest record of changes. This article concerns CQC assessments in England; other UK nations have different regulators.
-
A policy library should help demonstrate that the practice has effective governance and clear, workable arrangements for delivering care. Documents support that evidence when staff use them and the practice checks whether the arrangements work.
The legal foundation includes Regulation 17: Good governance, which requires effective systems to assess and improve quality and safety, manage risks and maintain relevant records. A collection of policies alone cannot establish that those systems operate effectively. See CQC’s Regulation 17 guidance.
The published Governance, management and sustainability quality statement also covers clear accountability, staff understanding of responsibilities and proportionate management of risk. Preparing the library can support evidence against these expectations. It cannot guarantee a particular rating. See CQC’s governance quality statement.
Check the assessment guidance and any instructions sent directly to the practice. As checked in September 2026, CQC’s published approach uses quality statements, while a revised assessment method is being piloted alongside existing inspections. Pilot judgements do not affect ratings.
-
Start with an inventory of the policies and procedures staff currently use. Establish their location, ownership and status before undertaking detailed reviews, so that attention goes to genuine gaps and conflicting instructions.
A simple register is usually a workable starting point. Suggested fields are:
Policy title and link to the authoritative copy.
Named owner and appropriate approver.
Current version, approval date and next review date.
Services, sites and staff groups covered.
Outstanding concerns and required actions.
These are practical document-control recommendations, rather than a prescribed CQC spreadsheet.
Check shared drives, policy platforms, induction packs and printed folders. A current electronic policy may coexist with an older reception desk instruction. Staff need to know which one applies.
Keep drafts and superseded versions separate from the live library, retaining historical records under the practice’s retention arrangements. Avoid creating a second “CQC library” that gradually diverges from the documents staff use.
CQC publishes supporting-document requirements for new registration applications. Those serve a different purpose from preparing an established practice for assessment and should not be treated as an exhaustive inspection checklist.
-
Prioritise policies according to the consequences of an error, known weaknesses and changes to services. An overdue review date should prompt investigation, but a document still within its review period may deserve more urgent attention if the underlying process has changed.
Depending on the practice’s services, an initial review might cover safeguarding, medicines management, results handling, infection prevention, emergencies, information security and business continuity. Complaints, incidents and previous assessment findings can help identify where closer examination is needed.
This is a suggested prioritisation approach, not a CQC ranking of policies.
For example, CQC’s guidance on results handling asks practices to demonstrate effective systems, including arrangements for absent clinicians, results requested by locums and appropriate follow-up. It also advises regular audit. That makes the results procedure a useful place to test whether written responsibilities match the actual workflow.
Ask the relevant clinical or operational lead to review the content. The Practice Manager can coordinate the work, but clinical decisions need appropriately qualified input.
Where PCN staff or another provider deliver part of a service, check who receives information, who acts on it and who provides cover. A shared policy needs clear local arrangements.
-
A proper review checks the policy against current authoritative guidance, local arrangements and the experience of people doing the work. It should establish whether the instructions remain appropriate and whether staff can realistically follow them.
Check the details that tend to become detached from daily operations: named leads, escalation contacts, software, opening hours, referral routes, cover arrangements and links to related procedures.
Then test the instructions with the people responsible. If a policy says a deputy performs a daily check, establish who that deputy is and whether they have the necessary access. Where practice differs from the document, assess whether the process, the wording or both need to change.
Templates need more than the surgery’s name added to the header.
For information governance policies, the ICO’s audit framework recommends defined responsibilities, approval, version control, review arrangements and communication to staff. This is data protection guidance; it should not be presented as a universal CQC document format.
Record what was checked, who reviewed it and what changed. If a full review confirms that no amendment is needed, record that outcome. If only one section was checked, describe the limited scope accurately.
-
Keep evidence that helps explain how important policies are implemented, monitored and improved. The most useful records come from ordinary governance activity and can be located without assembling a large new inspection dossier.
CQC’s GP governance guidance identifies policy reviews, risk assessments, audit findings and meeting records among potentially relevant evidence. It also explains that inspectors speak with staff about responsibilities and how decisions are communicated.
A practical evidence index might include:
Results handling - Workflow audit, agreed cover arrangements and follow-up on identified gaps
Infection prevention - Relevant audit findings, assigned actions and checks that actions were completed
Incident management - Recorded learning, resulting procedural changes and subsequent checks
Business continuity - Exercise or disruption debrief, revised contacts and actions taken
Staff policy awareness - Induction records, acknowledgements linked to versions and relevant discussions
These are suggested examples, not documents that every assessment will request.
Reading acknowledgements show that staff have confirmed reading a document. Understanding may need discussion, observation or a practical check. Ask staff to find a relevant procedure and explain what they would do if something went wrong.
Keep confidential supporting records in appropriately restricted locations. An evidence index can point to them without copying sensitive material into a widely accessible policy folder.
-
Address immediate safety concerns first, then give remaining work clear ownership, deadlines and oversight. An action plan records how a gap is being managed; it does not remove the need to correct unsafe arrangements.
For each unresolved issue, record the concern, its possible impact, any interim controls, the responsible person and the completion date. Significant risks should reach the relevant clinical lead, registered manager or partners promptly.
If unsafe instructions are discovered, obtain appropriate advice, correct or withdraw them and tell affected staff what to do. The document’s formal approval process must not leave staff relying on instructions known to be unsafe.
Avoid preparation shortcuts that make the history less reliable: moving review dates without a review, backdating approval or asking managers to confirm reading on behalf of staff.
Other problems worth checking include duplicate policies with conflicting instructions, documents naming people who have left and new procedures introduced without briefing staff.
Be precise about progress. “Policy revised; staff briefing outstanding” gives a more useful account than marking the whole action complete. Where a new process has only recently started, distinguish implementation from evidence that it has been sustained.
-
Before an assessment, check whether the library is accurate, accessible and connected to evidence of everyday use. A short check with colleagues can expose problems that are difficult to spot while reviewing documents alone.
Findability: Can reception, nursing and clinical colleagues locate the relevant current procedures using their usual access?
Version control: Do electronic copies, printed instructions and induction materials agree?
Local accuracy: Are contacts, systems, responsibilities and cover arrangements correct?
Coverage: Do policies reflect the services and sites actually operated?
Approval: Is there a clear record of who authorised significant changes?
Communication: Have affected staff, including relevant locums and PCN staff, received and understood those changes?
Follow-through: Can owners show what happened after an audit, incident or policy review identified a problem?
Outstanding work: Are unresolved issues visible to leaders, with appropriate interim action?
Assessment requests: Are requested documents clearly labelled and ready to provide through the agreed route?
Test retrieval when the usual policy administrator is unavailable. A library that depends on one person remembering where everything is stored remains difficult to use.
-
Begin with a manageable review of the policies carrying the greatest operational risk. Use what you learn to improve the wider library and its routine maintenance.
Create one current register and identify conflicting versions.
Select an initial group of priority policies using known risks, recent changes and outstanding findings.
Ask each owner to check the document and the working process, recording discrepancies and decisions.
Brief affected staff and check implementation, with leadership oversight of unfinished work.
The useful outcome is a policy library the practice can rely on during a busy working day, supported by a clear account of what has been checked and what still needs attention.