What Good Governance Looks Like in Complex Care

The health and social care landscape is a complex, heavily regulated environment. The current single assessment framework is used by the Care Quality Commission to inspect regulated services. Quality statements are used within each CQC domain, including "Involving People to Manage Risks", "Consent to Care and Treatment", and "Governance Management and Sustainability". Quality statements aim to provide a contextual breakdown of how each inspection area (e.g. consent, risk, governance, etc) translates into the provider's environment.

For instance, "Consent to Care and Treatment" may look different for a medium or low secure service as opposed to a nursing home and care home, where in an inpatient setting the Mental Health Act (1983) sits alongside the Mental Capacity Act (2005) in relation to many areas of treatment for mental disorders, as opposed to treatment for physical health disorders, as explored by Wheeler and Ruck Keene (2021). Whereas a nursing home environment is often governed by wider pieces of statutory legislation such as the Care Act (2014), Health and Social Care Act (2012) and specific decision-making legislation, the Mental Capacity Act (2005). Notwithstanding these provisions, complex care is just that, complex. Not least because of the wide-ranging legislation detailed here, but also the way in which an organisation governs its activities and manages risks.

Defining governance

Firstly, a definition is required. Internationally, governance is a term defined by The Office of the High Commissioner for Human Rights (2026) as the "processes of governing, the institutions, processes and practices through which issues of common concern are decided upon and regulated". Locally, governance may be described as the structures, systems and processes that ensure a service is safe, effective, and responsive to the needs of individuals and communities.

Therefore, the question is "how can providers govern their activities consistent with a provider's obligations under the Health and Social Care Act 2008 (Regulated Activities) Regulations (2014) Regulation 17 Good Governance?" That is a tricky question to explore. Naturally, providers turn to the regulator (i.e. CQC) in an attempt to gain a further understanding of what "Good Governance" means in practice. The Care Quality Commission provides a response to this, by outlining a breakdown of what specific subsections in Regulation 17 compel a provider to comply with and the guidance on how further to think about how each section can be applied, for example:

Guidance on Section 17(2)(b) by the Care Quality Commission

• Providers must have systems and processes that enable them to identify and assess risks to the health, safety and/or welfare of people who use the service.
• Where risks are identified, providers must introduce measures to reduce or remove the risks within a timescale that reflects the level of risk and impact on people using the service.
• Providers must have processes to minimise the likelihood of risks and to minimise the impact of risks on people who use services.
• Risks to the health, safety and/or welfare of people who use services must be escalated within the organisation or to a relevant external body as appropriate.
• Identified risks to people who use services and others must be continually monitored and appropriate action taken where a risk has increased.

Source: CQC guidance on Regulation 17

Where providers usually stop

Taken together, the guidance and the statute assert the rule of risk management in various forms. Risks not only to health and safety but also wider operational risks, clinical risks, physical risks, violence and aggression risks, financial risks and so on. The consequential provider response to this requirement is a risk assessment, and perhaps a risk management policy, often provided by commercial policy organisations providing policy suites, insert your company name, responsible role and logo. Often that is where providers stop.

Client focused risk management such as a mobility risk assessment, challenging behaviour risk assessment, and nutrition risk assessment are often seen to be updated monthly, where necessary. Typically, to fulfil a provider's audit requirements, this in isolation is a great start. But is that sufficient in terms of Section 17(2)(b)? How do we monitor the risks over time? To comply with the guidance on Section 17(2)(b), providers must trend identify, monitor themes with input from external bodies where needed. Relating closely to the statutory notification requirements set forth in the (Registration) Regulations 2009, Regulation 18 as well as Local Authority Safeguarding Board notifications, the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013, among others.

When providers update risk assessments, such as the above, it is common that we see "remains relevant in practice" or "remains effective". Does this provider oversee risks over time? Does this provider have an analysis of how effective the mitigation is? Could another mitigation be introduced which is more effective? Does an outside body of knowledge need to be consulted? Furthermore, when provider organisations face incidents relating to such risks, are the mitigations being followed? Is there a disconnect between your policy literature on how that risk should be managed, the care plan being followed, and the care records, and incident records delineating how that risk is actually being managed? Often not. There are many risk management cycles, most notably the Institute of Risk Management.

How does this relate to social care?

Broadly, risks need to be:

• updated following changes in their nature, intensity, frequency, etc;
• tracked over time to triangulate with mitigations and other factors such as staffing etc, to see what's more effective and when;
• communicated with staff;
• ensured that staff understand the evolving nature of their clients' risk, through vehicles such as meeting minutes, memos and spot check observational audits.

And often the biggest gap in providers' risk management practices:

Risks updated with the client to show compliance against the "Involving People to Manage Risks" quality statement.

Not just to show compliance with the Good Governance Regulation (17), but also to provide a person-centred way of involving people to manage their own risks, their own care and how safeguarding relates to them, in their circumstances. In reflection of that, I ask, how would you provide person-centred care (consistent with provider responsibilities under Regulation 9 Person-centred care) if that person you are caring for has not been involved in managing their risks? Mainly, it asserts an element of responsibility for one to manage their risks, and it ensures compliance with person-centred care practices mentioned above.

Governance as a live system

Ultimately, good governance in complex care is a live system of oversight, assurance and improvement. It requires providers to know their risks, monitor how those risks change, involve people in decisions about their care, communicate effectively with staff and act promptly when concerns arise. When done well, governance becomes more than a regulatory requirement. It becomes a practical way of improving safety, quality and person-centred care.

References

1. Care Quality Commission. Regulation 17: Good governance. Available at: cqc.org.uk (Accessed: 1 August 2026).
2. Care Quality Commission. Regulation 18: Notification of other incidents. Available at: cqc.org.uk (Accessed: 1 August 2026).
3. Great Britain. Care Act 2014. Chapter 23. London: The Stationery Office. Available at: legislation.gov.uk (Accessed: 1 August 2026).
4. Great Britain. Care Quality Commission (Registration) Regulations 2009, Regulation 18: Notification of other incidents. SI 2009/3112. London: The Stationery Office. Available at: legislation.gov.uk (Accessed: 1 August 2026).
5. Great Britain. Care Quality Commission (Registration) Regulations 2009. SI 2009/3112. London: The Stationery Office. Available at: legislation.gov.uk (Accessed: 1 August 2026).
6. Great Britain. Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, Regulation 17: Good governance. SI 2014/2936. London: The Stationery Office. Available at: legislation.gov.uk (Accessed: 1 August 2026).
7. Great Britain. Health and Social Care Act 2008 (Regulated Activities) Regulations 2014. SI 2014/2936. London: The Stationery Office. Available at: legislation.gov.uk (Accessed: 1 August 2026).
8. Great Britain. Health and Social Care Act 2008. Chapter 14. London: The Stationery Office. Available at: legislation.gov.uk (Accessed: 1 August 2026).
9. Great Britain. Health and Social Care Act 2012. Chapter 7. London: The Stationery Office. Available at: legislation.gov.uk (Accessed: 1 August 2026).
10. Great Britain. Mental Capacity Act 2005. Chapter 9. London: The Stationery Office. Available at: legislation.gov.uk (Accessed: 1 August 2026).
11. Great Britain. Mental Health Act 1983. Chapter 20. London: The Stationery Office. Available at: legislation.gov.uk (Accessed: 1 August 2026).
12. Great Britain. Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013. SI 2013/1471. London: The Stationery Office. Available at: legislation.gov.uk (Accessed: 1 August 2026).
13. The Office of the High Commissioner for Human Rights (2026). About good governance [online]. Available from: ohchr.org [Viewed 1 August 2026].
14. Wheeler, R. and Ruck Keene, A. (2021). Compulsory treatment of physical illness under MHA 1983. Journal of Medical Ethics [online]. medethics-2021-107438. doi: 10.1136/medethics-2021-107438 [Viewed 1 August 2026].

Speak to Beaumont Ridge Care Group

If your organisation is managing complex care, regulatory pressure, service instability or governance gaps, Beaumont Ridge Care Group can help you review what is working, identify risk points and strengthen the systems around care delivery.