Does the CQC provide a list of required policies?

No. The CQC does not publish a mandatory policy list. It expects the arrangements described by policies — for safeguarding, medicines, recruitment, governance and so on — to be in place, current and followed in practice, and it reviews the evidence against the 34 quality statements.

How often should CQC policies be reviewed?

Review each policy on a set cycle — annually as a minimum — and additionally whenever the underpinning law or national guidance changes. Record the review date, version and next-review date so you can evidence a controlled review cycle at inspection.

Are free CQC policy templates good enough?

Free templates can be a starting point but are often generic, not mapped to the regulations or quality statements, and quickly out of date. For inspection you need policies that are current, personalised to your service and demonstrably followed by staff.

What happens if my policies are out of date at inspection?

Out-of-date or unfollowed policies are commonly cited under the well-led key question as weak governance. It can contribute to a lower rating and to requirement or enforcement actions, so keeping policies current and evidencing that staff apply them matters.

How many policies does a CQC-registered service need?

There is no fixed number. Most adult social care providers end up with somewhere between 60 and 150 policies depending on the regulated activity, client group and service model. What matters is coverage — every regulation, risk and routine activity in your Statement of Purpose should be addressed — not hitting a target count.

What is the difference between a policy and a procedure?

A policy states what your service does and why, setting the principle and the accountability. A procedure sets out how staff carry it out step by step. Inspectors test both: the policy tells them what you promise, the procedure and the records tell them whether it happens.

Do staff need to sign that they have read each policy?

Yes — recording that staff have read and understood relevant policies is key evidence that your written procedures are actually applied. An acknowledgement log linking each staff member to the policy versions they have accepted is the simplest way to prove it.

CQC

CQC policies and procedures: the complete guide

By Cura Compliance UK · Updated 29 July 2026

CQC policies and procedures are the written rules that set out how a care service delivers safe, effective, caring, responsive and well-led care. Every CQC-registered provider must have them, keep them current, and be able to show staff follow them. They are the backbone of the evidence the Care Quality Commission reviews at inspection.

What are CQC policies and procedures?

A policy states what your service does and why; a procedure sets out how staff do it in practice. Together they translate regulations — the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 — into day-to-day working instructions. The CQC does not publish a fixed list of mandatory policies, but it does expect the arrangements those policies describe to exist and to be followed.

In other words, inspectors are not ticking off document titles. They are checking that what your policy promises is what actually happens on the ground, and that staff, people using the service and records all tell the same story.

Which policies does a CQC-registered service need?

The exact set depends on your regulated activity and client group, but almost every adult social care provider needs policies covering these areas:

Safeguarding adults (and children where relevant) and whistleblowing
Safe recruitment, DBS checks and staff induction
Medicines management (administration, storage, errors)
Infection prevention and control
Health and safety, including lone working and moving and handling
Person-centred care planning and consent / mental capacity (MCA and DoLS)
Dignity, equality, diversity and human rights
Complaints, compliments and duty of candour
Governance, audit and record keeping (including data protection)
Business continuity and emergency planning

How policies map to the CQC quality statements

Under the single assessment framework the CQC assesses services against 34 quality statements grouped under the five key questions — safe, effective, caring, responsive and well-led. Your policies provide much of the documentary evidence for these statements. For example, your safeguarding policy underpins the "safeguarding" quality statement, while your audit and oversight arrangements evidence the "governance, management and sustainability" statement under well-led.

The strongest evidence is not the policy alone but the chain from policy to practice: a current policy, staff trained on it, records showing it is applied, and audits that catch and fix lapses. See how to prepare for a CQC inspection for how inspectors test that chain, cross-checking your documents against what staff say and what records show.

CQC policies for domiciliary care and care homes

The core set is common to both, but the risks differ and so does the detail. Domiciliary care policies carry more weight on lone working, travel and missed or late visits, entry to people's homes and key security, and remote supervision of staff you rarely see. Care home policies deal with the risks of a shared building: fire safety and evacuation of people with mobility needs, catering and nutrition, visiting, and deprivation of liberty safeguards applied at scale.

A supported living service sits between the two — the building is the person's home, so restrictive practice, tenancy and choice run through the whole set. Adopting a policy library written for the wrong service model is a common and expensive mistake: see the domiciliary care policies checklist for what a home care set specifically needs.

Medicines management: the most scrutinised policy you own

Medicines is where policy failures become harm fastest, and inspectors know it. Your procedure needs to cover the whole chain — ordering, receipt, storage and temperature, administration and recording, refusal, covert administration under a best-interests decision, controlled drugs, PRN protocols with clear criteria, disposal, and what happens when something goes wrong.

That last part matters most. A service with zero recorded medication errors is not a safe service; it is a service that is not reporting. Inspectors look for errors to be recorded, investigated, learned from and fed back into training — evidence of an open culture rather than an unblemished record.

How risk assessments connect to policy

Policies describe your general approach; risk assessments apply it to a particular person, task or premises. The two have to join up. A moving and handling policy that requires a written assessment before any transfer is worthless if the care plans contain none, and an inspector will find the gap by pulling a file rather than by reading the policy.

Every risk assessment named in a policy should exist in practice, and be reviewed on the cycle the policy states
Assessments should be person-centred and dated, not generic forms copied between files
Where a risk is accepted, record the decision, who made it and the person's own view
Changes in need should trigger a review — evidence that the loop is live, not annual paperwork

Training, competency and proving staff follow policy

The gap between having a policy and evidencing it is usually training. Reading a document is not competence. For higher-risk areas — medicines, moving and handling, safeguarding, mental capacity — inspectors expect assessed competence, refreshed on a stated cycle, with a record of who is signed off for what.

The strongest evidence chain runs: current policy, staff acknowledgement of the version they were trained on, training and competency records, supervision notes discussing practice, audits sampling whether it happens, and actions closed out where it did not. Any link missing and the policy becomes an assertion rather than evidence.

Complaints, concerns and duty of candour

Your complaints procedure must be accessible to people using the service and their families, set out timescales, and explain how to escalate to the Local Government and Social Care Ombudsman if they remain unhappy. Regulation 20 adds a separate duty of candour: when a notifiable safety incident occurs, you must tell the person affected, apologise, explain what is known, and keep a written record of having done so.

As with medicines, an empty complaints log is a warning sign rather than a good result. Well-led services can show they receive concerns, act on them, and change something as a result.

Keeping policies inspection-ready

Out-of-date policies are one of the most common and most avoidable findings. A policy that still cites superseded guidance, names a manager who left two years ago, or was last reviewed outside your stated review cycle signals weak governance — exactly what the well-led key question probes.

Give every policy a version number, an owner, a review date and a next-review date
Review on a set cycle (annually as a minimum) and whenever law or guidance changes
Record that staff have read and understood each policy — an acknowledgement log is your evidence
Keep a single controlled copy so there is never doubt about which version is current

Templates versus writing your own

Writing every policy from scratch is slow and easy to get wrong; generic free templates are often unbranded, unmapped to the regulations and quickly stale. A maintained, regulator-aligned policy library gives you the best of both: a complete set you can adopt immediately, personalised with your organisation's details, and kept current as the rules change. Weigh the options in care policy templates vs building your own.

How CuraFlow helps

CuraFlow gives CQC-registered providers a complete, version-controlled policy library mapped to the quality statements, auto-filled with your company details, with staff acknowledgement tracking and Word and PDF downloads. When a policy is updated you are notified, so your set stays inspection-ready without manual chasing. See pricing and free samples or browse a library by service type in the policy catalogue.

Frequently asked questions

Does the CQC provide a list of required policies?: No. The CQC does not publish a mandatory policy list. It expects the arrangements described by policies — for safeguarding, medicines, recruitment, governance and so on — to be in place, current and followed in practice, and it reviews the evidence against the 34 quality statements.
How often should CQC policies be reviewed?: Review each policy on a set cycle — annually as a minimum — and additionally whenever the underpinning law or national guidance changes. Record the review date, version and next-review date so you can evidence a controlled review cycle at inspection.
Are free CQC policy templates good enough?: Free templates can be a starting point but are often generic, not mapped to the regulations or quality statements, and quickly out of date. For inspection you need policies that are current, personalised to your service and demonstrably followed by staff.
What happens if my policies are out of date at inspection?: Out-of-date or unfollowed policies are commonly cited under the well-led key question as weak governance. It can contribute to a lower rating and to requirement or enforcement actions, so keeping policies current and evidencing that staff apply them matters.
How many policies does a CQC-registered service need?: There is no fixed number. Most adult social care providers end up with somewhere between 60 and 150 policies depending on the regulated activity, client group and service model. What matters is coverage — every regulation, risk and routine activity in your Statement of Purpose should be addressed — not hitting a target count.
What is the difference between a policy and a procedure?: A policy states what your service does and why, setting the principle and the accountability. A procedure sets out how staff carry it out step by step. Inspectors test both: the policy tells them what you promise, the procedure and the records tell them whether it happens.
Do staff need to sign that they have read each policy?: Yes — recording that staff have read and understood relevant policies is key evidence that your written procedures are actually applied. An acknowledgement log linking each staff member to the policy versions they have accepted is the simplest way to prove it.

Ready-to-use, regulator-aligned policies for your service

Browse the domiciliary care policy library