Well-led · KLOE 4

Governance and management

Are there clear roles, responsibilities and systems of accountability to support good governance and manage risks, performance and issues?

In brief

Governance and management is key line of enquiry 4 under the Well-led key question in the Care Quality Commission (CQC) draft adult social care assessment framework (v9, 19 March 2026), currently published for consultation. It covers roles, responsibilities and accountability, governance, quality assurance and management, service risk management, cyber security and data security and protection toolkit (dspt), data security/data protection and general data protection regulation (gdpr), statutory and regulatory requirements, workforce planning, records/digital records. CQC describes performance against it at four rating levels: Outstanding, Good, Requires improvement and Inadequate. Each statement and rating characteristic quoted here is reproduced verbatim from CQC's draft; plain-English summaries are HLTH's own.

Key question: Well-led
Line of enquiry: KLOE 4 of 6 under Well-led
Rating levels: Outstanding, Good, Requires improvement, Inadequate
Source: Adult social care assessment framework, v9 (19 March 2026)
Status: Draft, published by CQC for consultation
Reference: pp. 58–61 of the CQC draft

Scope and topic areas

What this line of enquiry covers

Scope of this key line of enquiry and topic areas include:

Roles, responsibilities and accountability
Governance, quality assurance and management
Service risk management
Cyber security and Data Security and Protection Toolkit (DSPT)
Data security/data protection and General Data Protection Regulation (GDPR)
Statutory and regulatory requirements
Workforce planning
Records/digital records

Rating characteristics

How CQC describes each rating

The four characteristic sets for this KLOE, best to worst. Every point is CQC's wording, reproduced exactly.

Outstanding

In plain terms: Care is exceptional and consistently better than the Good standard.

Governance arrangements are proactively reviewed and reflect good practice. They are supported by rigorous, inclusive systems that empower staff at all levels to identify and drive positive outcomes for people who use the service.
There is a demonstrated commitment across the service to good practice, service performance and risk management systems and processes. Staff are engaged, respected and supported to use these systems effectively, addressing problems openly and swiftly through collaborative and responsive leadership.
The service has well-designed, good practice information systems and processes. These provide reliable, timely and relevant information which is used in reporting, performance management and care delivery, facilitating improvement and innovation.
Emergency preparedness and business continuity plans reflect the service and wider system. Leaders work with partners in the system to achieve cohesive plans that support people and local communities.

Good

In plain terms: The service meets the expected standard.

There are clear and effective governance, management and accountability arrangements. Staff understand their roles and responsibilities. Managers can account for the actions, behaviours and performance of staff.
Data or notifications are consistently submitted to external partners as required.
There are secure and reliable arrangements for the availability, integrity and confidentiality of data, records and data management systems. Information is used effectively to monitor and improve the quality of care. Staff understand their responsibilities when collecting and sharing information.
Leaders are aware of relevant quality frameworks, standards, legislation and statutory guidance. These are implemented and used to improve equity and tackle known inequalities.
Leaders and staff understand regulatory requirements. There are effective processes to keep up-to-date with all relevant changes, and staff understand these.
The service has an accurate statement of purpose that clearly reflects current service provision.
There are effective systems for monitoring and managing service performance, risk and learning from incidents that support innovation while maintaining the quality of care at the service.
People can see that their opinions and experiences are considered in the service’s policies and procedures.
Staff feel confident and supported to do their job by following the established processes.
There are thorough business continuity plans in place for emergencies or natural disasters, such as adverse weather events, and staff know how to put these into practice.

Requires improvement

In plain terms: The service is not yet Good and has areas that must improve.

Governance and accountability arrangements are not consistently reliable, effective or regularly reviewed.
Processes may be excessive or inaccessible and may inappropriately reduce autonomy of staff.
Not all staff understand their roles and responsibilities.
Required data and notification submissions are sometimes missed.
There are shortfalls in record keeping and data management. Records may be incomplete, inaccurate or out-of-date. Records are not stored appropriately and securely. Not all staff understand data protection requirements where this is relevant. Data is inconsistently collected, stored, used and shared appropriately and legally.
Information is not regularly available or used effectively to monitor and improve the quality of care.
There is variability in the recognition, understanding and implementation of relevant quality standards, and legal requirements are not consistently understood or fulfilled.
Leaders and staff have an inconsistent understanding of regulatory requirements. They do not keep adequately up-to-date or understand relevant changes.
Risks are inconsistently identified or managed. Systems for managing service performance and risk are inadequate and/or are not regularly reviewed to ensure they are effective.
Quality assurance arrangements are inconsistently applied or are ineffective. There are gaps in identifying improvements. Action to introduce improvements can be absent, reactive, focused on the short term or not reviewed. Information needs are not regularly reviewed.
The voice of people with lived experience is not appropriately represented in decision making in the service, including strategic decisions, risk assessments or quality improvement. Engagement may be limited or absent.
Business continuity plans are minimal or would not meet the needs of people using the service. Not all staff are unaware of them or how to apply them.

Inadequate

In plain terms: Performance is well below the expected standard; enforcement may follow.

Governance, performance management and accountability arrangements are poor or absent.
Processes are often excessive or inaccessible for staff. They are implemented or maintained in a way that inappropriately reduces autonomy and obstructs staff from doing their job.
Roles, responsibilities and accountability arrangements are not clear.
The service does not recognise the need to submit required data and notifications, or these are usually not submitted.
Understanding of data protection requirements is poor and there are serious shortfalls in meeting them. There may have been preventable incidents of data breaches.
There is a poor understanding of relevant mandatory quality frameworks and standards, and some legal requirements are not met.
Leaders and staff lack understanding of CQC’s regulatory requirements and have a poor track record of meeting them.
The service does not have an up-to-date or accurate statement of purpose.
Systems for identifying, capturing and managing service risks and issues are ineffective.
Quality assurance arrangements are not present or, if they are, they are ineffective.
Business continuity plans are not in place or do not meet the needs of people using the service. Staff do not understand them or know what to do in an emergency.

Reading these against your own evidence is where most providers get stuck. We can walk it through with you.