The policy everyone followed: what a coroner's report says about policies and the concerns we don't count - CW for Suicide.

We talk a lot about "write-only" policies. You know the type: drafted carefully, approved at committee, uploaded to the shared drive and never opened again. Staff couldn't tell you what's in them, and nobody can remember the last time one changed anything.

A Prevention of Future Deaths report published by the Chief Coroner's office in September shows the other side of the same coin. In this case staff knew the policy. They followed it closely. That was part of the problem.

What the coroner found

Robert Day was 60 and under the care of community mental health services in Kent for severe depression. He died in January 2025, and the inquest concluded that he had taken his own life. In March 2026 Ian Potter, Area Coroner for Kent and Medway, wrote to the trust's chief executive setting out concerns he believed could lead to future deaths if nothing changed.

Most of them sat under one heading: professional curiosity. The coroner heard that:

•      "home visits" had been held in public places, so clinicians never saw how he was actually living

•      the trust's Did Not Attend policy had been applied very strictly, with little real thought about why appointments were being missed, and one witness felt the policy itself was the issue

•      his sister contacted the trust with concerns at the start of January; two nurses visited that same day, but the plan they recorded was described in evidence as not reasonable, and a referral to the rapid response team would have been expected

•      some staff judged him on how he presented on a single day, without looking back at his history

A separate concern covered record keeping. On 14 January a paramedic sought advice from the trust's phone line, and there was no record of that call or the advice in his notes.

It matters to be precise here. The coroner did not find that these failings caused Robert's death. His concern was about what happens next, and he said he was not reassured when a manager explained they didn't want to roll changes out across every team in case it looked like a knee-jerk reaction.

Write-only, read-only: the same problem

A write-only policy fails because nobody uses it. A read-only policy fails because people use it instead of thinking.

Non-attendance policies are the classic case. Their job is to stop people falling through the gaps when they don't turn up. Applied without curiosity, they become the gap. Missed appointment, letter, second missed appointment, discharge. Every step compliant, and nobody asking why someone who is depressed and isolated has stopped engaging.

The answer isn't another policy. It's building the question into the one you already have. A good missed-appointment policy doesn't just say what to do after two DNAs. It asks the clinician to record what they think is going on, and who they've checked with, before they act.

The sister's phone call is data

Then there's the call from his sister. It almost certainly wasn't logged as a complaint, and most organisations wouldn't count it as one. But a worried relative picking up the phone is exactly the kind of signal a concerns system exists to catch. It's also the cheapest intelligence a provider will ever get.

This is why we keep coming back to complaints data as a gift rather than a nuisance. The formal complaint about a billing error or a curt receptionist matters. The informal ones matter more: the worried sister, the "he doesn't seem himself" at reception, the carer who mentions something in passing. That's where risk shows up first. A complaints log that only holds what arrived in writing is missing most of the story, and with it your early warnings.

Why this matters in the independent sector

Private and independent providers run on the same kinds of documents: cancellation and missed-appointment policies, discharge-after-non-attendance rules, sometimes fees. Because they're often written with admin and commercial reasons in mind, they're more likely to be applied mechanically, not less. And families of private patients often have fewer obvious routes to raise a worry, so what they say on the phone or at the front desk carries even more weight.

Five questions to ask this month

1.     When did a policy last change because of something that happened on the floor, rather than because its review date came round?

2.     Does your missed-appointment or non-attendance policy require someone to ask why before they act?

3.     Where does a worried relative's phone call go? Is it logged anywhere a manager, or the board, would ever see it?

4.     When you audit policy compliance, do you ever ask whether following the policy was the right call?

5.     If a fix is needed in one team, what stops you making it in all of them?

That last one is really the coroner's point. Making a change everywhere isn't a knee-jerk reaction. It's governance.

If this post has raised anything difficult for you, Samaritans are available day or night, free, on 116 123.

Source: Regulation 28 Report to Prevent Future Deaths, Robert Day (ref. 2026-0372), Courts and Tribunals Judiciary: https://www.judiciary.uk/wp-content/uploads/2026/09/Robert-Day-Prevention-of-future-deaths-report-2026-0372_Published.pdf

Chapter 8: Culture — The Board as Guardian of "How We Do Things Here"

What Good Looks Like — a board-level guide to governance done well

Culture is usually described as "how we do things around here". It's the honest answer to what actually happens when nobody senior is watching. Which is exactly why it's so hard for a board to see.

Most boards treat culture as an HR topic. It turns up once a year with the staff survey, gets a twenty-minute slot, and goes back to the people team. But culture decides whether a policy is followed or quietly worked around, whether a concern is raised or swallowed, and whether bad news travels up or stops at the first manager. That makes it a governance question, and one only the board can own.

Chapter 5 looked at the information a board sees. Culture is where that problem is sharpest, because the signals are soft, scattered and easy to explain away.

Why culture belongs to the board

Every other part of the governance framework depends on it. A risk register only works if people feel safe to name the risk. Incident reporting only works if staff believe reporting leads to learning, not blame. A Freedom to Speak Up Guardian only works if speaking up doesn't cost people anything.

The board sets the tone, whether it means to or not. What it asks about, what it praises, what it lets pass, and how it treats the person who brings bad news are all signals that travel down the organisation faster than any values poster. (Also, posters never, ever work!!)

Hearing about culture versus seeing it

Most boards hear about culture. A survey summary, an engagement score, a slide of staff quotes chosen by the people presenting them. All useful, but all filtered, and all reported by those with an interest in the answer.

Seeing culture is different. It means looking for the evidence that people can't easily polish:

•      Patterns, not averages. Which teams report fewer incidents than you'd expect? Where are sickness, turnover or agency use higher? A quiet team isn't always a safe one.

•      What staff do, not what they say. Who raises concerns, through which route, and what happens to them afterwards?

•      What patients and families tell you. Complaints read in full, not counted. Themes that repeat across months.

•      What the board sees for itself. Visits to services, unannounced where possible, at night and at weekends, talking to the people doing the work rather than the people managing it.

The question isn't "is our culture good?" It's "what would we expect to see if it wasn't, and are we looking?"

What it looks like when it fails

The independent investigation into maternity and neonatal services in East Kent, published in October 2022, was titled Reading the signals. The title was the point. The investigation found "gross failures of teamworking across the Trust's maternity services", and that the Trust "too often treated the concerns expressed by families as 'noise'".

It also found that "the Trust Board itself missed several opportunities" to identify the scale of the problems. The signals were there, in families' accounts, in staff behaviour and in outcomes. The culture had made them easy to dismiss.

Where to start

None of this needs a culture programme. It needs a board that decides to look.

Put culture on the agenda as a governance item. Not just once a year with the staff survey. Pick two or three culture indicators and look at them every quarter, alongside quality and finance.

Ask for the outliers. The team with the lowest incident reporting, the highest turnover, the most complaints, the fewest concerns raised. Then ask why.

Go and see. Every board member should visit services regularly, including out of hours, and share what they saw at the next meeting. Not as inspection, but as listening.

Follow one concern through. Once a year, take a concern someone raised and trace what happened to it, and to them. It will tell you more about your speaking-up culture than any survey.

Watch the board's own behaviour. How the board responds to bad news is the strongest culture signal of all. If the messenger is thanked, more messages follow. If not, they stop.

Chapter 7: Strategy — Setting Direction Without Setting the Detail

What Good Looks Like — a board-level guide to governance done well

Ask a board what it does on strategy and most will say it "approves" it. That's the problem. Approval is the last step, and by the time a strategy arrives for sign-off, the thinking that matters has already been done, or skipped.

Chapter 2 drew the line between oversight and management. Strategy is where that line is hardest to hold. Boards are told to shape strategy, not just rubber-stamp it. They're also told not to run the business. Somewhere between those two instructions is the useful part.

What boards are actually for in strategy

The executive team builds the strategy. They know the services, the market, the workforce and the numbers far better than any non-executive can. The board's job is different. It sets the direction the strategy has to serve, and it tests whether the strategy will get there.

In practice that means a handful of things. Agreeing what the organisation is for, and what it won't do. Setting the boundaries: how much risk, how much debt, which lines can't be crossed on quality. Testing the assumptions a plan rests on. And holding the executive to account for delivery, once the plan is agreed.

None of that requires the board to write a single line of the plan.

Drifting too far back

The first failure is a board that leaves strategy entirely to the executive. The plan arrives polished, the presentation is confident, and the board's role shrinks to asking for clarification and saying yes.

HBOS is the classic case. The Parliamentary Commission on Banking Standards concluded that "the strategy set by the Board from the creation of the new Group sowed the seeds of its destruction." More striking still, it found that "the Board, in its own words, had abrogated and remitted to the executive management the formulation of strategy". By its own account, the board had handed strategy away.

Drifting too far forward

The opposite failure looks more energetic, and it's just as damaging. A board that rewrites the executive's plan line by line, debates which site should open first, or reopens a decision every time a director has a new idea isn't challenging. It's second-guessing.

The signs are usually easy to spot. The same decision comes back to the board three times. Board papers grow longer because executives are trying to pre-empt every question. Directors start proposing their own alternatives in the meeting. And the executive team, slowly, stops owning the plan, because the board has made it clear that it's really theirs.

Where challenge tips into second-guessing

The difference isn't how hard the question is. It's what the question is aiming at.

Challenge tests the reasoning. "This plan assumes we can recruit 40 nurses in 12 months. What happens to the plan if we only find 20?"

Second-guessing substitutes the board's judgement for the executive's. "I think we should open in Leeds instead of Manchester."

The first question leaves the executive owning the answer and makes the plan stronger. The second takes ownership away, often on the basis of less information than the executive already has.

A useful rule of thumb: challenge asks "how do you know?" and "what if you're wrong?" Second-guessing says "I'd do it differently." If a director genuinely thinks the executive has made the wrong call, the right response is to say so clearly, once, and to ask what evidence would change their mind. Then the board decides, and lives with the decision.

Where to start

A few habits make the difference.

Get involved early, not late. Hold a strategy session before the plan is drafted, to agree direction, boundaries and the questions the plan must answer. Approval then becomes a check, not a first look.

Write down what the board won't accept. Risk appetite, quality red lines, limits on borrowing. These are the board's real contribution to strategy, and they give the executive freedom inside them.

Test the three assumptions that matter most. Every plan rests on a few. Ask the executive to name them, and to show what happens to the plan if each one is wrong.

Decide once. When the board has agreed a strategy, it shouldn't reopen it without new evidence. Track delivery against agreed milestones instead.

Once a year, ask the executive how the board helped. And how it got in the way. The honest answer tells you which side of the line you've been on.

Chapter 6: Risk Oversight — Beyond the Register, Into the Room

What Good Looks Like — a board-level guide to governance done well

Every board has a risk register. Very few boards have a risk conversation. The register is a document. Oversight is what happens when directors sit round a table and decide whether they're comfortable with the risks the organisation is carrying.

Chapter 5 looked at how the information a board sees shapes what it does. The risk register is the clearest example. It arrives every quarter, it looks thorough, and it can quietly replace the thinking it was meant to support.

Why the register gives false comfort

Most risk registers are built in good faith. They still tend to fail in the same few ways.

Scores settle. A risk is rated 16 when it's first added, and two years later it's still 16, because nobody has a reason to change it. The number stops describing the risk and starts describing the habit.

Controls are listed, not tested. "Policy in place", "training delivered", "monitored at committee". Each one sounds like protection. None of them tells the board whether the control actually works.

Mitigations are intentions. "Review of staffing model underway" can sit on a register for a year. It reads as action. Often it's a plan to have a plan.

The register only holds what someone has already thought of. The risks that hurt organisations most are frequently the ones nobody wrote down, or the ones that were written down at the wrong size.

And red, amber and green do a lot of quiet work. A board that sees mostly amber tends to relax. Amber means a risk the organisation hasn't brought under control.

What a good risk conversation sounds like

The difference is easier to hear than to describe. A weak conversation goes something like this.

"Risk 7, agency staffing, remains at 16. Controls are in place and the action plan is on track. Any questions?"

"No, thank you. Next item."

A better one sounds more like this.

"Risk 7 has been at 16 for five quarters. What would have to happen for it to move, up or down?"

"Honestly, the score hasn't been reviewed properly since we set it."

"Then let's not rely on it. Which control would fail first if two senior nurses left in the same month? And how would we know before a patient did?"

The second conversation does three things the first doesn't. It treats the score as a claim to test, not a fact. It asks how controls fail, not whether they exist. And it brings the risk back to the people it would harm.

Good risk questions tend to share that shape. What's changed since we last looked? What are we assuming? What's the worst credible outcome, not the average one? What risk are we carrying that isn't on this list? And are we comfortable, as a board, with where this sits against our appetite?

What it looks like when it fails

Carillion collapsed into liquidation in January 2018. The joint report of the Work and Pensions and BEIS Committees opened with a blunt verdict: "Carillion's rise and spectacular fall was a story of recklessness, hubris and greed."

The committees were clear about the board's part in it. Non-executives, they wrote, "have a particularly vital role in challenging risk management and strategy and should act as a bulwark against reckless executives. Carillion's NEDs were, however, unable to provide any remotely convincing evidence of their effective impact." On the board's awareness of shareholder concerns about debt and the pension deficit, the report found that "the board minutes, however, show little sign of these positions being properly challenged".

When the senior independent director was asked whether the board should have been asking more probing questions, his answer, even with hindsight, was "perhaps". The papers existed. The risks were known. What was missing was the conversation.

Where to start

None of this means throwing the register away. It means using it to start the conversation, not to finish it.

Spend board time on a few risks, properly. Pick the three or four risks that would hurt most, and discuss them in depth each meeting. Let the committee work through the rest.

Ask what's changed. Any score that hasn't moved in a year should be challenged. Either the risk is stable and you can say why, or nobody's looking.

Test one control a quarter. Choose a control the register relies on and ask for evidence it works: an audit, a spot check, a walk-round. "Policy in place" isn't evidence.

Ask for the risk that isn't there. Once a year, ask executives and front-line leaders what keeps them awake that isn't on the register. Add what you hear.

Agree your appetite, then use it. A board that has said how much risk it will accept in safety, finance and reputation can judge each risk against that. Without it, every discussion starts from scratch.

Chapter 5: Information — What the Board Sees Shapes What the Board Does

What Good Looks Like — a board-level guide to governance done well

A board can only govern what it can see. Every judgement it makes about risk, quality or performance rests on the information put in front of it, and almost all of that information arrives through management. So the board pack isn't admin. It's the main way the board finds out what's actually going on.

Chapter 4 looked at the chair and CEO relationship, and the information route that runs between them. This chapter looks at what travels along that route, and how it changes on the way.

The pack that reassures

Most board packs aren't dishonest. They're written by busy people who want the board to feel the organisation is in good hands, and who know the board's time is short. So the pack gets longer, the language gets smoother, and the problems arrive with an action plan already attached.

The result is a familiar kind of document. Two hundred pages, a dashboard with almost everything green, and a covering report that says the amber items are "being actively managed". Directors read it, ask a few questions and move on. Everyone leaves feeling assured. Nobody has actually been told anything new.

How filtering happens

Management filtering is rarely a decision. It happens in small, reasonable steps. A ward manager summarises for the service lead. The service lead summarises for the director. The director summarises for the board. At each stage the detail that seems least important drops out, and the framing gets a little more confident. By the time a concern reaches the boardroom it has been averaged, contextualised and explained.

The usual signs are easy to spot once you look for them. Red ratings that turn amber without anything changing. Trend lines that start conveniently recently. Averages that hide the one service that's struggling. Incidents reported as numbers rather than as what happened to someone. A complaints summary with no complaints in it.

Informed or reassured?

This is the distinction that matters. Reassurance tells the board that things are fine. Information lets the board judge for itself whether things are fine.

A reassuring paper says "mandatory training compliance is 91%, above target". An informing paper says the same, then adds that the overnight team at one site is at 64%, and that's where two of this quarter's three medication incidents happened. The first lets the board relax. The second gives it something to decide.

Good boards learn to ask for the second kind, and to be suspicious of any pack that never makes them uncomfortable. If nothing in the papers has surprised the board for a year, the likeliest explanation isn't that nothing surprising has happened.

What it looks like when it fails

The public inquiry into Mid Staffordshire NHS Foundation Trust, published in February 2013, is still the clearest example in UK healthcare. In his letter to the Secretary of State, Robert Francis QC described "a serious failure on the part of a provider Trust Board. It did not listen sufficiently to its patients and staff or ensure the correction of deficiencies brought to the Trust's attention." He put that failure down in part to "allowing a focus on reaching national access targets, achieving financial balance and seeking foundation trust status to be at the cost of delivering acceptable standards of care."

The warning signs were there, in mortality figures, complaints and concerns raised by staff. The board saw finance and targets in detail and saw patient experience as reassurance. It governed the information it was given, and the information it was given wasn't the information it needed.

Where to start

None of this needs a new reporting system. It needs a board that decides what it wants to know, and a pack built to tell it.

Put a one-page front sheet on every paper. What is this, what does the board need to decide or know, and what's the honest assessment of the level of assurance? "Limited" is a perfectly good answer, and a far more useful one than silence.

Ask for the exceptions, not the averages. Organisation-wide figures are fine as context. The board also needs to see the outliers: the site, the team, the shift that's furthest from where it should be.

Hear from people, not just numbers. A patient story, a complaint read in full, a staff member's account of an incident. These are the things that filtering removes first, and the things that most often change a board's mind.

Go and look. Board visits to services, unannounced where possible, are how directors test whether the pack matches reality. If what you see doesn't match what you read, that tells you something important about the pack.

Once a year, ask what the board wasn't told. Look back at the year's incidents, complaints and inspection findings. How many did issues or problems did the board first hear about through its own papers, and how many from somewhere else?

The second number is the one to work on.

Chapter 4: The Chair–CEO Relationship — The Hinge Governance Swings On

What Good Looks Like — a board-level guide to governance done well

Every board has a hinge. It isn't in the terms of reference or the committee structure, and it rarely comes up in a board evaluation. It's the working relationship between the chair and the chief executive, and almost everything else a board does swings on it.

Chapter 2 drew the line between oversight and management. The Chair–CEO relationship is where that line gets held, or quietly given up, week in, week out. The chair leads the board. The CEO leads the organisation. When those two people work well together, a board functions: it hears bad news early, argues properly, and changes its mind when the evidence says so. When they don't, a board performs. It meets, minutes and approves, and has very little grip on what is actually happening.

Trust: the part nobody writes down

Good trust between a chair and a CEO has a simple test. Can the CEO ring the chair with a problem they haven't solved yet, and expect help rather than a black mark? Can the chair say "I'm not convinced" without the CEO hearing "I'm after your job"?

Where that trust is missing, the CEO starts managing the chair. Papers get polished until they reassure. Problems arrive solved or not at all. The chair senses it, starts going round the CEO to find out what's really happening, and the relationship gets worse from there.

Too much trust fails differently. The chair becomes the CEO's defender rather than the board's leader, and the two of them turn into a unit the rest of the board can't get past. Decisions get settled in the pre-meeting and ratified in the room.

Challenge: the chair's job is to make it normal

A chair doesn't need to challenge everything personally. The job is to make sure the board challenges well — specifically, proportionately, and at the decision rather than the person — and that the CEO experiences it as part of the role, not an attack.

When challenge is too weak, you get assurance by assertion. "The team are on it" becomes an acceptable answer to a serious question. When it tips into a running campaign against the CEO, executives stop bringing anything uncertain to the board, which is exactly what the board most needs to see.

Boundaries: where the lines sit

Most Chair–CEO breakdowns involve one of them drifting into the other's territory, usually with good intentions. A chair who is in the building three days a week, briefing managers directly, has become a shadow CEO. A CEO who decides what the board gets to see has taken over part of the chair's job.

The simplest protection is to write the split down. The UK Corporate Governance Code expects the responsibilities of the chair, chief executive, senior independent director, board and committees to be set out in writing and agreed by the board. It's also firm that the chair and chief executive roles shouldn't be held by the same person. Plenty of organisations aren't bound by the Code, but it's still the clearest benchmark around.

Wells Fargo is a well-documented case of what happens when all three give way at once. John Stumpf was both chairman and chief executive while the bank's retail sales practices scandal built up, with millions of accounts opened without customers' consent. The board's own independent investigation, published in April 2017, found sales practices weren't identified to the board as a noteworthy risk until 2014, and that management reports didn't accurately convey the scope of the problem. It concluded Stumpf was "too slow to investigate or critically challenge" what was going on. With one person leading both the board and the business, there was no separate chair whose job was to ask. After Stumpf stepped down in October 2016, the board split the two roles, appointed an independent chair, and changed its bylaws so the roles have to stay separate.

Where to start

None of this needs a restructure. It needs a few deliberate habits.

Write the split down, and look at it once a year. One page: what the chair leads, what the CEO leads, and what's shared. Agree it as a board, and revisit it whenever something big changes — a new CEO, new owners, a difficult inspection.

Agree what reaches the chair between meetings. A standing rule on which kinds of news go to the chair, and how quickly, stops the board hearing about a serious problem from someone other than the CEO.

Make sure there's a second route to the board. In a healthcare provider, that means the registered manager and the Freedom to Speak Up guardian can reach the chair without going only through the CEO. It isn't a vote of no confidence. It's how a board knows its main information line is working.

If the roles are combined, say how you compensate. An independent non-executive with a lead role, meetings of the non-executives without the executive present, and a plan for when the roles will split.

Once a year, talk about the relationship itself. Chair and CEO each answer the same questions separately. When did the CEO last bring an unsolved problem to the chair? When did the board last send something back? When was the CEO last properly appraised? Then compare. The gaps between the two sets of answers show you where the hinge is sticking.

Chapter 3: Composition — Building a Board That Thinks, Not Just Attends

What Good Looks Like — a board-level guide to governance done well

Most boards are built the way a dinner party gets built: someone thinks of people they respect, people they trust, people who'd be a pleasure to sit across the table from for three hours a quarter. It produces a good dinner party. It doesn't reliably produce a board that will catch the thing that's about to go wrong.

What a comfortable board looks like

A comfortable board is easy to recognise once you know to look for it. The directors have impressive CVs, often from overlapping worlds — the same industry, the same handful of firms, the same professional networks as the chair or CEO. Meetings run smoothly, because everyone broadly agrees on how things should be done before they've even discussed it. Tenure is long. New appointments tend to come through someone's existing contacts rather than a defined search against what the board is actually missing.

None of this shows up as a problem, because comfort doesn't announce itself as a weakness. It looks like a strong, aligned, high-calibre board. What it usually isn't is a board that will notice a risk nobody in the room has direct experience of, or say the unwelcome thing to a chair or CEO they've known for fifteen years.

What a well-composed board looks like

A well-composed board starts from a different question: not "who do we admire," but "what does this organisation actually need to be watched for, and who around this table can watch for it." That means a skills matrix built against the organisation's real and emerging risks — cyber exposure, treasury and liquidity, clinical or product safety, regulatory change — rather than a generic template of "finance, legal, HR, marketing" ticked off regardless of what the business actually does.

It also means diversity of thought, which is a different thing from diversity of category. A board can be diverse by every demographic measure and still be composed entirely of people who reason the same way, went to the same three business schools, and built careers in the same three sectors. Diversity of thought means someone in the room who's run a very different kind of organisation, who's seen a very different kind of failure, who asks a question nobody else in the room would have thought to ask — not because they're contrarian, but because their reference points are different.

The clearest tell for a well-composed board is whether it contains at least one person who is a little uncomfortable to have there: someone whose expertise means they're going to ask the question everyone else finds it easier not to ask.

Where pedigree without fit leads

Lehman Brothers' board going into 2008 was not short on credentials. It included a Broadway theatre producer, a retired U.S. Navy rear admiral, and directors with long and genuinely distinguished careers in industry and public service. The Corporate Library, an independent board-research firm, had rated Lehman's board poorly before the collapse, flagging that few of the outside directors had current experience in banking, capital markets, or the kind of balance-sheet risk that was about to bring the firm down — at the exact moment that risk had become the only question that mattered. The board wasn't unintelligent or unengaged. It was composed for prestige and comfort, not for the specific thing it needed to be watching.

That's the pattern worth taking from it: an impressive board and a well-composed board are not the same board, and the gap between them only becomes visible once the thing nobody was positioned to catch actually happens.

Where to start

Build a skills matrix against your actual risks, not a generic template. List the five things most likely to seriously damage this specific organisation, then check whether the board has real, current expertise against each one — not adjacent experience from a decade ago.

Score the gaps honestly, in writing. Most boards can describe what their directors bring. Fewer can name, precisely, what's missing. Put the gap on paper before the next appointment is made.

Set a tenure and refreshment discipline, and hold to it. Long-serving directors bring institutional memory, and they also bring the comfort that dulls challenge. A defined term limit, applied without exception, keeps the board from quietly calcifying around one chair's or CEO's comfort.

Recruit for people who'll ask different questions, not just different-looking people. Diversity of category matters and is worth pursuing in its own right — but it isn't a substitute for diversity of thought. Ask what kind of failure a candidate has seen that nobody currently on the board has seen.

Chapter 2: The Board's One Job — Oversight, Not Management

What Good Looks Like — a board-level guide to governance done well

A board has exactly one job. Make sure the company is being run well, and step in if it isn't. That's it. Strategy input, risk oversight, succession, culture — all of it is that one job, applied to a different part of the business.

Most boards don't fail because they misunderstand this. They fail because they drift off it, in one of two directions, usually without noticing.

Drifting into management's lane

The first drift shows up dressed as diligence. A board starts weighing in on which candidate to hire for a role two levels below the executive team. It re-litigates a marketing campaign in the boardroom. It asks for the detail behind a supplier contract that carries no material risk, just because a director finds it interesting.

None of this looks wrong from inside the room. It looks thorough. But a board doing the executive team's job isn't adding oversight — it's substituting its own judgement for the judgement of people who were hired, and are paid, to have better judgement on exactly that question. It also usually means something has already gone wrong upstream: either the board doesn't trust the CEO enough to have appointed them, or nobody has done the work of building that trust properly.

Abdicating oversight entirely

The second drift is quieter, and more common. A board defers. It takes management's account of a situation as the account of the situation, asks a handful of process questions, and moves on. Chapter 1 described a service that kept failing its "well-led" inspection while board meetings and paperwork carried on as normal — a board that had abdicated oversight so completely it no longer registered the gap between what it was being told and what was actually happening.

Both failures look identical from the compliance side. Attendance is fine, minutes are filed, the code is met. Only one version of that board is actually doing the job.

Where the line sits

The distinction is simpler than it feels in the room. Oversight asks whether something should be happening, and whether it's being managed properly. Management decides how it gets done.

"Should we be comfortable with this level of customer concentration risk" is oversight. "Which account manager handles the renewal call" is management. "Is our safety case for this product sound, and who signed it off" is oversight. "What the engineering team's sprint plan looks like this month" is management. The test isn't how technical or important a question sounds — plenty of oversight questions are simple, and plenty of management decisions are hard. The test is whether the board is asking "is this being handled properly," or reaching in to handle it.

Boeing is a well-documented case of what happens when that line gets missed on the abdication side. Before the two 737 MAX crashes, in 2018 and 2019, Boeing's board had no standing committee dedicated to engineering or product safety; safety-related risk moved through the same channels as everything else, filtered by the same executive team whose judgement it was meant to check. The House Transportation and Infrastructure Committee's investigation that followed found the board had not been shown the internal safety analysis for the flight-control system later linked to both crashes. Boeing's response, that same year, was to create a permanent board-level Aerospace Safety Committee with its own direct reporting line. That's what "where the line sits" looks like once a board decides it needs to see the evidence, not just hear the summary.

Where to start

None of this requires reorganising the board. It requires the habit of checking, deliberately, which side of the line a given discussion is actually on.

Before a topic gets boardroom time, ask "whether" or "how." If the real question is how something gets executed, it belongs with management, however tempting it is to weigh in. If it's whether something should be happening at all, or whether it's being managed properly, it belongs with the board.

Give your highest-risk oversight area a standing committee, not an agenda slot. Whatever would hurt the organisation most if it went wrong quietly — safety, clinical or service quality, financial controls — deserves a committee with its own charter and a direct line to the full board, not fifteen minutes inside a general update.

Set an explicit rule about who talks to whom. Directors shouldn't be directing operational staff below the executive team without going through the CEO first. It's a simple guardrail against the management-drift side.

Build in a standing question for the abdication side. Not "what does management's summary say," but "what would we need to see to know this is actually going well, and are we seeing it?"

Once a year, review which side the board actually spent its time on. If most of the year went on execution detail, that's drift into management. If most of it went on nodding through management's account of things, that's abdication. Either finding is worth acting on.

Governance Is Not Compliance: Why the Difference Matters More Than Your Policy Folder Suggests

Ask most independent providers what "good governance" looks like and you'll get a description of good compliance instead: policies up to date, DSPT submitted, statutory notifications sent on time, CQC evidence portfolio populated. All of that matters. None of it is governance.

Compliance answers one question: are we meeting the minimum standard set by someone outside the organisation? Governance answers a different one: are we making good decisions, for the right reasons, in a way we could defend to a regulator, a coroner, or a patient's family if we had to? A service can be fully compliant and still be badly governed. It's a more common combination than most boards would like to admit.

What compliance actually covers

Compliance is the floor. It's the set of external requirements — CQC fundamental standards, DSPT, statutory notifications, mandatory training completion rates — that exist whether or not your organisation has thought about them at all. You can outsource most of compliance. You can automate parts of it. A well-run compliance function tells you where you stand against a fixed external checklist, and that's genuinely valuable: it catches the gaps that would otherwise surface during an inspection instead of before one.

But compliance, by design, doesn't ask whether the checklist is the right one for your organisation's actual risks. It doesn't ask why an incident happened, only whether it was reported within the required timeframe. It doesn't ask whether your board understood the decision it signed off, only whether the sign-off exists on file.

What governance adds

Governance is the judgment layer sitting above compliance. It's the structure through which decisions get made, tested, and owned — who decided, on what evidence, weighed against what risk, with what oversight afterward. A governance framework asks compliance's questions and then a harder set on top: did we understand what we were agreeing to, did the right people have visibility before the decision was made rather than after, and can we show our reasoning, not just our paperwork, if we're asked to account for it later.

This is the distinction that shows up hardest in an incident. A provider with strong compliance and weak governance will have the notification on file, the policy referenced, the training record complete — and still struggle to explain why the decision that led to the incident was made, because no one owned it as a decision at the time. It just happened, inside a compliant system, without anyone particularly deciding it should.

Where this shows up in practice

Three places we see the gap most often with providers:

Risk registers that log risks without anyone owning the decision about what to do with them. A risk sitting at "amber" for eighteen months with no board discussion isn't a governance failure of documentation — the documentation is fine. It's a failure of someone actually deciding what amber means and what happens next.

Board minutes that record attendance and agenda items but not reasoning. If a board approved a change in staffing ratios, the minute that matters isn't "the board approved the proposal." It's what evidence was weighed, what alternative was considered and rejected, and why. That's the record that protects the organisation later — and it's the record most boards don't actually keep, because it takes longer to write and nobody's checklist requires it.

Assurance that flows one way. Compliance tells the board what's been done. Governance requires the board to test it — to ask the operational team a question they weren't expecting, rather than accepting the report as read. A board that only ever receives assurance, and never probes it, isn't governing. It's rubber-stamping with good intentions.

The practical fix

You don't fix this by adding more policies — that's compliance thinking applied to a governance problem, and it tends to make the folder thicker without making the decisions better. The fix is structural:

Separate the reporting question from the decision question on your board agenda. "Here's our compliance status" and "here's a decision we need to make, here's the evidence, here's what we're weighing" should be different agenda items with different expectations of the room.

Require reasoning in the minute, not just the outcome. One sentence on what was considered and why is usually enough. It's the habit that matters, not the length.

Build in genuine challenge. If every paper that reaches the board gets approved without a substantive question, that's worth noticing in itself — not because approval is wrong, but because it suggests the board isn't yet doing the second half of its job.

Compliance keeps you registered. Governance is what you'd actually want standing behind you if something went wrong and someone asked why the decision was made the way it was.

August regulatory round-up

A short one this month, but two dates worth having on your radar:

DSPT transition deadline — 14 August 2026. The Health Research Authority has confirmed that 2024/25 Data Security and Protection Toolkit assurances will only be accepted for CAG applications, amendments or annual reviews submitted before 14 August. After that date, only 2025/26 submissions will be accepted. If your DSPT renewal has slipped, this is the practical deadline that bites — not the toolkit's own nominal submission date.

CQC's sector-specific assessment framework — expected this summer. CQC has confirmed it's on track to publish the replacement for the single assessment framework this summer, with separate frameworks for adult social care, hospitals, primary care and mental health, ahead of implementation planned for the end of 2026. The single assessment framework remains in force for inspections in the meantime, so nothing changes operationally yet — but providers should expect the published framework text to set the shape of what changes later this year, and it's worth reading closely as soon as it lands rather than waiting for guidance to catch up.

We're tracking both, along with the Health Bill's progress through report stage, in this month's full regulatory briefing for Harbour and Deep Water subscribers.

Chapter 1: Why "Good" Is Harder Than "Compliant"

What Good Looks Like — a board-level guide to governance done well

Every board can point to its compliance record. Codes followed, papers filed, committees constituted, the annual report ticking every disclosure box a regulator or shareholder might ask for. None of that tells you whether the board is any good.

That's the uncomfortable starting point for this series. Compliance is achievable by any board willing to follow a checklist and hire people who know how to fill one in. Good governance is not. It requires judgment, several people willing to use it out loud, and a chair prepared to let them.

Two boards, same paperwork

Picture two boards with identical compliance records. Full attendance at every meeting. All committees quorate. Every disclosure filed on time, every code provision either met or properly explained. On paper, indistinguishable.

On one of these boards, a non-executive director reads the CEO's growth plan in March and asks a plain question: what happens to service quality if headcount doubles in nine months and the training pipeline doesn't change? The question gets minuted, the plan gets adjusted, and the year goes fine.

On the other board, nobody asks. Same plan, same numbers, same nine months. By October the business is short-staffed, quality has slipped, and the board is now managing a crisis instead of a growth plan. Both boards were compliant the whole way through. Only one of them was governing.

Why compliance became the ceiling

Most governance codes exist because something went badly wrong first. Enron collapsed in 2001 with a board that had approved the conflicts of interest behind its off-balance-sheet partnerships — waivers later scrutinised in detail by the US Senate investigation and the Powers Report. That's how most governance rules get written: a specific failure, then a fix for that specific failure, after the fact.

Carillion is a closer-to-home example of what that ceiling looks like from the inside. One of our team spent a year working for a Carillion-run service before resigning, once it became clear that governance there meant compliance and nothing more. The service kept failing its CQC inspections on "well-led" — the domain that asks, in effect, whether the people running the organisation actually understand and act on what's happening inside it — and the board never seemed to register that its own narrow view of the business was the reason why. Meetings happened. Papers were filed. Nobody in the room was asking the question "well-led" is actually testing for.

That's a sound way to build a floor. It's a poor way to build a standard. A code can tell a board what to have on file. It can't make anyone in the room actually think, and it can't manufacture the willingness to say something unwelcome to a confident CEO. Boards that treat the code as the job description will always be compliant and sometimes still fail badly, because the code was never designed to catch what killed those two companies: a room full of qualified people who didn't push.

What "good" actually adds

Good governance sits on top of compliance, not instead of it. It's the judgment to know which item on a packed agenda deserves forty minutes instead of four. It's a chair who notices the room agreeing too quickly and asks the question that breaks the consensus open. It's a director willing to be the one voice that slows things down, and a board culture where doing that doesn't cost you your seat at the table.

None of that shows up in a compliance audit. All of it shows up in the outcome.

Where to start

None of this requires a new committee or a thicker policy. It's a handful of specific, testable habits, and a board can start on any of them next quarter.

Audit your last four board packs for narrative versus status. How much is genuine analysis, and how much is a RAG-rated table someone updates before the meeting? A pack where everything reads green isn't reassurance — it's a sign nobody is being asked to explain why.

Count the challenge in your minutes, not just the attendance. Go back over the last twelve months and check how many recommendations went through unamended and unquestioned. If it's nearly all of them, the board is confirming decisions, not testing them.

Get information the executive team hasn't filtered first. Meet frontline staff or middle managers without the executive in the room, even once or twice a year. It's the only way to test whether what reaches the board matches what's actually happening on the ground — the gap our own team watched widen at Carillion, inspection after inspection.

Give someone in the room the explicit job of disagreeing. Before a significant decision, the chair asks whoever's spoken least what they think, or names someone to make the case against. It feels artificial the first few times. Then it's just how the board thinks.

Test for judgment at induction and evaluation, not just process. Tell new directors plainly that challenge is the job, not a bonus feature. And have the annual board evaluation ask for evidence of real disagreement and what came of it, not just confirmation that the committees met.

What this series is

Over the coming weeks, this series works through what "good" actually looks like at board level, one part at a time: how a board should be composed, what the chair and CEO owe each other, what a board should actually see and ask for, how risk oversight differs from a risk register, how a board adds value to strategy without doing management's job, and more. Each piece stands alone, but together they build into a working picture of a board that governs rather than one that merely complies.

The first question worth asking of any board, including your own, isn't "are we compliant." It's "if something in this business went wrong quietly, over months, would anyone in this room notice before it became a crisis."

That's the difference this series is about.

Employing Third-Party Software: What Independent Providers Actually Need to Check

A vendor demo can make almost any system look ready. Slick dashboards, a confident sales lead, a case study from a trust three counties over. None of it tells you whether the product is safe to put in front of your clinicians and your patients.

That's what due diligence is for.

Below is the checklist we use with independent providers before any new clinical or care-related software goes near a live environment, what to ask for, who needs to sign it off, and the three red flags that should stop a procurement in its tracks.

The Due Diligence Checklist

1. Mandate Digital Technology Assessment Criteria (DTAC).

DTAC is the baseline for procurement, and it's just been refreshed. NHS England introduced an updated form in February 2026, with a hard cutoff on 6 April 2026, the previous version should no longer be in circulation. Independent providers delivering NHS care should insist on the standard NHS England DTAC form rather than accepting a vendor's own version of it. Providers delivering arms-length care should do likewise.

2. Demand the Clinical Safety Case.

Ask for the vendor's DCB0129 Clinical Safety Case and Hazard Log. This is the evidence that clinical risk was managed properly during development, and it's a statutory obligation for manufacturers of health IT systems under the Health and Social Care Act 2012. As the deploying organisation, you'll need it as the starting point for your own risk assessment, you can't complete DCB0160 without it. During checking, make sure that the hazards were investigated using standard methods.

3. Appoint your own Clinical Safety Officer (CSO).

You need a CSO to review the vendor's documentation and assess risk in the context of your own deployment‚ that's your DCB0160 obligation, and it sits with you, not the vendor. The CSO should be a registered senior clinician (GMC, NMC, GPhC, or HCPC). One detail worth knowing: the requirement for a specific NHS-mandated training course has recently been dropped from the DTAC framework, so don't let a vendor use its absence as a reason to wave through a weaker appointment‚ competence and registration still matter, the formal course just isn't the only route there anymore. If you don't have someone internally, this role can be outsourced to a consultant.

4. Check the Data Security and Protection Toolkit (DSPT).

Your organisation needs a current DSPT self-assessment. If you're a Category 2 supplier‚ with 50 or more staff, or turnover above £10 million‚ that now requires independent audit rather than self-declaration. "Standards Met" status is written into NHS Standard Contract Clause 21.2, so falling short isn't a paperwork gap, it's a contractual breach.

5. Verify Cyber Essentials Plus.

Cyber Essentials Plus has become the de facto requirement for NHS suppliers handling patient data or providing IT and digital services, driven by Procurement Policy Note 014. Strictly, the policy itself allows Cyber Essentials, Cyber Essentials Plus, or demonstrably equivalent controls‚ but NHS Supply Chain's own implementation pushes suppliers firmly toward Cyber Essentials Plus specifically, with a fallback security questionnaire for those who don't hold it. In practice, for an independent provider evaluating a vendor, Cyber Essentials Plus is the standard to ask for. Don't let ISO 27001 be offered as a straightforward substitute‚ it covers different ground.

6. Test with your own clinicians.

Insist on a pilot with your own clinical staff, using dummy or test data in a sandbox rather than live patient records. This is where you actually learn whether the system fits your workflow‚ particularly if you're running a private/NHS hybrid setting, which often behaves differently to a pure NHS deployment. This pilot is also where DCB0160 gets applied in practice: clinical risk management isn't a document you file once, it's something you test.

7. Confirm NHS interoperability.

Ask directly about integration with the NHS Spine and whether the vendor builds to Fast Healthcare Interoperability Resources (FHIR) standards. Independent providers are increasingly expected to integrate with NHS systems rather than sit apart from them, and the NHS Business Partners programme that used to help with this has been retired. That support gap means the burden of asking the right integration questions now sits with you.

8. Embed exit and performance clauses.

Get your legal team to build in explicit exit clauses, data extraction rights, and performance benchmarks tied to clinical outcomes‚ not just uptime. The Data (Use and Access) Act 2025 gives regulators direct enforcement powers over IT suppliers for the first time, which strengthens your hand at the contract stage. Make sure your contract is drafted to take advantage of that.

Three Red Flags

Missing or outdated DTAC form. Anything submitted on the pre-April 2026 version is a sign the vendor isn't keeping pace with its own compliance obligations.
No DCB0129 documentation. If a vendor can't produce a Safety Case and Hazard Log, that's not a gap to work around, it's a statutory obligation they haven't met, and a reason to walk away.
No independent DSPT audit, where one's required. If you're a Category 2 organisation and the vendor's DSPT submission hasn't been independently audited, they're non-compliant, and by extension so is your supply chain.

Your Governance Pathway

For an independent provider, sign-off on a new system should move through a clear sequence rather than sitting with one person's judgement:

1. Commercial/Procurement runs the RFP and negotiates the contract.
2. Your Clinical Safety Officer reviews DCB0129 and completes the DCB0160 risk assessment for your specific deployment.
3. Your Data Protection Officer signs off the DPIA and the DSPT submission.
4. Your Cyber Security Lead verifies Cyber Essentials Plus and the underlying technical security.
5. End-user clinicians test usability and workflow fit in your actual setting, not a generic demo environment.
6. Your Governance Committee reviews the evidence from each stage and gives formal approval.

Bottom Line

Due diligence isn't about ticking a form‚ it's about demanding the right documentation and getting the right people, particularly your CSO and DPO, to put their name to a formal sign-off. DTAC, DCB0129, DSPT, and Cyber Essentials Plus are the four pillars that should be non-negotiable. If a vendor can't produce all four without a fight, that tells you something worth knowing before you sign, not after.

How to Make Shared Governance Work: Navigating the NHS and Independent Sector Divide

A growing share of NHS-funded care now happens in independent hospitals. As of 2022, the independent sector delivered around 9% of all NHS-funded elective procedures, and for hip and knee replacements and cataract surgery specifically, that figure rises to roughly one in three. NHS spending on independent sector care reached £11.8 billion in 2020/21, up £2 billion on the year before.

This isn't a niche arrangement at the margins of the system. It's a substantial and growing part of how NHS-funded care actually gets delivered.

Nearly all of it runs on a shared medical workforce. Most consultants working in independent hospitals hold a substantive NHS post, and their NHS employer carries legal responsibility for oversight of their whole scope of practice, including the work they do on the independent side. Which raises an obvious question: when a consultant's practice spans both sectors, how well does governance actually follow them across that boundary?

Until this year, the honest answer was mostly anecdotal. A national survey published in 2026 changes that. Researchers from the University of Manchester and University of York surveyed 769 senior leaders with governance responsibility across NHS trusts and independent hospitals in England; 320 responded (a 42% response rate), and asked, in detail, how shared clinical governance actually functions between the sectors. The findings are worth taking seriously, because they confirm something many independent providers have probably suspected but rarely seen measured: shared governance across this boundary runs largely on goodwill, not process.

The headline finding: informal is the norm, not the exception

Only around one in five respondents said they had a formal agreement or policy governing shared clinical governance arrangements with their counterpart hospitals in the other sector. The rest relied on contact of varying frequency, described by respondents as ad hoc, sporadic, and reactive: meetings that happened when something went wrong, rather than as a standing part of how the relationship worked.

Where relationships were strong, they tended to be strong with one or two specific partner hospitals, and considerably weaker, sometimes non-existent, with others, even where consultants were shared across all of them. The researchers found this pattern repeatedly: a good relationship with the hospital down the road, and almost nothing with three others where the same doctor also holds practising privileges.

The mechanism holding this together, more than anything else, was personal relationships. Responsible-officer-to-responsible-officer conversations were the main channel respondents described. When those individual connections existed, the system worked reasonably well. When they didn't—because of staff turnover, a large multi-site independent group with too many NHS trusts to build relationships with individually, or simply no prior contact—governance information didn't reliably flow at all.

The perception gap independent providers should sit with

Here's the finding that's genuinely worth pausing on if you're on the independent sector side: when asked to rate the quality of their shared governance arrangements, independent hospital respondents rated them significantly more positively than their NHS counterparts did—a statistically significant gap, not a marginal one. Nearly two-thirds of independent sector leaders rated their processes for verifying consultants' scope of practice as robust; fewer than a fifth of NHS leaders said the same about theirs. Three-quarters of independent sector leaders were confident they knew the NHS scope of practice of their dual-practice consultants; under a third of NHS leaders had equivalent confidence about the independent side.

Interestingly, the survey suggests the complexity runs the other way round from what you might expect: independent hospital respondents most commonly reported that their consultants come from three or more different NHS trusts, while NHS respondents mostly said their consultants who also work independently were active at just one or two independent hospitals—and over a third of NHS respondents didn't know which independent hospitals their consultants worked at, at all. If anything, independent providers are often the ones managing the wider spread of relationships, which makes the confidence gap more striking, not less.

This is worth sitting with because it means an independent provider can genuinely believe the relationship with its NHS partner is working well, while the NHS side experiences the same relationship as thin, uncertain, and hard to rely on. If your own confidence in shared governance rests entirely on your side of the process feeling solid, that confidence may not be shared by the trust you'd need it from in a crisis, and you may not find that out until you actually need it.

Where the practical risk actually sits: scope of practice and probity

The survey asked in detail how organisations verify a consultant's scope of practice at the other hospital, and how concerns get shared. The pattern that emerged across both sectors was a heavy, largely unavoidable reliance on the consultant's own honesty.

NHS respondents described relying on a "letter of good standing" provided at appraisal, self-reported by the consultant, rarely independently verified. Independent hospital respondents described a similar dependency running the other way—scope of practice information supplied by the consultant when applying for practising privileges, sometimes supported by a letter from their NHS trust, but frequently not checked in any real depth afterward. One independent sector hospital director's own assessment, reported in the study, was blunt: they were relying on trusting that the consultant was telling the truth, and probably weren't rechecking scope of practice as often as they should.

This matters more than it might first appear, because it's precisely the gap the Paterson Inquiry identified after Ian Paterson was able to continue harming patients across both NHS and independent settings, in part because information about his practice wasn't being systematically shared between the organisations where he worked. The Inquiry's first recommendation called for a single, shared repository of consultants' whole practice, accessible to both sectors. A pilot of exactly this—the Acute Data Alignment Programme (ADAPt), run jointly by the Private Healthcare Information Network and NHS Digital—ran between 2020 and 2023. It has not yet been implemented nationally. Five years after Paterson, the infrastructure recommendation still doesn't exist in practice, and the survey's findings show why that gap continues to matter: without it, verification still depends heavily on the consultant's own account.

This sits close to what medical revalidation is meant to capture in the first place—a doctor's whole scope of practice, wherever they work. The survey shows plainly that, in practice, the mechanism to evidence that fully across sectors still isn't there for most organisations.

Concern-sharing looks better on paper than it works in practice

Most organisations do have a policy for handling concerns about a consultant's practice, 79% of NHS respondents and 93% of independent sector respondents confirmed this. But having a policy and having concerns actually reach the other sector in practice are different things. Only 64% of NHS policies specifically included a process for sharing concerns with the other sector hospital, against 93% of independent sector policies.

When asked directly whether consultants fulfil their professional obligation to inform other organisations about significant concerns, restrictions, or exclusions, the most common answer from NHS respondents wasn't yes or no, it was "I don't know," at nearly half of all responses. Only around one in ten NHS respondents and roughly one in five independent sector respondents felt this always happened. Respondents from both sides described a system that, in practice, isn't a genuine two-way exchange: independent providers frequently reported passing information to the NHS without it being reciprocated, and vice versa, often attributed to unclear ownership within large NHS organisations (where responsibility bounces between the Medical Director, the Responsible Officer, and divisional leads) rather than any deliberate withholding.

What this means practically for independent providers

None of this is really an indictment of individual organisations trying their best within an unregulated, non-mandatory process. This is a structural gap, not a behavioural one, and the researchers are explicit that it needs systemic fixing, better data infrastructure, and full implementation of the Paterson recommendations, rather than individual organisations solving it alone. But waiting for that infrastructure to arrive isn't a governance strategy. Here are five concrete steps worth taking now:

• Don't treat a "letter of good standing" as verification. It's a useful data point, but the survey shows plainly that both sectors know these rely on the consultant's own account rather than independent checking. Where you can, build in an actual verification step—a direct conversation with the Responsible Officer or equivalent at the other organisation, not just a form.

• Formalise the relationship, even informally. You don't need a heavyweight contract to move from ad hoc to structured. A simple written understanding—who the named contacts are on each side, how often you'll touch base, what triggers an out-of-cycle conversation—closes most of the gap the survey identifies between "some contact" and "an actual formal agreement," which only one in five organisations currently have.

• Don't assume reciprocity. The survey found information sharing was frequently one-directional, more often independent sector giving without receiving back. If you're only getting what's volunteered, build in a habit of actively asking, rather than waiting for information to arrive.

• Build resilience beyond one relationship. Where governance depends on one individual's personal connection with one RO, it collapses the moment either person moves on. Document who holds the relationship and make sure at least one other person in your organisation has visibility of it.

• Watch the Paterson recommendation timeline. The infrastructure gap this survey identifies is a known, named policy priority. When ADAPt or an equivalent shared data system does move toward implementation, providers who've already built strong internal scope-of-practice and concern-sharing habits will adapt far more easily than those relying entirely on goodwill today.

This is exactly the kind of gap that sits between disciplines—part clinical oversight, part information governance, part plain organisational habit—which is precisely why it tends to fall through the cracks of governance built around a single specialism. It's also exactly the kind of standing, cross-disciplinary assurance work we build into ongoing governance support for independent providers, rather than treating it as a one-off policy exercise.

Source: Stringer G, Ferguson J, Walshe K, et al. Shared clinical governance arrangements between NHS and independent acute hospitals in England: findings from a national survey of senior leaders. Journal of Health Services Research & Policy, 2026. Funded by the NIHR Health and Social Care Delivery Research Programme.

What good governance looks like: a story worth knowing

In 2009, a US military hospital discovered that faulty procedure had exposed more than 2,000 patients to potential harm.

 It went public.

Local press and elected officials wanted someone held accountable, and the hospital commander's first instinct was to reprimand the chief nurse.

Dr James Gilman, who had oversight responsibility for the hospital at the time, talked the commander out of it. Not because nobody was involved, many nurses had, in fact, taken part in the flawed process. But because, as he put it later, "this was clearly a systems error."

Reprimanding one nurse wouldn't fix a process that dozens of staff had been following incorrectly, in good faith, for a long time. It would just teach every other nurse in the building that the safest thing to do next time was say nothing.

The commander never reprimanded anyone. The hospital offered free testing and treatment to every patient who might have been affected. And here's the part that actually matters for how the story ended: the culture on those wards held. Nurses kept flagging problems, because reporting a problem hadn't just got a colleague punished.

Gilman told this story years later, by then CEO of the NIH Clinical Centre, at a session on what it actually takes to build a hospital where staff feel safe raising a hand.

Why this is a governance story, not just a nice one.

It would be easy to file this under "leadership culture" and move on. But look at what actually happened, structurally:

The response separated the individual from the system.

Multiple people did the same wrong thing the same way. That's not a training gap in one nurse. That's a process that was set up to fail, and the response treated it that way.

Accountability didn't disappear. It moved to where it belonged. Someone was still accountable. It just wasn't the person who happened to be holding the syringe when the process broke. The organisation owned the fix.

Transparency came before the instinct to protect reputation. The hospital went public and offered treatment rather than managing the story. That's the harder, more expensive choice, and it's the one that actually rebuilds trust with patients and regulators alike.

The decision protected the next disclosure, not just this one.

The real cost of a scapegoat isn't the one person punished, it's every future near-miss that never gets reported because staff watched what happened to the last person who spoke up. Gilman's call protected reporting behaviour for years afterwards, not just resolved one bad week.

The version of this most services face.

Nobody reading this is likely to have 2,000 affected patients.

What's far more common is a smaller version of the same fork in the road: an incident review where it's genuinely easier, quicker, and less politically awkward to find one person at fault than to admit the rota, the induction process, or the equipment checklist was the real problem.

That's the moment good governance actually gets tested.

Not in the policy document. In the room, when someone has to decide what the finding says.

If your last few incident reviews all landed on individual human error, it's worth asking, gently, and honestly, whether that's because that's what happened, or because it was the easier thing to write down.

5 signs your audit programme isn't working

Most providers have an audit programme. Fewer can say what it's actually changed.

An audit programme that's working produces evidence of improvement‚ actions closed, practice changed, risk reduced.

One that isn't working still produces paperwork. It just doesn't produce much else. Here's how to tell which one you've got.

1. The same findings show up year after year
   If last year's hand hygiene audit flagged low compliance on a particular ward, and this year's audit flags the same thing, the audit did its job‚it found the problem twice. What didn't happen is the improvement. A repeat finding isn't proof the audit is broken. It's proof the action plan that followed it was.

2. Actions get logged but nobody checks they happened
   Most audit tools have an action column. Fewer have a column for "did this actually get done, and did it work." An action plan with a due date and an owner looks complete. Whether it closed the gap is a different question, and it's the one CQC and NHS Resolution actually ask.

3. The programme is built around what's easy to count, not what's risky
   Documentation audits are quick to run and quick to score. Auditing whether clinical decisions were appropriate, or whether a consent conversation actually happened the way the notes say it did, takes longer and is harder to standardise. A programme weighted toward the former and light on the latter will always look tidier than it is.

4. Audit results and incident data live in separate systems, and nobody's cross-checking them
   If your complaints log, incident reports, and audit findings are reviewed by different people at different meetings and never compared side by side, you'll miss the pattern where all three are pointing at the same underlying issue. That's usually the first thing an external reviewer finds, because they're the ones actually putting the three together.

5. Your audit plan was written once and hasn't moved since
   A risk-based audit programme should shift with your risk profile — a new service line, a staffing change, a near miss, a regulatory update. If this year's audit calendar is last year's audit calendar with the dates changed, it's being run as a compliance exercise, not a governance one.
   

   What a working audit programme actually looks like
   
   None of this means adding more audits. It usually means fewer, better-targeted ones, with a genuine re-check built in: did the action happen, and did it work. That loop, audit, act, re-audit is the part that gets skipped most often, and it's the part that actually produces the evidence boards and inspectors want to see.
   
   If you're not sure where your programme currently sits against that, it's worth an honest look before your next inspection does it for you.
   
   Get in touch and the Harbour Governance team can help you review your current programme against what CQC and NHS Resolution actually expect to see.
    

The question your board should be asking

Most boards ask the wrong question about governance.

They ask "do we have a policy for this?" The better question — the one CQC inspectors are now trained to listen for — is much shorter, and much harder to fake:

"What have we changed because of what we found?"

That single sentence separates two very different kinds of governance. One produces paperwork. The other produces evidence of a working mind — an organisation that notices something, thinks about it, and does something differently as a result.

Why this question, and why now

Under the current CQC framework, Well-led is consistently the most heavily scrutinised of the five key questions, and the one most likely to pull a service's overall rating down even when everything else looks strong. What inspectors are checking for isn't the existence of a governance structure — a leadership meeting that happens regularly and is minuted is table stakes. What they're checking for is whether that structure actually does anything: whether risks are noticed early, whether the board or senior leadership can point to a specific decision it made in response, and whether anyone can say what changed as a result.

The gap between "we have a risk register" and "our risk register shows we spotted a problem in March, understood why it happened, and closed it by June" is the whole ballgame. The first is a document. The second is governance.

This isn't just an inspection-readiness point. It's arriving at a moment when the wider system is having a related, larger argument about where accountability sits at all. The Health Bill currently moving through Parliament pulls significant national accountability back toward the Secretary of State and DHSC — a marked shift away from the arm's-length model that has shaped NHS governance for over a decade. Whatever you make of that shift, it puts local, board-level accountability under a brighter light, not a dimmer one. If national oversight is consolidating, local leadership needs to be able to show, unambiguously, that it knows what's happening in its own service and is acting on it. Nobody further up the chain is going to do that noticing for you.

What "good" actually looks like

It's rarely dramatic. In practice, the boards that pass this test tend to share a few habits:

• A standing agenda item, not an occasional one — governance oversight reviewed every time the board or leadership team meets, not only when something has already gone wrong.

• Minutes that show reasoning, not just attendance — "we reviewed X, found Y, and are changing Z" rather than a list of topics covered.

• A risk register that moves — reviewed and updated on a fixed monthly cycle, with entries that show when a risk was identified, what was done, and when it closed. An annual review that never changes is functionally the same as no register at all.

• Genuine challenge in the room — evidence that a non-executive, trustee, or equivalent asked a hard question and got a real answer, not a reassurance.

None of this requires more infrastructure. It requires one habit: closing the loop, visibly, every time.

The question to take into your next meeting

You don't need a new framework to start. You need one sentence, asked consistently: what have we changed because of what we found? Ask it of your last incident. Ask it of your last complaint theme. Ask it of your last risk register review. If the honest answer is "nothing yet," you've just found your board's most useful agenda item for next month.

Where does your evidence stand against the new CQC framework?

CQC's replacement assessment framework closes its consultation this year — 34 Quality Statements collapsing into 24 Key Lines of Enquiry, numerical scoring replaced with descriptive Rating Characteristics. Final publication is expected over summer.

Most providers haven't read the draft yet. Fair enough — you're running a service, not tracking consultation documents.

So we built something to close that gap: a short, free self-assessment that maps your current evidence against the direction of travel. Fifteen questions across the five Key Questions (Safe, Effective, Caring, Responsive, Well-led). About four minutes. At the end, you get a readiness score and a specific gap list — not generic advice, actual next steps for the domains where your evidence is thinnest.

A few honest caveats, because we'd rather you trust the tool than be impressed by it:

→ It's built on the draft consultation, not the final framework — we'll update it the moment CQC publishes

→ It's a self-read, not an audit — useful for spotting direction, not for relying on at inspection

→ It's free. No email gate, no catch. If it's useful to you, that's the point.

The real reason to do this now rather than in the autumn: providers who start mapping evidence to the new structure today will be materially ahead when it lands. The ones who wait will be doing this same exercise under time pressure.

Link to the tool is in here:

🌊 Harbour Governance CQC Framework Check.

Accessible Information: Why "We Meet the Standard" Usually Means "We Meet Part of It"

If you asked most independent healthcare providers whether they comply with the Accessible Information Standard, you'd get a confident yes. Ask them to show you the evidence, and the confidence tends to thin out fast.

That gap matters more than it used to. The Standard was refreshed in 2025, a self-assessment framework now sits alongside it, and CQC has built it directly into how it tests the responsive key question. What used to be a soft expectation is now something you're asked to evidence — and increasingly, something a regulator will go looking for even if you don't offer it up.

This piece is about two things. First, the specific places providers tend to fall short, often without realising it. Second, something that doesn't get said often enough in governance circles: accessible information shouldn't be a favour someone has to ask for. If a person has to request it, and request it again at the next appointment, and again with the next clinician, the standard hasn't really been met — it's just been made conditional on the patient doing the work.

What the standard actually asks for.

The Accessible Information Standard (AIS, formally DAPB1605) has been a legal requirement for NHS and publicly funded adult social care providers since August 2016, and it explicitly covers private hospitals and organisations delivering NHS-funded care, not just NHS trusts. It applies wherever someone's ability to access or understand information, or to communicate with staff, is affected by a disability, impairment or sensory loss — and that includes carers and family members with needs of their own, not only the patient in front of you.

The standard sets out a sequence of steps organisations are expected to follow: identify a person's information and communication needs, record them clearly, flag them so they're visible wherever that person is seen, share them appropriately with other providers involved in their care, and meet them in practice. Following the 2025 update, a sixth step was formally added: review. Needs aren't static — they change, and the standard now expects providers to check in on them over time rather than recording something once and treating it as settled indefinitely.

None of this is exotic. It's closer to good clinical record-keeping than to a specialist accessibility project. Which is partly why it gets missed — it doesn't look like the kind of thing that needs a policy.

Where providers actually fall down

In our experience working across independent and private providers, the gaps rarely come from ill will. They come from treating the standard as a document rather than a live operational habit. A few patterns come up again and again.

Recording without flagging. A need gets noted in a consultation summary or an admissions form, and then it sits there — technically recorded, practically invisible. If a receptionist booking a follow-up, or a locum seeing the patient for the first time, has no way of seeing that flag at the point of contact, the recording has achieved nothing except paperwork. The test isn't "did we write it down somewhere," it's "would the next person interacting with this patient know, without having to ask."

One-off identification. Needs are often captured once, at registration or first assessment, and never revisited. Someone's hearing changes. Someone develops a condition that affects reading. Someone's preferred communication method shifts after a stroke or a diagnosis. The 2025 review requirement exists precisely because static records go stale, but a lot of providers haven't yet built review into any recurring process — it's not on a care plan cycle, not on an annual check, nowhere.

Treating it as a specialist add-on. Some providers have built genuinely good processes for patients who are already known to have a sensory impairment — an established deaf patient, for instance, has clear provision. But the standard applies far more broadly than that, and the identification step is supposed to be routine for everyone, not triggered only when a need is already obvious. If your process only switches on once someone discloses something, you've skipped the "identify" step entirely and gone straight to "meet," which only works for the people who already know to ask.

No audit trail. This is the one that catches people out with CQC. Since the self-assessment framework was introduced, providers are expected to be able to show their own performance against it, including publishing that self-assessment and the actions taken to close gaps. "We do this" isn't evidence. A register of identified needs, a record of flags applied, a note of when needs were last reviewed, a documented reason on the rare occasion a "should" requirement wasn't met — that's evidence. Very few independent providers have this ready to hand over, because until recently nobody was really asking for it.

The sector data behind this isn't flattering. Freedom of Information research found only around a third of NHS trusts considered themselves fully compliant, and a smaller fraction still could actually evidence having audited their own compliance. A 2025 report on deaf people's experience found the majority had never once been asked, at any point of contact, whether they had a communication need. These are NHS figures, but there's no reason to assume independent providers are, on average, doing better — most are smaller, with less dedicated equality and diversity resource, and the same instinct to assume "we'd know if it were a problem."

The part that doesn't get said enough: this isn't something people should have to ask for

Here's the bit we think gets lost in a lot of AIS compliance work, which tends to focus heavily on process and documentation and rather less on what it actually feels like from the other side of the desk.

The whole design of the standard is proactive. Identify, record, flag, share, meet, review — every one of those verbs describes something the organisation does. Not one of them says "wait for the patient to ask." And yet in practice, a huge amount of accessible provision in health and care still runs on the patient having to raise it — often more than once, often with someone new each time, often having to explain the same thing to a receptionist, then a nurse, then a consultant, because none of it was flagged anywhere they could see it.

That's not a technical failure of the standard. It's a failure to build it into the default pathway rather than treating it as an exception process for people who self-advocate. And self-advocacy under those conditions has a cost. Having to explain a disability or communication need repeatedly, to strangers, in a clinical setting, while also trying to manage whatever brought you there in the first place, is exhausting in a way that "just ask us" doesn't account for. It also quietly filters who gets accommodated well: people who are confident, who know their rights, who have the energy that day to push. Everyone else falls through — which is exactly what the RNID and SignHealth findings suggest is happening at scale.

Good governance on this doesn't stop at "we have a policy that says people can request accessible formats." It asks a harder question: does our default pathway assume the need might be there before anyone has said a word? Is identification something we do routinely, as a matter of course, the same way we routinely ask about allergies — or is it something that only kicks in once a patient has already had to flag themselves as different from the standard case? Access shouldn't be a favour granted on request. It should be the starting assumption, with the burden of building the process sitting with the provider, not the burden of asking sitting with the patient.

What this means practically for boards and governance leads

A few concrete things worth checking, beyond "do we have an AIS policy":

Can a member of front-line staff — reception, not just clinical — see a flagged communication need at the point of contact, without having to dig for it or ask a colleague?

Is there a defined trigger for reviewing recorded needs, rather than leaving review to happen only if something goes wrong?

Is identification built into a standard part of your pathway (registration, pre-assessment, annual check) for everyone, or does it only activate once someone discloses something?

If CQC asked for your self-assessment against the framework tomorrow, could you produce it, along with an action plan for the gaps it shows, within a day?

Where a "should" requirement in the standard genuinely isn't being met, is there a documented, credible reason on file — or is it just not happening, with no record of why?

None of this needs to be complicated. It needs to be built in as routine rather than treated as a specialism, and it needs an evidence trail that exists whether or not anyone ever asks to see it. That's the difference between an organisation that meets the standard and one that's confident it does.

If you want a structured way to work through where your own service stands against the AIS — identification, flagging, review cycles, and the self-assessment evidence CQC will expect to see — this is exactly the kind of gap analysis we build into the Harbour Governance toolkit. Get in touch if it would help to talk it through.

Preparing for Your First CQC Inspection: A Practical Guide

So, you've registered your service, the certificate is on the wall, and now the reality is setting in: your first CQC inspection is on the horizon. It's completely natural to feel a mix of pride and apprehension. This milestone is a chance to showcase the quality of care you provide, and with the right preparation, you can approach it with confidence rather than dread.

Understand the New Rules of the Game

The Care Quality Commission has moved to a Single Assessment Framework, a significant shift from the old Key Lines of Enquiry (KLOEs). The core of what they assess remains the same: Is your service Safe, Effective, Caring, Responsive, and Well-led?. However, the way they gather evidence has changed. Instead of a single, high-stakes inspection day being the primary event, the CQC now gathers intelligence on a more continuous basis. This means your readiness shouldn't be a one-off event but an ongoing state of being. The framework uses 34 'quality statements' (like "We protect people from harm") as the benchmark for what good care looks like, and inspectors will want to see tangible evidence that you meet them.

Get Your Evidence House in Order

The most common pitfall for new providers isn't delivering poor care—it's failing to document it. If it isn't written down, it didn't happen.  Inspectors will test your systems, and you need to be able to provide evidence instantly.

• Core Documentation is Key: Your Statement of Purpose, up-to-date policies and procedures (Safeguarding, Complaints, Medication, MCA/DoLS, Recruitment), and a clear Governance Framework are non-negotiable.

• Demonstrate Operational Readiness: Even if you have no clients yet, show that you are ready. Have your care planning, rota systems, and training partners secured. A provider with no staff still secured approval by demonstrating their full onboarding workflow and induction process.

• Show, Don't Just Tell: Prepare real-world examples. This includes a log of complaints and incidents showing how you learned from them, completed audits with action plans, staff supervision records, and patient feedback surveys.

Treat the Registration Assessment Like a Governance Interview

Your post-submission registration assessment call is not a casual chat. It's the decisive gateway to approval. The Registered Manager (RM) is the linchpin of this process. If they underperform, the whole application can stall.

Prepare the Registered Manager: The RM must be able to articulate governance strength, regulatory understanding, and operational readiness . They should be ready for scenario-based questions, such as "A medication error occurs—walk me through your actions," and provide a structured, step-by-step answer .

Know Your Application Inside Out:

Your verbal answers will be cross-referenced against your application. Any inconsistency raises red flags. For example, stating you will start with "5 care staff" in the application and saying "2" in the interview was enough for the CQC to question a provider's planning stability.

Involve and Prepare Your Team

An inspection isn't just for the leadership. Inspectors will speak to a range of staff, from clinicians to receptionists.

• Build Confidence: Provide staff with short, practical briefings on what to expect. Focus on their role in the five key questions. They should be proud and positive about the work they do.

• Practical Tips for Staff: Remind them to wear their name badge, keep workspaces clean and tidy, and know how to raise a concern (like safeguarding or whistleblowing). If an inspector approaches while they are with a patient, they should politely let the inspector know they will be with them as soon as possible.

Test Your Readiness with a Mock Inspection

One of the most effective ways to prepare is to simulate the real thing. A mock inspection can be done internally or with external specialists.

• Uncover Unknown Unknowns: This is where you'll find missing documents, test whether policies are truly being followed in practice, and see how your team handles the pressure of being questioned.

• Reduce Anxiety: Familiarising everyone with the process helps reduce stress on the actual day.

Key Insight:

The CQC's implementation of the Single Assessment Framework has faced significant criticism and an independent review found "significant failings in the effectiveness of the CQC". Providers have reported that reports can be too brief, lack detail, and assessment teams sometimes lack consistency. This is important context for you. While you must prepare thoroughly, this means you should also be prepared to challenge factual errors in your draft report and provide clear, detailed evidence to support your case. The regulator's own challenges mean a well-documented, articulate provider is in a stronger position than ever.

Take a breath. You can prepare for this. Your policies will be in place, your evidence organised, your staff briefed. 

CQC inspectors are not adversaries — they are assessing whether your patients are safe and well cared for. 

Be calm, be open, and be honest. 

If you do not know the answer to something, say so and offer to find out. That is always better than guessing.