What good governance looks like: a story worth knowing

In 2009, a US military hospital discovered that faulty procedure had exposed more than 2,000 patients to potential harm.

 It went public.

Local press and elected officials wanted someone held accountable, and the hospital commander's first instinct was to reprimand the chief nurse.

Dr James Gilman, who had oversight responsibility for the hospital at the time, talked the commander out of it. Not because nobody was involved, many nurses had, in fact, taken part in the flawed process. But because, as he put it later, "this was clearly a systems error."

Reprimanding one nurse wouldn't fix a process that dozens of staff had been following incorrectly, in good faith, for a long time. It would just teach every other nurse in the building that the safest thing to do next time was say nothing.

The commander never reprimanded anyone. The hospital offered free testing and treatment to every patient who might have been affected. And here's the part that actually matters for how the story ended: the culture on those wards held. Nurses kept flagging problems, because reporting a problem hadn't just got a colleague punished.

Gilman told this story years later, by then CEO of the NIH Clinical Centre, at a session on what it actually takes to build a hospital where staff feel safe raising a hand.

Why this is a governance story, not just a nice one.

It would be easy to file this under "leadership culture" and move on. But look at what actually happened, structurally:

The response separated the individual from the system.

Multiple people did the same wrong thing the same way. That's not a training gap in one nurse. That's a process that was set up to fail, and the response treated it that way.

Accountability didn't disappear. It moved to where it belonged. Someone was still accountable. It just wasn't the person who happened to be holding the syringe when the process broke. The organisation owned the fix.

Transparency came before the instinct to protect reputation. The hospital went public and offered treatment rather than managing the story. That's the harder, more expensive choice, and it's the one that actually rebuilds trust with patients and regulators alike.

The decision protected the next disclosure, not just this one.

The real cost of a scapegoat isn't the one person punished, it's every future near-miss that never gets reported because staff watched what happened to the last person who spoke up. Gilman's call protected reporting behaviour for years afterwards, not just resolved one bad week.

The version of this most services face.

Nobody reading this is likely to have 2,000 affected patients.

What's far more common is a smaller version of the same fork in the road: an incident review where it's genuinely easier, quicker, and less politically awkward to find one person at fault than to admit the rota, the induction process, or the equipment checklist was the real problem.

That's the moment good governance actually gets tested.

Not in the policy document. In the room, when someone has to decide what the finding says.

If your last few incident reviews all landed on individual human error, it's worth asking, gently, and honestly, whether that's because that's what happened, or because it was the easier thing to write down.

5 signs your audit programme isn't working

Most providers have an audit programme. Fewer can say what it's actually changed.

An audit programme that's working produces evidence of improvement‚ actions closed, practice changed, risk reduced.

One that isn't working still produces paperwork. It just doesn't produce much else. Here's how to tell which one you've got.

1. The same findings show up year after year
   If last year's hand hygiene audit flagged low compliance on a particular ward, and this year's audit flags the same thing, the audit did its job‚it found the problem twice. What didn't happen is the improvement. A repeat finding isn't proof the audit is broken. It's proof the action plan that followed it was.

2. Actions get logged but nobody checks they happened
   Most audit tools have an action column. Fewer have a column for "did this actually get done, and did it work." An action plan with a due date and an owner looks complete. Whether it closed the gap is a different question, and it's the one CQC and NHS Resolution actually ask.

3. The programme is built around what's easy to count, not what's risky
   Documentation audits are quick to run and quick to score. Auditing whether clinical decisions were appropriate, or whether a consent conversation actually happened the way the notes say it did, takes longer and is harder to standardise. A programme weighted toward the former and light on the latter will always look tidier than it is.

4. Audit results and incident data live in separate systems, and nobody's cross-checking them
   If your complaints log, incident reports, and audit findings are reviewed by different people at different meetings and never compared side by side, you'll miss the pattern where all three are pointing at the same underlying issue. That's usually the first thing an external reviewer finds, because they're the ones actually putting the three together.

5. Your audit plan was written once and hasn't moved since
   A risk-based audit programme should shift with your risk profile — a new service line, a staffing change, a near miss, a regulatory update. If this year's audit calendar is last year's audit calendar with the dates changed, it's being run as a compliance exercise, not a governance one.
   

   What a working audit programme actually looks like
   
   None of this means adding more audits. It usually means fewer, better-targeted ones, with a genuine re-check built in: did the action happen, and did it work. That loop, audit, act, re-audit is the part that gets skipped most often, and it's the part that actually produces the evidence boards and inspectors want to see.
   
   If you're not sure where your programme currently sits against that, it's worth an honest look before your next inspection does it for you.
   
   Get in touch and the Harbour Governance team can help you review your current programme against what CQC and NHS Resolution actually expect to see.
    

CQC inspection surge — are you on the priority list?

CQC has published exactly which services it's assessing first, and the independent sector is named specifically.

On 26 May 2026, CQC set out how it's prioritising assessments to hit its target of publishing at least 9,000 reports by September 2026. For hospitals, secondary and specialist care, four groups are named. Two of them will apply to a lot of independent providers reading this.

Who's first in the queue

For hospitals, secondary and specialist care, CQC is prioritising:

• Services not assessed for a significant period, where CQC's monitoring data points to a need to re-inspect

• Services registered but never assessed, ranked by how long they've been registered

• NHS providers applying for advanced foundation trust status without a recent assessment

• Independent sector services specifically, because of "unknown or emerging risk" and the growing volume of NHS-commissioned work they deliver

That last point is the one worth sitting with. CQC isn't treating the independent sector as background noise in a wider inspection push. It's calling it out as a named priority, and the reasoning is explicit: as more NHS-commissioned activity moves into independent settings, CQC wants more current data on how those services are performing.

If your organisation has never been assessed under the current framework, or hasn't had contact in a while, that combination — never assessed, or overdue, plus independent sector — puts you closer to the front of the queue than you might assume.

What this means in practice

Two questions worth answering honestly this week:

When were you last assessed, and does your evidence reflect it? A service that hasn't had a full assessment in some time is exactly the profile CQC has said it's targeting. If your governance evidence, policies, and risk data haven't been refreshed to match, that gap will show on the day.

Is your risk data telling CQC a different story than you'd tell them yourself? CQC's monitoring activity — data it already holds, not just what happens on inspection day — feeds directly into who gets prioritised. Incident reporting, complaints data, and notifications all shape that picture before an inspector ever arrives.

Neither of these is about panic. It's about knowing where you sit before CQC tells you, rather than after.

Where to start

Our CQC framework transition self-assessment tool walks through exactly this — mapping your current evidence against what the new framework will expect, and flagging where the gaps are before they're someone else's finding. It's free to use, and takes about twenty minutes.

If you'd rather talk it through first, get in touch and the Harbour Governance team can help you work out where you actually stand.

Source: CQC, "Priorities for delivering more assessments and tackling aged ratings," published 26 May 2026.

The question your board should be asking

Most boards ask the wrong question about governance.

They ask "do we have a policy for this?" The better question — the one CQC inspectors are now trained to listen for — is much shorter, and much harder to fake:

"What have we changed because of what we found?"

That single sentence separates two very different kinds of governance. One produces paperwork. The other produces evidence of a working mind — an organisation that notices something, thinks about it, and does something differently as a result.

Why this question, and why now

Under the current CQC framework, Well-led is consistently the most heavily scrutinised of the five key questions, and the one most likely to pull a service's overall rating down even when everything else looks strong. What inspectors are checking for isn't the existence of a governance structure — a leadership meeting that happens regularly and is minuted is table stakes. What they're checking for is whether that structure actually does anything: whether risks are noticed early, whether the board or senior leadership can point to a specific decision it made in response, and whether anyone can say what changed as a result.

The gap between "we have a risk register" and "our risk register shows we spotted a problem in March, understood why it happened, and closed it by June" is the whole ballgame. The first is a document. The second is governance.

This isn't just an inspection-readiness point. It's arriving at a moment when the wider system is having a related, larger argument about where accountability sits at all. The Health Bill currently moving through Parliament pulls significant national accountability back toward the Secretary of State and DHSC — a marked shift away from the arm's-length model that has shaped NHS governance for over a decade. Whatever you make of that shift, it puts local, board-level accountability under a brighter light, not a dimmer one. If national oversight is consolidating, local leadership needs to be able to show, unambiguously, that it knows what's happening in its own service and is acting on it. Nobody further up the chain is going to do that noticing for you.

What "good" actually looks like

It's rarely dramatic. In practice, the boards that pass this test tend to share a few habits:

• A standing agenda item, not an occasional one — governance oversight reviewed every time the board or leadership team meets, not only when something has already gone wrong.

• Minutes that show reasoning, not just attendance — "we reviewed X, found Y, and are changing Z" rather than a list of topics covered.

• A risk register that moves — reviewed and updated on a fixed monthly cycle, with entries that show when a risk was identified, what was done, and when it closed. An annual review that never changes is functionally the same as no register at all.

• Genuine challenge in the room — evidence that a non-executive, trustee, or equivalent asked a hard question and got a real answer, not a reassurance.

None of this requires more infrastructure. It requires one habit: closing the loop, visibly, every time.

The question to take into your next meeting

You don't need a new framework to start. You need one sentence, asked consistently: what have we changed because of what we found? Ask it of your last incident. Ask it of your last complaint theme. Ask it of your last risk register review. If the honest answer is "nothing yet," you've just found your board's most useful agenda item for next month.

Where does your evidence stand against the new CQC framework?

CQC's replacement assessment framework closes its consultation this year — 34 Quality Statements collapsing into 24 Key Lines of Enquiry, numerical scoring replaced with descriptive Rating Characteristics. Final publication is expected over summer.

Most providers haven't read the draft yet. Fair enough — you're running a service, not tracking consultation documents.

So we built something to close that gap: a short, free self-assessment that maps your current evidence against the direction of travel. Fifteen questions across the five Key Questions (Safe, Effective, Caring, Responsive, Well-led). About four minutes. At the end, you get a readiness score and a specific gap list — not generic advice, actual next steps for the domains where your evidence is thinnest.

A few honest caveats, because we'd rather you trust the tool than be impressed by it:

→ It's built on the draft consultation, not the final framework — we'll update it the moment CQC publishes

→ It's a self-read, not an audit — useful for spotting direction, not for relying on at inspection

→ It's free. No email gate, no catch. If it's useful to you, that's the point.

The real reason to do this now rather than in the autumn: providers who start mapping evidence to the new structure today will be materially ahead when it lands. The ones who wait will be doing this same exercise under time pressure.

Link to the tool is in here:

🌊 Harbour Governance CQC Framework Check.

Accessible Information: Why "We Meet the Standard" Usually Means "We Meet Part of It"

If you asked most independent healthcare providers whether they comply with the Accessible Information Standard, you'd get a confident yes. Ask them to show you the evidence, and the confidence tends to thin out fast.

That gap matters more than it used to. The Standard was refreshed in 2025, a self-assessment framework now sits alongside it, and CQC has built it directly into how it tests the responsive key question. What used to be a soft expectation is now something you're asked to evidence — and increasingly, something a regulator will go looking for even if you don't offer it up.

This piece is about two things. First, the specific places providers tend to fall short, often without realising it. Second, something that doesn't get said often enough in governance circles: accessible information shouldn't be a favour someone has to ask for. If a person has to request it, and request it again at the next appointment, and again with the next clinician, the standard hasn't really been met — it's just been made conditional on the patient doing the work.

What the standard actually asks for.

The Accessible Information Standard (AIS, formally DAPB1605) has been a legal requirement for NHS and publicly funded adult social care providers since August 2016, and it explicitly covers private hospitals and organisations delivering NHS-funded care, not just NHS trusts. It applies wherever someone's ability to access or understand information, or to communicate with staff, is affected by a disability, impairment or sensory loss — and that includes carers and family members with needs of their own, not only the patient in front of you.

The standard sets out a sequence of steps organisations are expected to follow: identify a person's information and communication needs, record them clearly, flag them so they're visible wherever that person is seen, share them appropriately with other providers involved in their care, and meet them in practice. Following the 2025 update, a sixth step was formally added: review. Needs aren't static — they change, and the standard now expects providers to check in on them over time rather than recording something once and treating it as settled indefinitely.

None of this is exotic. It's closer to good clinical record-keeping than to a specialist accessibility project. Which is partly why it gets missed — it doesn't look like the kind of thing that needs a policy.

Where providers actually fall down

In our experience working across independent and private providers, the gaps rarely come from ill will. They come from treating the standard as a document rather than a live operational habit. A few patterns come up again and again.

Recording without flagging. A need gets noted in a consultation summary or an admissions form, and then it sits there — technically recorded, practically invisible. If a receptionist booking a follow-up, or a locum seeing the patient for the first time, has no way of seeing that flag at the point of contact, the recording has achieved nothing except paperwork. The test isn't "did we write it down somewhere," it's "would the next person interacting with this patient know, without having to ask."

One-off identification. Needs are often captured once, at registration or first assessment, and never revisited. Someone's hearing changes. Someone develops a condition that affects reading. Someone's preferred communication method shifts after a stroke or a diagnosis. The 2025 review requirement exists precisely because static records go stale, but a lot of providers haven't yet built review into any recurring process — it's not on a care plan cycle, not on an annual check, nowhere.

Treating it as a specialist add-on. Some providers have built genuinely good processes for patients who are already known to have a sensory impairment — an established deaf patient, for instance, has clear provision. But the standard applies far more broadly than that, and the identification step is supposed to be routine for everyone, not triggered only when a need is already obvious. If your process only switches on once someone discloses something, you've skipped the "identify" step entirely and gone straight to "meet," which only works for the people who already know to ask.

No audit trail. This is the one that catches people out with CQC. Since the self-assessment framework was introduced, providers are expected to be able to show their own performance against it, including publishing that self-assessment and the actions taken to close gaps. "We do this" isn't evidence. A register of identified needs, a record of flags applied, a note of when needs were last reviewed, a documented reason on the rare occasion a "should" requirement wasn't met — that's evidence. Very few independent providers have this ready to hand over, because until recently nobody was really asking for it.

The sector data behind this isn't flattering. Freedom of Information research found only around a third of NHS trusts considered themselves fully compliant, and a smaller fraction still could actually evidence having audited their own compliance. A 2025 report on deaf people's experience found the majority had never once been asked, at any point of contact, whether they had a communication need. These are NHS figures, but there's no reason to assume independent providers are, on average, doing better — most are smaller, with less dedicated equality and diversity resource, and the same instinct to assume "we'd know if it were a problem."

The part that doesn't get said enough: this isn't something people should have to ask for

Here's the bit we think gets lost in a lot of AIS compliance work, which tends to focus heavily on process and documentation and rather less on what it actually feels like from the other side of the desk.

The whole design of the standard is proactive. Identify, record, flag, share, meet, review — every one of those verbs describes something the organisation does. Not one of them says "wait for the patient to ask." And yet in practice, a huge amount of accessible provision in health and care still runs on the patient having to raise it — often more than once, often with someone new each time, often having to explain the same thing to a receptionist, then a nurse, then a consultant, because none of it was flagged anywhere they could see it.

That's not a technical failure of the standard. It's a failure to build it into the default pathway rather than treating it as an exception process for people who self-advocate. And self-advocacy under those conditions has a cost. Having to explain a disability or communication need repeatedly, to strangers, in a clinical setting, while also trying to manage whatever brought you there in the first place, is exhausting in a way that "just ask us" doesn't account for. It also quietly filters who gets accommodated well: people who are confident, who know their rights, who have the energy that day to push. Everyone else falls through — which is exactly what the RNID and SignHealth findings suggest is happening at scale.

Good governance on this doesn't stop at "we have a policy that says people can request accessible formats." It asks a harder question: does our default pathway assume the need might be there before anyone has said a word? Is identification something we do routinely, as a matter of course, the same way we routinely ask about allergies — or is it something that only kicks in once a patient has already had to flag themselves as different from the standard case? Access shouldn't be a favour granted on request. It should be the starting assumption, with the burden of building the process sitting with the provider, not the burden of asking sitting with the patient.

What this means practically for boards and governance leads

A few concrete things worth checking, beyond "do we have an AIS policy":

Can a member of front-line staff — reception, not just clinical — see a flagged communication need at the point of contact, without having to dig for it or ask a colleague?

Is there a defined trigger for reviewing recorded needs, rather than leaving review to happen only if something goes wrong?

Is identification built into a standard part of your pathway (registration, pre-assessment, annual check) for everyone, or does it only activate once someone discloses something?

If CQC asked for your self-assessment against the framework tomorrow, could you produce it, along with an action plan for the gaps it shows, within a day?

Where a "should" requirement in the standard genuinely isn't being met, is there a documented, credible reason on file — or is it just not happening, with no record of why?

None of this needs to be complicated. It needs to be built in as routine rather than treated as a specialism, and it needs an evidence trail that exists whether or not anyone ever asks to see it. That's the difference between an organisation that meets the standard and one that's confident it does.

If you want a structured way to work through where your own service stands against the AIS — identification, flagging, review cycles, and the self-assessment evidence CQC will expect to see — this is exactly the kind of gap analysis we build into the Harbour Governance toolkit. Get in touch if it would help to talk it through.

A Lost to Follow Up Tragedy

We wanted to write about a case that has hit pretty hard this week.

Paul Harries was an NHS manager who died in October 2024 from a ruptured abdominal aortic aneurysm (AAA), but this wasn’t a clinically silent condition. His aneurysm had been known about, monitored, and then lost.

The Prevention of Future Deaths report should be read carefully by every governance professional in the sector, and can be found here: 

https://www.judiciary.uk/prevention-of-future-death-reports/paul-harries-prevention-of-future-deaths-report/

Mr Harries AAA was initially diagnosed through the National AAA Screening Programme in November 2020 and referred on to the Vascular team at the Royal Sussex County Hospital. Following an initial assessment which showed a more complex picture, Mr Harries was further referred to the Assessment Unit (VAU) for scanning and monitoring. Monitoring by this team in January 2022 identified the aneurysm had increased in size.

In July 2022, Mr Harries missed a scheduled appointment and scan, no further action was taken and he was lost to follow up.

In February 2023,  Mr Harries attended ED after coughing blood for a week. He was scanned and the incidental finding showed a further increase in the size of the aneurysm. However, this information was not present in the discharge summary and his GP was not informed for 14 months.

In April 2024, Mr Harries' GP reviewed him for hypertension; became aware of the history of aneurysm and the more recent results, referring Mr Harries to the Vascular Team as ‘Urgent’.

Unfortunately the Vascular team operated a modified triage system, recategorised Mr Harries as ‘Amber’, which meant he would be triaged within six weeks and reviewed within around 40 weeks. This should have meant he was given the appropriate diagnostic tests by mid-May, and be reviewed by the team by mid-November.

A diagnostic scan in May 2024 showed the aneurysm was difficult to measure. His outpatient appointment, booked on 15 September 2024 was set for 19 October 2024.

Mr Harries died at home on 9 October 2024, two weeks before that appointment.

Mr Harries' family contacted PALS at The University Hospitals Sussex NHS Foundation Trust in February 2025, an inquest being opened on 25 September 2025. 

The coroner noted that there were four main areas of concern:

• a failure of safety netting and follow-up systems.

• Incidental finding communication - incidental findings not routinely communicated if they do not relate to the presenting complaint: 

• Urgent referral recategorisation: There was a failure to request of the GP their rationale behind the urgency.

• Long waits with a condition known to be deteriorating.

The Coroner went on to note that the changes made by the hospital "do not appear to fully resolve the observed weaknesses", and that the hospital remains reliant on three separate referral systems - which rely on three different IT systems.

We at Harbour are not writing this to apportion blame. 

The trust has responded with evident commitment to change, and the individuals involved were operating within systems that failed them as much as they failed Mr Harries.

We are highlighting this writing this because every one of these failures has a governance name:

• Failure of safety netting systems.

• Failure of information governance and clinical communication.

• Failure of triage governance and clinical oversight.

• Failure of risk stratification and escalation

The trust has since announced significant investment in a new Electronic Patient Record — and we genuinely hope it helps. A well-implemented EPR, with cross-specialty visibility and automated flagging of incidental findings, should make cases like Mr Harries less likely.

But here is the question that kept us discussing this into the night as governance professionals:

What happens when we digitise a broken system?

An EPR doesn't fix a culture where urgent referrals get recategorised without sufficient clinical oversight. It doesn't automatically resolve the question of who is responsible when a finding crosses specialty boundaries. It doesn't eliminate the human judgment call that sits at the centre of triage.

Done well, digital transformation closes the gaps. Done poorly, it makes them faster, more scalable, and so much harder to see.

The governance question for every provider investing in new digital systems right now is not just: will this EPR connect our data? 

It's: have we mapped our existing failure points honestly enough to know whether we're building something better — or just digitising what we already have?

None of these questions are unique to large NHS trusts, and Independent providers face the same risks, often with smaller teams, less infrastructure, and digital systems that were never designed to talk to each other.

Effective oversight of patient safety transcends administrative compliance; it represents the critical boundary between a clinical oversight and a tragic outcome.

In the context of Paul’s experience, several governance challenges remain unresolved:

• Where does the accountability lie for monitoring patients who miss scheduled imaging?

• How do we guarantee that unexpected clinical findings are effectively relayed to primary care?

• What are the mechanisms for justifying the recategorisation of urgent clinical referrals?

• Which specialty assumes primary responsibility when a diagnosis spans multiple departments?

Any framework unable to address these fundamental queries is fundamentally compromised. 

Without clear answers, we risk accelerating the pace of institutional failure.

Rest in peace, Paul Harries. We owe a debt of gratitude to his family and the coroner for their commitment to ensuring the healthcare sector learns from this loss.

Source: HSJ, 2025; https://www.judiciary.uk/prevention-of-future-death-reports/paul-harries-prevention-of-future-deaths-report

#PatientSafety #HealthcareGovernance #PSIRF #DigitalSafety #EPR #ClinicalGovernance #HarbourGovernance #IndependentHealthcare

Healthcare Complaint Management in England & Wales — What's Coming and Why It Matters

A Harbour Governance Sector Insight  ·  July 2026

Category: Regulatory Updates

Complaint management is one of the most under-governed areas in independent healthcare. Most providers have a complaints policy.

Far fewer have a complaints system — one that identifies patterns, drives learning, closes the loop with patients, and gives the board genuine assurance.

That gap matters more now than at any point in the last decade. Because the regulatory and legislative landscape around complaint handling in England and Wales is changing — faster, and more significantly, than most providers realise.

This briefing sets out where things stand, what good looks like right now, and what is coming in the next twelve to eighteen months.

The current landscape — in brief

In England, the legal framework for complaint handling is the Local Authority Social Services and National Health Service Complaints (England) Regulations 2009. These establish a two-stage process: local resolution by the provider, followed by referral to the Parliamentary and Health Service Ombudsman (PHSO) for complaints that remain unresolved.

The PHSO has developed NHS Complaint Standards that set out how organisations providing NHS services should approach complaint handling. These place a strong emphasis on early resolution, compassionate engagement and fair, accountable responses.

For independent providers — here is where it gets complicated.

The PHSO has no jurisdiction over privately funded care. If a patient receives privately funded treatment and remains dissatisfied following the provider's local complaints process, their options are limited. ISCAS (the Independent Sector Complaints Adjudication Service) provides independent adjudication — but membership is voluntary. If your organisation is not registered with ISCAS, a dissatisfied private patient currently has no independent route of appeal.

This is a significant governance and reputational gap. And it is one that is increasingly on Parliament's radar.

In Wales, the most significant complaints reform in fifteen years has just come into force. The new Listening to People framework replaced Putting Things Right on 1 April 2026, introducing a two-stage process — Early Resolution and Formal Investigation — with financial redress of up to £50,000 in eligible cases. For independent providers regulated by Healthcare Inspectorate Wales, the expectation that complaint governance aligns with these four core principles is increasingly being applied in HIW inspections.

What good complaint management looks like in 2026

Drawing from PHSO standards and CQC's Well-Led expectations, there are eight defining characteristics of good complaint management right now. The four that independent providers most consistently get wrong are:

1. Agreed — not imposed — timescales The 2009 Regulations do not set a mandatory response deadline. Good practice requires agreeing a timescale with the complainant at the acknowledgement stage. Not telling them when you will respond. Agreeing it. The distinction matters both to patients and to inspectors.

2. Any open door - The NHS (and therefore the CQC) doesn't have a formal "open door" policy, but it lives by a "no wrong door" principle. That means complaints can be raised anytime, anywhere—by phone, email, or in person—and staff are trained to catch concerns even if you never use the word "complaint." Issues are fixed informally on the spot if possible, and if not, the door simply opens onto the next stage, all the way up to the independent Ombudsman. In short: the system is designed so you never have to fight to be heard—you just have to walk in.

3. A coordinated response when multiple providers are involved Where a patient's complaint spans more than one provider, those providers are required to give a coordinated response. This is one of the most frequently cited complaint handling failures in CQC inspection reports — particularly in independent providers who share patients with NHS services.

4. Genuine learning — not just resolution Modern complaint governance is not about closing cases. It is about triangulating complaint themes with incident data, patient feedback and audit findings to identify where systems are failing. PSIRF expects this. CQC's Well-Led framework expects this. The PHSO expects this. Resolving individual complaints without analysing the patterns is compliance theatre.

The horizon — what's coming in the next 12-18 months

The following section provides a summary of the key developments on the horizon. Our full horizon scan — covering all five developments in detail, with governance action points for each — is available to Harbour and Deep Water subscribers.

The 10 Year Health Plan — complaint reform commitment The government has committed to reforming the NHS complaints process through the 10 Year Health Plan — setting clear standards for both timeliness and quality of responses, and introducing a new National Director of Patient Experience. The most significant proposal is the introduction of patient power payments — allowing patients to withhold a portion of payment for their care if dissatisfied. If enacted, this would be the most significant shift in complaint leverage for patients in a generation.

PHSO jurisdiction — the independent sector gap Parliamentary attention on the absence of a mandatory independent complaints route for privately funded patients is growing. The most likely development is a tightening of CQC registration expectations — requiring all independent providers to belong to an approved independent adjudication scheme such as ISCAS. This is not yet confirmed, but providers who are not currently ISCAS members should be reviewing that position now.

Healthwatch England abolished Healthwatch England is being abolished, with patient voice functions moving to the Department of Health and Social Care. For independent providers, this removes one patient advocacy route and may increase the volume of complaints that escalate directly to CQC.

For the full analysis — including the Wales Listening to People framework in detail, the CQC/HSSIB merger implications for complaint governance, and our recommended governance action plan for independent providers — see our full Complaints Horizon Scan, available to Harbour and Deep Water subscribers.

Three questions to ask about your complaints governance today

Before the landscape changes further, here are the three questions every governance lead and board member in independent healthcare should be able to answer:

1. If a private patient exhausts your internal complaints process and remains dissatisfied — where do they go? If the answer is "I'm not sure" or "there isn't anywhere," that is a governance gap and a reputational risk. The answer should be: to ISCAS, or to an equivalent approved adjudication scheme.

2. Can you show your board a complaints themes analysis from the last twelve months — not just a case count? A board that only sees how many complaints were received, and how many were resolved within timescale, is not being given the governance information it needs. Themes, learning, and evidence of service change are the markers of a mature complaints system.

3. Does your complaints process meet the Accessible Information Standard? If patients cannot access your complaints process in a format that meets their communication needs — large print, BSL interpretation, easy read — your complaint handling is failing before it has started. This is a compliance gap that CQC is increasingly focused on.

How Harbour Governance can help

Our Complaints, Compliments and Feedback policy — included in all subscription tiers — is aligned to current PHSO standards and CQC expectations, and will be updated as the landscape changes.

Our full Complaints Horizon Scan — covering all five horizon developments in detail with governance action points — is available to Harbour and Deep Water subscribers.

If you are a governance lead or board member who wants to understand your complaints position before the landscape shifts further, book a conversation with our founder here — available to Deep Water subscribers.

Harbour Governance publishes regular regulatory analysis and practical governance guidance for independent and private healthcare providers in England and Wales. Subscribe to receive updates directly.

Preparing for Your First CQC Inspection: A Practical Guide

So, you've registered your service, the certificate is on the wall, and now the reality is setting in: your first CQC inspection is on the horizon. It's completely natural to feel a mix of pride and apprehension. This milestone is a chance to showcase the quality of care you provide, and with the right preparation, you can approach it with confidence rather than dread.

Understand the New Rules of the Game

The Care Quality Commission has moved to a Single Assessment Framework, a significant shift from the old Key Lines of Enquiry (KLOEs). The core of what they assess remains the same: Is your service Safe, Effective, Caring, Responsive, and Well-led?. However, the way they gather evidence has changed. Instead of a single, high-stakes inspection day being the primary event, the CQC now gathers intelligence on a more continuous basis. This means your readiness shouldn't be a one-off event but an ongoing state of being. The framework uses 34 'quality statements' (like "We protect people from harm") as the benchmark for what good care looks like, and inspectors will want to see tangible evidence that you meet them.

Get Your Evidence House in Order

The most common pitfall for new providers isn't delivering poor care—it's failing to document it. If it isn't written down, it didn't happen.  Inspectors will test your systems, and you need to be able to provide evidence instantly.

• Core Documentation is Key: Your Statement of Purpose, up-to-date policies and procedures (Safeguarding, Complaints, Medication, MCA/DoLS, Recruitment), and a clear Governance Framework are non-negotiable.

• Demonstrate Operational Readiness: Even if you have no clients yet, show that you are ready. Have your care planning, rota systems, and training partners secured. A provider with no staff still secured approval by demonstrating their full onboarding workflow and induction process.

• Show, Don't Just Tell: Prepare real-world examples. This includes a log of complaints and incidents showing how you learned from them, completed audits with action plans, staff supervision records, and patient feedback surveys.

Treat the Registration Assessment Like a Governance Interview

Your post-submission registration assessment call is not a casual chat. It's the decisive gateway to approval. The Registered Manager (RM) is the linchpin of this process. If they underperform, the whole application can stall.

Prepare the Registered Manager: The RM must be able to articulate governance strength, regulatory understanding, and operational readiness . They should be ready for scenario-based questions, such as "A medication error occurs—walk me through your actions," and provide a structured, step-by-step answer .

Know Your Application Inside Out:

Your verbal answers will be cross-referenced against your application. Any inconsistency raises red flags. For example, stating you will start with "5 care staff" in the application and saying "2" in the interview was enough for the CQC to question a provider's planning stability.

Involve and Prepare Your Team

An inspection isn't just for the leadership. Inspectors will speak to a range of staff, from clinicians to receptionists.

• Build Confidence: Provide staff with short, practical briefings on what to expect. Focus on their role in the five key questions. They should be proud and positive about the work they do.

• Practical Tips for Staff: Remind them to wear their name badge, keep workspaces clean and tidy, and know how to raise a concern (like safeguarding or whistleblowing). If an inspector approaches while they are with a patient, they should politely let the inspector know they will be with them as soon as possible.

Test Your Readiness with a Mock Inspection

One of the most effective ways to prepare is to simulate the real thing. A mock inspection can be done internally or with external specialists.

• Uncover Unknown Unknowns: This is where you'll find missing documents, test whether policies are truly being followed in practice, and see how your team handles the pressure of being questioned.

• Reduce Anxiety: Familiarising everyone with the process helps reduce stress on the actual day.

Key Insight:

The CQC's implementation of the Single Assessment Framework has faced significant criticism and an independent review found "significant failings in the effectiveness of the CQC". Providers have reported that reports can be too brief, lack detail, and assessment teams sometimes lack consistency. This is important context for you. While you must prepare thoroughly, this means you should also be prepared to challenge factual errors in your draft report and provide clear, detailed evidence to support your case. The regulator's own challenges mean a well-documented, articulate provider is in a stronger position than ever.

Take a breath. You can prepare for this. Your policies will be in place, your evidence organised, your staff briefed. 

CQC inspectors are not adversaries — they are assessing whether your patients are safe and well cared for. 

Be calm, be open, and be honest. 

If you do not know the answer to something, say so and offer to find out. That is always better than guessing.