Duty of Candour: A Practical Guide for Registered Managers
- Manu Thomas ACP | Former CQC Specialist Advisor | NICE Associate
- Jul 14
- 7 min read
Duty of candour is not a form you complete after something goes wrong. It is a fundamental standard, one of the areas CQC pays particular attention to, and it sits at the heart of how inspectors judge whether a service is genuinely open and safe. For registered managers, that means duty of candour has to work as a live operational process, not a policy document that only gets read after an incident.
This guide sets out what the law requires, how to recognise when the duty applies, and how to build a process your staff can actually follow under pressure.
What duty of candour actually is
Duty of candour comes from Regulation 20 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014. It has applied to adult social care providers since April 2015, alongside NHS bodies and independent healthcare providers.
There are two duties that sit alongside each other. The general duty requires providers to act in an open and transparent way with people using the service and their families, at all times, whether or not something has gone wrong. The specific duty sets out exact steps that must be followed when a notifiable safety incident occurs. Registered managers need both to be working, because it is entirely possible to be broadly open and transparent as an organisation while still failing the specific, procedural requirements of Regulation 20 when an incident happens.
CQC regulates the statutory duty. Where staff hold professional registration, for example nurses or social workers, they also carry a separate professional duty of candour overseen by their own regulator, such as the NMC. The two duties reinforce each other but are not the same thing, and registered managers should not assume that professional-body training on candour automatically satisfies the statutory requirements CQC inspects against.
What counts as a notifiable safety incident
This is the point where most services either get duty of candour right or fall down on it, because the trigger is often missed at the point of reporting, not at the point of response.
A notifiable safety incident is any unintended or unexpected incident that occurs during the delivery of a regulated activity and that, in the reasonable opinion of a healthcare professional, has resulted in, or appears to have resulted in, the service user's death (where directly related to the incident), or severe harm, moderate harm, or prolonged psychological harm.
Three questions determine whether an incident meets the threshold:
Was the incident unintended or unexpected?
Did it occur during the delivery of a regulated activity?
Did it result in, or could it result in, death, severe harm, moderate harm, or prolonged psychological harm?
If the answer to all three is yes, the specific duty of candour applies and the notification process must be followed. If any answer is no, the general duty to be open and transparent still applies, but the formal notification steps are not triggered.
In practice, common social care scenarios that meet the threshold include unwitnessed falls resulting in fracture, medication errors causing harm, pressure ulcers that develop to a significant grade under the provider's care, and any incident that a reasonable healthcare professional would judge as causing moderate harm or worse. An unwitnessed fall with no injury, or a near miss caught before it reached the person, would not meet the threshold on its own, though it may still warrant an open conversation and should always be recorded and reviewed.
Registered managers should build this three-question test directly into incident reporting forms, so the judgement is made at the point of reporting rather than retrospectively when someone reviews the file weeks later.
What the specific duty requires, step by step
Once an incident meets the notifiable safety incident threshold, Regulation 20 sets out a defined sequence. As soon as reasonably practicable after becoming aware of the incident, the registered person must:
Notify the relevant person in person. This means a face-to-face conversation with the service user, or their representative if the person lacks capacity or has died, delivered by one or more representatives of the provider. It should not be a letter or a phone call where an in-person conversation is reasonably possible.
Give a truthful account of the facts as currently known. The notification must set out what the provider knows about the incident at that point, in terms the person can understand, without waiting for a full investigation to conclude first.
Explain what further enquiries the provider believes are appropriate. People are entitled to know what happens next, not just what happened.
Offer an apology. This is not optional and it is not an admission of liability. An expression of sorrow or regret is a distinct legal requirement under the regulation, separate from any conversation about fault or compensation.
Follow up in writing. A written record of the notification, including the apology, must be given to the relevant person, and a copy kept on file.
Keep a complete written record of all communication with the relevant person throughout the process, not just the initial notification.
The apology point is worth reinforcing with staff specifically, because reluctance to apologise is one of the most common reasons duty of candour breaks down in practice. An apology under this duty does not affect indemnity cover and does not constitute an admission of legal liability. Services that delay or avoid apologising, often out of concern about insurance or litigation, are the ones most likely to face both regulatory action and, separately, a complaint or claim from the family, since a lack of timely apology is frequently what pushes people towards formal action in the first place.
How CQC assesses duty of candour on inspection
CQC does not investigate every notifiable safety incident directly. That responsibility sits with the provider. CQC's role is to check that the provider is fulfilling its responsibility to carry out the duty correctly, and it does this in several ways: following up incidents reported through notifications that were or should have been marked as triggering the duty, asking providers directly about recent incidents, and asking people who have experienced a notifiable safety incident how the provider responded to them.
Inspectors will look for evidence of all three elements working together: that the provider recognises when the duty applies, that it follows the specific procedural steps correctly, and that this sits within a wider culture of openness rather than existing only as a compliance exercise. Ultimate responsibility rests with the registered person, meaning you as registered manager or the provider, and CQC can move directly to enforcement action, including criminal prosecution, for a breach of Regulation 20.
Want a clear picture of where your service stands against this and the wider CQC framework? Our CQC Readiness Assessment gives you a structured view of your compliance position before an inspector does.
Building a duty of candour process that holds up
A policy on paper does not protect you if staff do not know how to apply it under pressure. A workable process needs the following in place.
Policies. A single duty of candour policy that includes the three-question threshold test, the required notification steps in order, template wording for the initial conversation and apology, and a clear line of accountability for who authorises and delivers the notification.
Staff competence. Training that goes beyond a slideshow. Staff, at every level of seniority, need to understand what triggers the duty, why apologising is required and safe to do, and how to escalate a concern if they believe the duty has not been followed by someone else. New starters should cover this in induction, not wait for annual refreshers.
Audits. Regular sampling of incident reports against the three-question test, checking not just the incidents that were flagged as notifiable, but a sample of those that were not, to catch under-reporting.
Care planning. Incident and duty of candour outcomes feeding back into individual care plans and risk assessments, so learning is visible at the level of the person affected, not just in a governance spreadsheet.
Feedback. A route for families and service users to raise concerns if they believe an incident was not disclosed to them, separate from the general complaints process, since this goes to the heart of trust in the service.
Governance. Duty of candour compliance reviewed at registered manager and provider level on a fixed schedule, with themes reported to the wider governance structure, not just closed off incident by incident.
Practical checklist for registered managers
Does your incident reporting form include the three-question notifiable safety incident test?
Do staff at every level know that an apology is required and that it does not constitute admission of liability?
Is there a named process for who delivers the in-person notification and within what timeframe?
Are written records of all duty of candour communications kept and auditable?
Do you regularly sample incidents that were not flagged as notifiable, to check the threshold judgement was correct?
Is duty of candour training refreshed annually and covered explicitly at induction?
Is there a governance route for themes from duty of candour incidents to reach senior oversight?
Frequently Asked Questions
Does duty of candour only apply to health and NHS providers? No. Duty of candour applies to every provider registered with CQC, including adult social care providers, and has done since April 2015.
Is an apology under duty of candour an admission of liability? No. An apology given as part of the duty of candour is an expression of sorrow or regret. It is not a legal admission of liability and does not affect indemnity or insurance cover.
What happens if a notifiable safety incident is not disclosed? Failure to comply with the duty of candour can result in CQC enforcement action, including warning notices, requirement notices, or criminal prosecution, since duty of candour is a fundamental standard.
Who is responsible for ensuring duty of candour is carried out? Ultimate responsibility sits with the registered person, in practice the registered manager or provider, even though individual staff are expected to cooperate with the duty in their day-to-day roles.
Does an unwitnessed fall automatically trigger duty of candour? Not automatically. It depends on whether the fall resulted in, or could have resulted in, death, severe harm, moderate harm, or prolonged psychological harm. An unwitnessed fall with no resulting injury would not meet the threshold, though it should still be recorded and reviewed, and the general duty to be open with the person still applies.
Sources
Care Quality Commission, Regulation 20: Duty of candour (regulation in full) — cqc.org.uk
Care Quality Commission, How we regulate the duty of candour — cqc.org.uk
Care Quality Commission, Updated guidance on meeting the duty of candour — cqc.org.uk
Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, Regulation 20 — legislation.gov.uk
Comments