Care Home Safeguarding: What CQC Expects

This guide explains how safeguarding duties apply to care homes registered with CQC in England. It is general guidance on regulatory compliance, not legal advice, and it does not replace your local safeguarding adults board's procedures. The legislation and case law in this guide were checked on 17 September 2026.

Safeguarding in a care home is not one duty. It is three, and they sit with three different bodies. You have a standing duty under Regulation 13 to operate systems that prevent and investigate abuse. Your local authority has a duty under section 42 of the Care Act 2014 to make enquiries once it has reasonable cause to suspect an adult is at risk. And you have a separate duty to notify CQC. Homes get into difficulty when they collapse all three into a single act — "we raised a safeguarding" — and assume the rest follows.

It does not follow. A referral to the local authority is not a notification to CQC. An enquiry by the local authority does not discharge your own duty to investigate. And closing the local authority's enquiry does not close yours.

Your duty: Regulation 13

Regulation 13 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 is headed "Safeguarding service users from abuse and improper treatment." Its opening requirement is broad: "Service users must be protected from abuse and improper treatment in accordance with this regulation."

Two operative paragraphs then do most of the work, and the difference between them is worth reading slowly:

13(2) — "Systems and processes must be established and operated effectively to prevent abuse of service users."
13(3) — "Systems and processes must be established and operated effectively to investigate, immediately upon becoming aware of, any allegation or evidence of such abuse."

Note "immediately upon becoming aware of." The regulation does not say "once the local authority has decided whether to open an enquiry." Your investigation duty is triggered by awareness, not by anyone else's decision. In practice this means the immediate protective steps — separating the people involved, preserving records, informing the person and their representative — belong to you and start straight away.

Regulation 13(4) then sets out what care must never include. Care or treatment must not be provided in a way that includes "discrimination against a service user on grounds of any protected characteristic (as defined in section 4 of the Equality Act 2010)", or that includes "acts intended to control or restrain a service user that are not necessary to prevent, or not a proportionate response to, a risk of harm", or that "is degrading for the service user", or that "significantly disregards the needs of the service user for care or treatment."

That last limb is the one most often overlooked. Significant disregard of a person's care needs is abuse for these purposes. A resident repeatedly left without the repositioning their care plan specifies is a Regulation 13 matter, not merely a care-quality one.

What counts as abuse

Regulation 13(6) defines it, and the definition is narrower and more specific than the everyday word:

"abuse" means—(a) any behaviour towards a service user that is an offence under the Sexual Offences Act 2003, (b) ill-treatment (whether of a physical or psychological nature) of a service user, (c) theft, misuse or misappropriation of money or property belonging to a service user, or (d) neglect of a service user.

Financial abuse appears explicitly at (c). Homes that treat safeguarding as being about physical harm tend to under-report the money cases — a resident's pension being managed informally by a relative, small sums going missing from rooms — which are squarely within the definition.

Restraint has its own test

Regulation 13(7) defines control and restraint widely: a person restrains a service user if they use or threaten force "to secure the doing of an act which the service user resists", or restrict the person's "liberty of movement, whether or not the service user resists, including by use of physical, mechanical or chemical means."

"Whether or not the service user resists" is the phrase that catches people out. A resident who does not object to a lap belt, a chair placed against a door, or sedation used to manage behaviour is still being restrained. And "chemical means" puts covert or behaviour-management medication inside this regulation.

Regulation 13(5) adds that a service user "must not be deprived of their liberty for the purpose of receiving care or treatment without lawful authority" — which is where the Deprivation of Liberty Safeguards come in as the authorising route.

The local authority's duty: section 42

Section 42 of the Care Act 2014 applies where a local authority "has reasonable cause to suspect that an adult in its area (whether or not ordinarily resident there)" has needs for care and support, "is experiencing, or is at risk of, abuse or neglect", and "as a result of those needs is unable to protect himself or herself against the abuse or neglect or the risk of it."

Where those three conditions are met, the authority "must make (or cause to be made) whatever enquiries it thinks necessary to enable it to decide whether any action should be taken in the adult's case."

Three practical consequences follow for a care home:

The duty is the authority's, not yours. You refer; they decide whether the section 42 threshold is met. A referral that does not result in an enquiry has not been "rejected" and does not mean you were wrong to refer.

"Cause to be made" often means you. Local authorities routinely delegate the fact-finding of an enquiry back to the provider. Being asked to investigate your own incident is normal practice, not a sign of trust — but it is the authority's enquiry, run to its terms and timescales, and the report goes to them.

Your Regulation 13(3) investigation runs alongside. They overlap heavily and you should not duplicate work, but they answer different questions. Theirs asks what should happen for this adult. Yours asks what your systems let happen and what changes.

Section 42(3) also confirms that "abuse" here "includes financial abuse", listing having money or property stolen, being defrauded, being put under pressure over money or property, and having money or property misused.

The CQC duty: notification

This is the step most often missed, because it feels like it has already been done. It has not.

Regulation 18(1) of the Care Quality Commission (Registration) Regulations 2009 requires that "the registered person must notify the Commission without delay of the incidents specified in paragraph (2)". Regulation 18(2)(e) specifies "any abuse or allegation of abuse in relation to a service user".

Read that as written. It is abuse or allegation of abuse — not substantiated abuse, not abuse the local authority has accepted for enquiry. The trigger is the allegation. Waiting for an outcome before notifying is itself the breach, and it is one CQC can see plainly afterwards by comparing your incident log to your notification history.

"Without delay" is not defined as a number of days. Treat it as the same working day you become aware, or the next at the outside.

Our guide to CQC statutory notifications covers the full set of notifiable events and the submission routes. Where an incident also meets the notifiable-safety-incident threshold, the separate duty of candour obligations apply on top — again, not instead.

Where this becomes criminal

Breach of a fundamental standard is often dealt with through the improvement route: a warning notice, a requirement to comply, conditions on registration. But most of the fundamental standards also carry criminal liability, and safeguarding is one of them — with a condition attached that is worth understanding precisely.

Regulation 22 creates two kinds of offence. Under 22(1), failure to comply with Regulations 11, 16(3), 17(3), 20(2)(a) and (3), or 20A is an offence in its own right — no harm need follow. Under 22(2), failure to comply with Regulations 12, 13(1) to (4) or 14 is an offence where that failure "results in — (a) avoidable harm (whether of a physical or psychological nature) to a service user, (b) a service user being exposed to a significant risk of such harm occurring, or (c) in a case of theft, misuse or misappropriation of money or property, any loss by a service user of the money or property concerned."

Safeguarding sits in that second group. So a Regulation 13 breach is not automatically a prosecution — it becomes one at the point somebody is harmed, exposed to a significant risk of harm, or loses money or property. Regulation 22(4) then provides a defence where the registered person proves they "took all reasonable steps and exercised all due diligence to prevent the breach."

That defence is the reason your paperwork matters. "All reasonable steps and all due diligence" is demonstrated with training records, supervision notes, a safeguarding policy people have actually read, referral records, and evidence that concerns raised internally were acted on. It is not demonstrated by the absence of previous incidents.

What CQC tests at assessment

Expect the questions to land in four places.

Staff knowledge, tested directly. Inspectors interview care staff away from managers and ask what they would do if they suspected abuse. The answer they want is specific: who they tell, that they can go outside the home if needed, and that they do not need permission to raise a concern. A confident "I'd tell the manager" with nothing behind it reads as a gap.

Your log against your notifications. The single most common finding is an incident recorded internally with no corresponding CQC notification. Reconcile the two lists yourself, quarterly, before someone else does.

Whether concerns travel upward. Inspectors look for evidence that low-level concerns — a rough transfer, a dismissive comment, a pattern of missed calls — get recorded and reviewed rather than resolved informally in the corridor. Cultures that only capture serious incidents are the cultures where serious incidents accumulate unseen.

Learning, not just closure. Under Regulation 17(2), systems must enable you to "assess, monitor and improve the quality and safety of the services provided" and to "assess, monitor and mitigate the risks relating to the health, safety and welfare of service users and others". A closed safeguarding with no recorded change is a closed incident, not evidence of governance. Show the theme analysis and what you altered as a result.

Your safeguarding records are also core evidence for the Well-Led key question — see our guide to Well-Led evidence for how this fits the wider governance picture, and how to write care notes for the record quality an enquiry will be reconstructed from.

A short reconciliation to run this month

Pull every safeguarding concern logged in the last 12 months and match each to a CQC notification. Investigate any that has none.
Check your log includes financial and neglect concerns, not only physical ones. A log that is entirely physical incidents is almost certainly under-capturing.
Confirm every restraint in use — including lap belts, bed rails, sedation and door practices — has a recorded capacity assessment, best-interests decision and authorisation where required.
Ask two care staff, unprompted, what they would do if they suspected abuse and who they could go to outside the home. Their answers are the ones CQC will hear.
Check your safeguarding policy names your current local authority safeguarding team and current CQC contact routes, and that its review date has not passed.

This is general guidance based on the published Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, the Care Quality Commission (Registration) Regulations 2009 and the Care Act 2014, all checked on 17 September 2026. Safeguarding procedures vary between local authorities and your local safeguarding adults board's procedures take precedence on referral routes and thresholds — check them alongside the current guidance on cqc.org.uk. Not legal advice.

Sources

Safeguarding concerns, notifications, capacity assessments and the evidence tying them together tend to sit in separate places until someone asks for all of them at once. InspectReady keeps them organised and current, built for independent care homes rather than enterprise chains. Start your free trial — 14 days free, no card required.