Safeguarding Audits in Care Homes: How to Run and Evidence Them

A safeguarding audit is an internal check a care provider runs on its own safeguarding systems, testing whether concerns are recognised, referred, recorded and acted on. Councils in England received 640,240 safeguarding concerns in 2024-25, the eighth consecutive annual rise, and carried out 185,270 Section 42 enquiries off the back of them.

Most providers we speak to do not have a policy problem. They have an evidence problem. The policy exists, staff have been trained, concerns get escalated, and none of that is easy to show when the proof sits across a paper file in the office, a shared drive, and a separate policy system nobody has opened since the last review.

What is a Safeguarding Audit in Adult Social Care?

A safeguarding audit is a structured review of how well a care service prevents, recognises and responds to abuse, carried out by the service itself and evidenced for the regulator.

It is worth being precise about the language, because providers and the regulator do different things. The provider audits its own service. CQC inspects and assesses it. A policy or procedure that refers to a CQC audit is describing something that does not exist, and it is a small detail that is easy to correct before an assessment.

Safeguarding consultancies also sell external audits, and these are a different exercise. An external audit is usually commissioned every one to three years, carried out by someone from outside the organisation, and delivered as a written report. It is a useful second opinion, but it cannot do the job of the internal audit, which runs on a regular cycle and produces evidence continuously.

What Does CQC Regulation 13 Require You to Evidence?

Regulation 13 requires systems and processes that prevent abuse, immediate investigation of allegations, and board-level responsibility for safeguarding.

It is worth reading the regulation itself rather than relying on a summary from a training slide.

• Regulation 13(2) requires systems and processes that prevent abuse of service users.
• Regulation 13(3) requires the provider to investigate immediately upon becoming aware of an allegation, and to take action in line with local Safeguarding Adults Board procedures.
• CQC’s guidance adds that safeguarding training should be given at induction, at a level appropriate to each person’s role, and that a named person at board level should be responsible for safeguarding.

This is also the reason to anchor your audit to the regulation rather than to CQC’s assessment framework. Regulation 13 has been in force in its current form since 2014. The framework that sits above it, which determines how your evidence is judged, has changed several times over the same period and is being revised again, with sector-specific frameworks consulted on during 2026.

An audit built around the regulation stays usable through those changes. An audit built around the 34 quality statements has to be reworked every time they are replaced.

Our guides to CQC compliance, the CQC single assessment framework, and CQC quality statements cover the framework side in more detail.

What Evidence Does CQC Expect to See?

No single list is mandated, but assessors consistently look for:

• Training records mapped to role, with refresh dates
• The safeguarding policy, its review date, and evidence it aligns with local Safeguarding Adults Board procedures
• Concern and referral logs, with timestamps
• Incident records and investigation outcomes
• DBS checks and recruitment files
• Restraint and Deprivation of Liberty Safeguards records
• The action trail showing what changed as a result

The CQC Self Assessment Safe template covers the wider domain this evidence sits in, and our CQC inspection checklist templates cover how the same evidence is used across an assessment.

What Should a Safeguarding Audit Cover?

A safeguarding audit covers eight areas, each producing a different kind of evidence.

Scope area	Evidence it produces
Policy and local procedure alignment	Reviewed policy, dated, referencing your Safeguarding Adults Board
Staff knowledge and training	Training matrix by role, refresh dates, competence checks
Recognising and reporting	Staff able to describe thresholds and routes without prompting
Referrals and notifications	Concern log, referral decisions, CQC notification records
Recruitment and DBS	Completed files, gaps explained, renewal dates tracked
Restraint and deprivation of liberty	Authorisations, least-restrictive rationale, review dates
Resident and relative voice	Feedback records, how concerns raised informally were handled
Learning from incidents	What changed after the last safeguarding incident

Several of these overlap with audits you may already be running. Restraint and deprivation of liberty is covered in more depth by the Use of Bed Rails Audit, and how people are treated day to day sits in the Dignity In Care Audit.

Both belong to the wider care home audit library, and our guide to risk assessment in health and social care explains how safeguarding risk sits alongside the other risks you assess.

It is also worth thinking about how the checklist itself is written. UK care compliance specialists argue that a safeguarding audit should prompt the person running it to think, and should generate evidence the service owns, rather than prescribe a fixed list of documents to hold.

The reasoning behind that is practical. A service can hold every document on a prescribed list and still have an assessor judge the evidence insufficient, because the criteria are broad and the question of what counts as sufficient is the assessor’s to answer. A checklist that implies compliance gives a provider confidence it has not yet earned. A checklist that asks good questions produces evidence the manager can stand behind and explain.

How Do You Audit Safeguarding Concerns and Referrals?

When you audit safeguarding concerns and referrals, what you are really auditing is the decision trail rather than the outcome. Whether a referral was made matters less than whether the decision to make it, or not to make it, was reasonable, taken in good time, and recorded when it happened.

This is the part of safeguarding that generates the most evidence and gets audited the least.

When Does a Concern Meet the Section 42 Threshold?

Section 42 of the Care Act 2014 sets three conditions, and all three must apply before the local authority has a duty to make enquiries:

1. The adult has needs for care and support, whether or not the local authority is meeting any of those needs.
2. The adult is experiencing, or is at risk of, abuse or neglect.
3. As a result of those needs, the adult is unable to protect themselves against the abuse or neglect, or the risk of it.

The judgement about whether a concern meets that threshold is yours to make and to record. The local authority does not make it for you. Gather the facts before you decide: what happened, when it happened, who was present, what the person says about it, and any injury documented on a body map. Your audit should then sample concerns from the log and ask whether that sequence is visible in the record, or whether the record simply states the conclusion.

Nuffield Trust analysis of safeguarding data found that concerns have risen 76% since 2016-17, faster than the enquiries that follow them, and that neglect and acts of omission are the most common risk type.

Neglect is also the category where threshold decisions vary most between services and between individual managers, which is why the reasoning behind each decision needs to be written down at the time rather than reconstructed afterwards.

What’s the Difference Between a Safeguarding Referral and a CQC Notification?

These are separate duties with different thresholds, and treating them as one is among the most common gaps we see.

	Safeguarding referral	CQC statutory notification
Goes to	Local authority safeguarding team	CQC
Triggered by	A concern meeting the Section 42 threshold	Allegations of abuse, whether or not referred
Timescale	Set by your local authority, often within one working day	Without delay
Form	Local authority provider form	CQC notification form

Making the referral does not discharge the notification duty, and a concern that falls below the Section 42 threshold can still require notifying CQC. The CQC Notification Log Audit checks this trail specifically.

The same principle applies across the whole audit: record the reasoning, not only the answer. When you decide that a concern does not meet the threshold, the evidence that protects you is the rationale you wrote at the time, not the absence of a referral in the log. It is also why a yes/no tick box with no comment field makes for a weak audit, whatever it happens to be auditing.

How Often Should You Run a Safeguarding Audit?

A safeguarding audit works best on two separate cycles, because the safeguarding log and the wider safeguarding system need checking at different intervals.

• Monthly: the safeguarding log. The care home audit schedule GoAudits built with compliance experts at Care Quality Solutions puts accidents, incidents, and the safeguarding log on a monthly cycle, run by the registered manager.
• Risk-scaled: the full audit. Policy, training, recruitment, restraint and resident voice. Care compliance specialists suggest tightening the cycle for a service under enforcement or recently rated poorly, and easing it for a stable one. CQC sets no required frequency, so the interval is yours to choose and to justify.
• Why annual is no longer enough. CQC rated 15,757 locations in 2019 and 3,253 in 2024, so for most providers the internal audit is the only regular feedback on whether safeguarding is working. Mock CQC inspections help, and domiciliary services should start from the domiciliary care audit template set rather than adapting a care home one.

Keeping to either cycle is easier when the schedule runs itself. With GoAudits care home auditing software, you can repeat the monthly log audit automatically, send due-date reminders to whoever has been assigned it, and flag anything overdue on the dashboard, so a missed audit surfaces straight away rather than at the next governance meeting.

Who Should Run the Safeguarding Audit?

Whoever runs the audit should understand safeguarding well without being accountable for the results. In practice that usually means peer review between services, review by a head office or peripatetic manager, or the deputy running the audit while the registered manager samples the same records separately.

That is harder to arrange in a single home, where the registered manager may be the only person with the knowledge to run the audit at all. Where real independence is not available, the next best control is documented challenge: record who reviewed the audit, what they questioned, and what changed as a result. We look at this across the whole audit programme in the mandatory care home audits guide.

Should You Score Your Safeguarding Audit?

Score it on your own consistent scale, so you can compare this cycle against the last one and see whether anything is improving.

What is worth avoiding is building your internal scoring to mirror CQC’s rating scale. The regulator’s own scoring methodology is under revision, so a score designed to match it will stop meaning much as soon as it changes. A simple scale of compliant, not compliant, and not applicable, with a mandatory comment field, usually tells you more, and the comment field is where the reasoning lives.

How Do Safeguarding Audits Fail to Satisfy Inspectors?

Safeguarding audits usually fail at the action stage rather than at the audit stage.

The pattern is a familiar one. Audits are completed on schedule, action plans are generated after incidents, but no concrete action or evidence is documented. What the file does not show is that practice changed. Assessors tend to read that as passive governance, meaning a system that documents itself without improving anything.

What Does Regulation 17 Have to Do With Safeguarding?

Regulation 17 covers good governance, and it is the one regulation that surfaces across all five key questions. A governance gap does not stay contained in well-led, because the evidence for safe, effective, caring and responsive is produced by the same systems.

That makes your safeguarding audit Regulation 13 evidence and Regulation 17 evidence at once. The Regulation 13 half is usually in reasonable shape. The Regulation 17 half, which has to show that findings led to change, is the part providers struggle to produce.

There is an uncomfortable consequence. CQC assessment is now intelligence-led and triggered by risk, and safeguarding concerns are among the triggers, alongside complaints and frequent changes of registered manager. The system you would most want audited is the same one most likely to bring an assessor to your door, which makes the audit an early warning system rather than a rehearsal.

Northern Healthcare, which operates 15 supported living locations, has logged and resolved more than 1,100 quality improvement actions through GoAudits. That figure is the Regulation 17 evidence, because it counts actions closed rather than audits completed.

With GoAudits, we concentrated various compliance checks and audits in one single app that works online and offline.

Danielle Ruane, Training, Compliance & IT Manager, Northern Healthcare

Frequently Asked Questions