A care audit is a planned check of your records and practice against the standard you have set yourself and the standard CQC expects. For a domiciliary care provider, that means care plans, risk assessments, medication records, daily notes, call monitoring data and finances, checked by someone independent, with every finding recorded and acted on. The law asks you to have a system that works. It does not hand you a fixed list. This guide covers what to audit, who should do it, how to record it, and how to move from paper forms to digital ones without disrupting your branch.
TL;DR
- Regulation 17 requires systems to assess, monitor and improve quality and safety. CQC does not publish a fixed list of audits, so you decide the programme and must be able to show it works.
- For home care, the core audit targets are care plans, risk assessments, MAR charts, daily notes, electronic call monitoring, timesheets and financial records.
- Auditors should be independent of the work they check. Findings only count as evidence if you record them and show what you did next.
- Digital audit forms make the trail easier to keep. Not being fully digitised does not automatically lower a CQC rating, but paper that stops you proving safe care can hurt an inspection outcome.
- Weave drafts care plans from a recorded assessment and fills in the forms in your existing care system, so the records you audit are complete from the start.
Table of Contents
- What the law actually requires
- Which audits a domiciliary care provider should run
- Who should carry out the audit
- Recording findings and acting on them
- Digitising care audits
- Digital evidence for CQC
- Our perspective: audit the record, but fix how it is created
- How Weave supports your audit trail
- A simple audit programme to start from
- FAQ
- Sources
What the law actually requires
The starting point is Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, the good governance regulation. It requires providers to establish systems and processes that assess, monitor and improve the quality and safety of the service. It also requires you to keep accurate, complete and contemporaneous records for each person you support, plus records for your staff and for how the regulated activity is managed.
Notice what is missing. There is no instruction to run a medication audit monthly or a care plan audit every quarter. You choose the programme, the frequency and the sample size, based on the size and risk of your service. Your job is to show that your choices are sensible and that the system catches problems.
That has two practical consequences:
- A schedule you can justify beats a copied template. If a registered manager can explain why daily notes are sampled weekly and care plans quarterly, that reasoning is part of your evidence.
- An audit that never finds anything is not reassuring. It suggests the audit is too shallow, or nobody is recording what they see.
If you are preparing for an inspection more broadly, our guide on how to prepare for a CQC inspection in home care covers the wider picture. This article stays with audits.
Which audits a domiciliary care provider should run
Home care has an audit challenge residential settings do not: the care happens in people’s homes, out of sight, and most of your evidence is paper or digital records created by staff working alone. Professional guidance on auditing domiciliary care documents points to these record types:
- client information
- risk assessments
- care and support plans
- MAR charts
- daily care notes
- financial transactions and receipts
- electronic call monitoring records and timesheets
Here is how that translates into a working programme. Treat the frequencies as a starting point to adapt, not as a legal requirement.
| Audit | What you check | Typical question it answers |
|---|---|---|
| Care plans | Plan matches the assessment, is current, and reflects the person’s preferences and outcomes | Would a new carer know exactly what to do on the first visit? |
| Risk assessments | Hazards identified, controls listed, review dates met | Is anything about this person’s home or health unaddressed? |
| MAR charts | Gaps, codes, signatures, PRN protocols, changes from prescribers | Did every person get the right medicine, and is that proven? |
| Daily notes | Completed, factual, timely, linked to the plan | Do notes show the care that was planned was delivered? |
| Call monitoring and timesheets | Late and missed calls, short visits, travel gaps | Are people getting the time they were commissioned for? |
| Finance records | Transactions, receipts, two-signature rules where used | Is anyone’s money handled safely and transparently? |
| Consent and capacity | Consent recorded, changes logged, best interest decisions documented | Are we acting within the person’s wishes and the law? |
The consent line deserves attention. Regulation 17 says consent records, including changes in consent and decisions made for people who lack capacity, must be accurately and securely maintained. These are easy to leave out of an audit schedule because they sit across several documents.
If you also run lone-working checks, the risk assessment for working alone in home care is a natural companion to the risk assessment audit.
Who should carry out the audit
Two principles recur in the guidance.
Independence. Staff should not check their own work or that of relatives. The same professional guidance says audits should be done by independent persons, which in a branch usually means a care coordinator checking another coordinator’s plans, or a manager from a neighbouring branch doing a sample.
Allocated responsibility. Document auditing should be a regular process with named people, not something done in a rush before an inspection. Government guidance on adult social care says internal audit schedules should be managed by registered managers or their deputies, and auditors should be appropriately trained.
In practice, a workable split looks like this:
- Registered manager: owns the schedule, reviews every summary, signs off action plans.
- Field care supervisors and assessors: carry out spot checks and review plans they did not write.
- Office staff: check call monitoring exceptions, timesheets and MAR returns as they come in.
- Carers: are not auditors of their own notes, but should receive feedback quickly so the same error does not repeat.
Recording findings and acting on them
The audit itself is only half of the evidence. The other half is what happened next. Auditors are expected to spot issues before they snowball, make sure concerns are addressed and record the action taken. Those records, according to the same source, serve as valuable evidence of good governance during CQC inspections.
A useful finding record has six parts:
- What was checked, and the sample size
- What was found, in plain factual terms
- The risk to the person, if any
- The action, with a named owner
- A due date
- Confirmation that the fix worked, usually by re-checking the same item
Step six is the one most often missed. The government describes audit as a way to support continuous improvement by reviewing practice against agreed standards and checking whether changes improve outcomes. An action marked “done” without a re-check does not close that loop.
When an audit finds a risk or safeguarding concern
Some findings cannot wait for the next scheduled review. If an audit shows that a person may be at risk of harm, such as missed medication, an unexplained injury recorded in notes or unusual financial transactions, deal with the person’s safety first. Follow your safeguarding policy and escalate through your registered manager and the local authority safeguarding route as your policy sets out. The audit record then documents that you acted, when, and who was told. Do not leave a safeguarding concern sitting in an audit action list.
Digitising care audits
Paper audits work, but they are slow to compile and hard to analyse. A folder of completed forms cannot tell you that late-evening MAR gaps cluster in one team, or that the same plan section is incomplete across ten new clients. Digital audit forms can.
Government guidance says digital social care records make it easier to keep accurate, up-to-date information, demonstrate good governance and improve the safety and responsiveness of care. For a deeper look at the records side, see our practical guide to digital social care records.
What “fully digitised” means
According to the government’s guidance, a CQC-registered provider counts as fully digitised if it uses an assured digital social care record solution and meets the “standards met” level on the Data Security and Protection Toolkit (GOV.UK, becoming a fully digitised care provider). The same page says commissioners and people choosing care are expected to look for fully digitised providers in future.
It is equally clear on the other side: not being fully digitised will not automatically lower a CQC rating. The risk is more specific. If paper-based systems limit your ability to show safe, effective care, inspection outcomes could be affected. Audits are where that limit shows up first.
Practical ways to digitise audits
You do not need a single big-bang project. A sensible order is:
- Move the audit forms first. Build your care plan, MAR, daily notes and spot-check forms as digital templates, so results are captured once and can be searched and totalled.
- Use search on your electronic records. Professional guidance notes that software “find text” functions can search documents for keywords, combined with manual review (Croneri). Searching for phrases like “refused”, “fall” or “new medication” across notes quickly shows where a plan may be out of date.
- Keep action logs in one place. Every finding, owner and due date in one list beats actions scattered across email and notebooks.
- Report monthly. Count findings by audit type, branch and team. Patterns are the point.
- Fix the source of poor records. If audits keep finding incomplete care plans, the problem is often how the plans are written, not how they are checked.
That last step matters most, and it is where we focus.
Digital evidence for CQC
Inspectors will ask you to show, not tell. Good digital evidence is current, easy to find and attributable. For home care, think of it as four bundles:
- Governance evidence: your audit schedule, completed audits, action logs and re-check results.
- Person-level evidence: care plans, risk assessments, consent records and daily notes, each dated and signed.
- Workforce evidence: training, supervision, spot checks and competency records.
- Incident evidence: incident reports, investigation notes and what changed afterwards.
CQC also describes how remote inspection evidence can be shared. In its guidance on using remote technology to inspect home care, evidence can go through a secure portal (SFTP), screen sharing or secure email, as agreed with the inspector. If your records live in scattered documents and notebooks, that is hard to do quickly. If they live in one system, it is a matter of minutes.
An example of this in practice: our case study on a CQC-compliant absence-to-incident workflow shows how a routine event can become a complete, compliant record without extra typing.
Our perspective: audit the record, but fix how it is created
We built Weave inside Cera Care, and we see the same pattern across more than 160 branches. Audit findings in home care are rarely about carers not caring. They are about records that were written in a hurry, weeks after an assessment, by someone typing from memory into several forms in the care system.
Most branches respond by adding more audits. We think the better move is to improve the first draft. When an assessor talks through the visit and the plan is drafted from what was actually said, there is less to miss and less to correct. The member of staff still checks it before anything is saved, because a person should always be accountable for a care plan. But they are reviewing a complete draft, not building one from a blank screen.
That changes what audit finds. Fewer missing sections, fewer vague outcomes, fewer plans that contradict the assessment. Auditors can spend their time on the judgement calls, such as whether the plan is right for this person, not on chasing blanks.
We also do not ask you to replace your care system. Weave runs in a sidebar beside the one you already use, so your audit forms, call monitoring and records stay where they are. Branches using it have cut the time spent on care plan write-ups by around 75%.
— John
How Weave supports your audit trail
Weave is software for UK home care providers. Its main tool, Voice To Care Plan, lets a field care supervisor or assessor record an assessment on their phone. Weave turns the conversation into a draft care plan. Once a member of staff has checked it, Weave fills in the care plan forms in your existing care system from a sidebar in the Chrome browser. There is no migration and no integration project.
For audit purposes, that gives you:
- care plans that follow the assessment conversation, which makes plan-versus-assessment checks quicker
- a human review step before anything is saved
- consistent completion of the forms your audit sampling looks at
- data held in UK and EU data centres
The wider Weave platform also automates workflows, including the audit and incident forms that follow an event, without engineering work on your side. If you want to see what an assessment looks like before it becomes a plan, read the sample assessment transcript.
Start with Voice To Care Plan. Try it free on a real assessment and see the draft your auditors would be checking.
If you are weighing up wider automation, our piece on healthcare workflow automation for UK home care explains where it helps and where a person must stay in the loop.
A simple audit programme to start from
If you are building or refreshing your programme, here is a first-pass structure for a single branch. Adjust it to your size and risk profile, and record your reasoning.
Weekly
- Call monitoring exceptions: late, missed and short visits
- MAR returns reviewed as they arrive
- A small sample of daily notes per team
Monthly
- A sample of care plans for plan-versus-assessment accuracy
- Risk assessment review dates
- Finance records where you handle money
- Incidents, with a check that actions were closed
Quarterly
- Governance summary for the registered manager: trends, repeat findings and overdue actions
- Consent and capacity records
- Spot-check coverage: has every carer been observed?
After any significant event
- Targeted review of the person’s plan, risk assessment and notes
Whatever the frequency, make the output the same each time: findings, actions, owners, due dates and re-checks.
FAQ
Does CQC require specific care audits?
No fixed list exists. Regulation 17 requires you to have systems that assess, monitor and improve quality and safety, and to keep accurate records. You decide which audits to run and how often, then show that they work and that you act on what they find.
Who should audit care records in a home care agency?
Someone independent of the work being checked. Staff should not audit their own records, and responsibility should be allocated to named, trained people, with the registered manager or deputy managing the schedule. Audit should be a regular process, not a response to a problem.
Do I have to be fully digitised to get a good CQC rating?
No. Government guidance states that not being fully digitised will not automatically lower a rating. The caution is that paper systems which stop you demonstrating safe, effective care could affect an inspection outcome. Full digitisation means using an assured digital social care record solution and meeting the “standards met” level on the DSPT.
What should I do with audit findings?
Record each finding, assign an owner and a due date, then re-check once the action is done. Anything involving risk to a person should be dealt with straight away and escalated under your safeguarding policy. Your records of audits and actions are evidence of good governance at inspection.
Can I digitise audits without changing my care system?
Yes. Digital audit forms can sit alongside your current system, and tools like Weave work from a browser sidebar beside the system you already run, so there is no migration. Start with the forms and records that cause the most findings.
Sources
- Regulation 17: Good governance, Care Quality Commission
- Auditing domiciliary care documents, Croneri
- Additional information and resources for adult social care managers, GOV.UK
- Becoming a fully digitised care provider, GOV.UK
- How we use remote technology to inspect home care, CQC