Of the five key questions that the Care Quality Commission asks when inspecting any health or social care service, “Are they safe?” is the one that produces the most enforcement action. It is also the one that providers most frequently underestimate in its scope. Safety, in the CQC’s framework, is not only about what happens in the care environment during delivery. It includes how staff are recruited, verified, and assessed before they ever set foot in a care setting in a professional capacity.
Safe recruitment is one of the most examined components of the Safe domain, and it is one where providers regularly receive findings that contribute to lower ratings, requirement notices, or in serious cases, enforcement action. This article examines what the CQC expects from recruitment practices, where the most common compliance failures occur, and how providers can build a recruitment process that stands up to inspection scrutiny.
The Regulatory Framework for Safe Recruitment
The CQC’s inspection of recruitment practices draws from two primary regulatory sources: the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, and the accompanying guidance documents that the CQC uses to assess compliance.
Regulation 19 — Fit and proper persons employed — is the central provision. It requires registered persons to ensure that their workers are of good character, have the necessary qualifications, competence, skills, and experience for the work they are to perform, and are able to perform it. Crucially, the regulation requires that the provider can demonstrate that appropriate recruitment checks have been carried out before each worker begins their role.
The specific checks required under Regulation 19 and the associated Schedule 3 include identity verification, right to work in the UK verification, disclosure and barring service (DBS) checks at the appropriate level for the role, verification of professional registration for clinical and regulated roles, employment history and reference verification, and health checks relevant to the duties to be performed.
The CQC’s Key Lines of Enquiry (KLOEs) for the Safe domain include specific prompts around recruitment: inspectors are directed to look at whether providers have robust processes for checking that staff are safe to work with vulnerable people, whether records demonstrate that all required checks have been completed before employment begins, and whether the provider has a process for managing and responding to any concerns that checks reveal.
Where Providers Most Commonly Fall Short
The recruitment compliance failures that most commonly feature in CQC inspection reports fall into a predictable set of categories. Understanding them is the first step toward building a process that avoids them.
Incomplete or missing DBS records are the most frequent finding. This includes DBS checks that were completed at too low a level for the role (an enhanced DBS check is required for roles involving regulated activity with vulnerable adults or children, including most care staff, clinical staff, and supervisory roles), checks that were completed but are not on the DBS Update Service with no re-verification process documented, and in some cases, staff who began work before DBS clearance was received without the appropriate risk assessment being documented.
Employment history gaps that were not investigated is the second most common category. Most providers ask applicants for their employment history, but fewer have a documented process for following up on gaps, inconsistencies, or periods of employment that do not appear to have been verified through a reference. The CQC inspector who looks at a file and sees a four-month gap between employments that has not been explored or documented is looking at a potential Regulation 19 concern.
Professional registration not independently verified is the third category. For registered nurses, social workers, occupational therapists, pharmacists, and other regulated professionals, the CQC expects that the provider has independently verified registration with the relevant professional body — the NMC, HCPC, or GPhC — and has a process for ongoing monitoring of registration status. A reference from a previous employer confirming that someone is a registered nurse is not equivalent to checking the NMC register directly; the latter is what the CQC looks for.
References that are not meaningful is the fourth category, and the one most often overlooked by providers who believe their reference process is adequate. Two references confirming that someone was employed at a previous role for a given period, without any assessment of character, conduct, or suitability for the specific type of work, do not meet the spirit or the letter of what the CQC expects. References should come from direct line managers, should cover conduct and suitability as well as factual employment details, and should be verified as genuine — including confirming that the referee is who they claim to be.
Building a Compliant Recruitment Process
The providers who perform well on recruitment compliance in CQC inspections are not those who have assembled the most paperwork. They are those who have a genuinely systematic process — documented, consistently applied, and designed to catch problems rather than generate files that look complete on the surface.
The recruitment process should begin with a role-specific risk assessment that identifies what checks are required, at what level, and what the acceptable sequence is. For most care staff, this means that DBS registration on the Update Service (or a new check if not registered), identity verification, right to work verification, two meaningful references, and employment history investigation must all be completed and documented before the individual starts in their role — or, where a conditional start is operationally necessary, that a documented risk assessment justifies the exception and additional oversight is in place during the interim period.
Digital background checking tools have considerably reduced both the administrative burden and the completion time for pre-employment checks, making the argument that thorough screening is operationally impractical much harder to sustain. A basic DBS check — covering identity verification, criminal record check, and right to work — can be initiated and tracked digitally, reducing the paper-based delays that previously caused providers to begin employment before checks were complete. For senior care roles, deputy managers, clinical leads, and roles with greater autonomy, standard screening check that adds employment history verification and credential checking provides the depth of pre-employment due diligence that the CQC expects for roles carrying greater responsibility for service users’ safety and wellbeing.
For Registered Managers — whose fit and proper person status is assessed under Regulation 5, a separate and more demanding provision — and for clinical directors, directors of nursing, and other senior figures who carry significant regulatory accountability, first class verification provides the comprehensive multi-layer screening that these roles warrant. The CQC’s assessment of Registered Managers under Regulation 5 is particularly detailed, and the provider who can demonstrate that a thorough, documented pre-appointment verification was conducted is in a substantially stronger position than one who cannot.
Documentation: What Inspectors Look For in Practice
The documentary standard that the CQC applies to recruitment files has become more detailed over successive inspection cycles, and providers who have not updated their file structure in recent years may find that files that satisfied inspection in 2018 or 2019 do not satisfy inspection now.
Each recruitment file should contain, at minimum: a completed application or CV reviewed and annotated for gaps, signed consent from the applicant for checks to be conducted, identity documents verified and copied, right to work documents verified according to Home Office guidance, DBS check certificate or Update Service confirmation at the appropriate level, DBS barring list check where applicable, professional registration verification for regulated roles, at least two references with evidence that they are from line managers and that they have been verified as genuine, notes on any employment history gaps or concerns investigated and resolved, occupational health clearance where required, and a pre-employment checklist signed by the recruiting manager confirming that all checks were completed before the start date.
The checklist is the document that ties the file together and that inspectors often look at first. It makes visible whether the process was followed or whether shortcuts were taken, and it is the document that a provider’s Registered Manager needs to be able to explain clearly when an inspector asks how recruitment compliance is monitored and assured.
Beyond Compliance: Why This Matters for Your Service
The purpose of safe recruitment requirements is not bureaucratic — it is protective. Health and social care settings exist to provide safe, effective, caring, and responsive services to people who are, by definition, in a vulnerable position. The staff recruited to provide those services carry significant responsibility, and the recruitment process is the primary mechanism by which providers can exercise judgment about who is and is not suitable to carry it.
Providers who approach recruitment compliance as a box-ticking exercise — assembling files that look complete without the underlying process being genuinely rigorous — are not only exposed to CQC enforcement risk. They are also exposed to the real operational and reputational risk of employing someone whose background, if properly checked, would have raised concerns.
The providers who get this right consistently are the ones who treat safe recruitment not as a compliance obligation but as an expression of what their service stands for. The standard they set for who they employ, how thoroughly they check, and how carefully they document reflects the standard they intend to provide. That alignment between values and process is, in the end, exactly what the CQC is looking for when it asks whether a service is well-led.