What is duty of candour in health and social care?

Duty of candour is the legal and professional obligation to be open and honest with people who use services (and their representatives) when a notifiable safety incident has caused moderate harm or above. It requires timely verbal notification, written notification within 10 working days, support for the person harmed, investigation, and sharing of investigation outcomes. It is set out in Regulation 20 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014.

Tier 2: Compliance and Standards

Duty of Candour: A Complete Guide for Health and Social Care Providers

The Care Quality Commission (CQC) expects care providers to be open, honest, and transparent when things go wrong. This obligation is called the duty of candour, and it is a fundamental regulatory requirement for all CQC-registered providers. Failure to meet this duty can result in enforcement action, reputational damage, and loss of people's trust in your service.

Book Consultation Learn More

Care worker speaking with an older person and family

This guide explains what duty of candour is, how it applies to your service, when it is triggered, and what steps you must take to comply. We also cover common mistakes providers make and how CQC inspectors assess your compliance.

Book a Consultation Contact Us

What Is Duty of Candour?

Duty of candour is the legal and professional obligation to be open and honest with people who use services (and their representatives) when a notifiable safety incident has occurred that causes them harm. It requires timely notification, clear communication, and a commitment to investigate what went wrong and explain the findings.

Historical Context

The duty emerged from the public inquiry into the Mid Staffordshire NHS Foundation Trust, where a culture of secrecy and defensive communication contributed to years of poor care going undetected. The inquiry found that when incidents occurred, staff and leaders did not inform patients or their families honestly about what had happened. This lack of transparency allowed failures to continue.

The legal and professional obligation to be open and honest when things go wrong.

The duty of candour is now embedded in Regulation 20 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014. It is also a professional duty for health professionals regulated by the General Medical Council (GMC), Nursing and Midwifery Council (NMC), and Health and Care Professions Council (HCPC).

Care professional discussing care records with an older person

Breaching Regulation 20 is a breach of a fundamental standard, and CQC can take enforcement action, including prosecution.

The Legal Framework: Regulation 20

Regulation 20 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 states that a registered person must ensure that staff make available to the relevant person (or their representative) all such relevant information as relates to their care and treatment. This must be done in a timely manner and in an accessible way.

Regulation 20 states that a registered person must ensure that staff make available to the relevant person (or their representative) all such relevant information held by the regulated activity provider as relates to the care and treatment of the relevant person. This must be done in a timely manner and in an accessible way.

Key Elements of Regulation 20

Notification must be given verbally to the relevant person (or their representative) without unreasonable delay
Written notification must follow within 10 working days
The provider must be reasonably supportive to the relevant person
A full investigation into the incident must be carried out
The provider must provide the relevant person with the outcome of the investigation

CQC Registration Step-by-Step Guide

Not sure where to start with CQC registration? Our step-by-step guide walks you through every stage of the process, from application to approval.

Read the full guide

Who Does Duty of Candour Apply To?

Duty of candour applies to all CQC-registered providers of health and social care. This includes:

Domiciliary care agencies

Residential care homes

Supported living services

Day centres and day services

Nursing homes

Hospitals

GP practices

Dental practices

Individual health professionals have their own duty of candour responsibilities, set out by their professional regulators (GMC, NMC, HCPC). However, as an employer or service provider, your organisation must ensure that a culture of openness exists and that staff are supported to uphold the duty.

Duty of Candour and Your Service Users

Duty of candour applies when a notifiable safety incident causes harm to a person who uses your service. It does not apply only to serious incidents. If moderate harm has occurred as a result of a patient safety incident, the duty is triggered.

What Triggers Duty of Candour?

Not every incident triggers duty of candour. The trigger is a notifiable safety incident that causes harm to a person using the service. Understanding what constitutes a notifiable safety incident is critical to knowing when you must comply with duty of candour.

Definition of a Notifiable Safety Incident

A notifiable safety incident is an unintended or unexpected event that resulted in, or could have resulted in, harm to a person. The threshold that triggers the duty is set by Regulation 20 and differs by service type. Moderate harm is the threshold for NHS bodies under Regulation 20(8). Adult social care providers are covered by Regulation 20(9), which sets a higher bar.

Examples of notifiable safety incidents include:

A person falls and breaks a bone as a result of inadequate supervision
A person is given the wrong medication, causing adverse effects
A person experiences pressure ulcers due to inadequate care planning
A person is left without adequate support, leading to self-harm
A person experiences unauthorised restraint or restriction
A person's care plan is not followed, leading to deterioration in their health
A person experiences sexual or physical abuse by a member of staff

The Harm Threshold

For a provider that is not an NHS body, Regulation 20(9) triggers the duty where the incident appears to have resulted in, or could still result in, one of the following:

Death, where it relates directly to the incident rather than to the person's illness or underlying condition
Impairment of sensory, motor or intellectual function that is likely to last 28 days or more
Changes to the structure of the person's body
Prolonged pain or prolonged psychological harm, meaning 28 days or more
Shortening of life expectancy
Treatment needed to prevent death or any of the outcomes above

Harm below that level, such as a small bruise from a fall that resolves quickly without medical intervention, does not trigger Regulation 20. You must still investigate, document and report the incident through your safeguarding and incident reporting procedures, and being open with the person is good practice whether or not the regulation is engaged.

How to Identify Triggers

Your service should have clear procedures for identifying notifiable safety incidents. Staff must be trained to recognise when an incident has occurred and to escalate it immediately to management. You should have:

A clear definition of notifiable safety incidents in your policies
Training for all staff on recognising incidents
An incident reporting system that flags incidents that may trigger duty of candour
A clear process for escalation to management within your first step
A member of staff or team responsible for determining whether duty of candour applies

Compliance Auditing and Quality Assurance

Already registered but want to stay ahead of CQC? Our compliance auditing service provides mock inspections, evidence reviews, and ongoing quality assurance to keep your rating on track.

Read the full guide

The Duty of Candour Process: Step by Step

When a notifiable safety incident has occurred, you must follow a clear process to discharge your duty of candour. This process has several steps.

1
Verbal Notification
Without unreasonable delay after the incident occurs, you must notify the relevant person (or their representative) verbally. This does not have to wait for an investigation to be completed. The person has a right to know quickly that something has gone wrong.
The verbal notification should include:
- A clear statement that a notifiable safety incident has occurred
- Acknowledgment that harm has resulted
- An expression of sorrow or regret for the harm
- An explanation of what is known at that stage (without speculation)
- Details of the next steps, including investigation and the timeframe for written notification
2
Written Notification
Within 10 working days of the incident being identified, you must provide written notification. The written notification must be clear, factual, and thorough. It should include:
- A detailed description of what happened
- The date and time of the incident
- Details of harm that resulted
- Details of the investigation that will be undertaken
- The timeframe for providing the outcome of the investigation
- An expression of sorrow or regret
- Details of support being offered
- Contact details for questions or concerns
3
Reasonable Support
You must be reasonably supportive to the person harmed and their representative. This might include:
- Offering counselling or emotional support
- Offering to meet with the person and their family to discuss what happened
- Helping the person access compensation or redress
- Providing information about complaints procedures and their rights
4
Investigation
You must conduct a thorough, objective investigation into what happened. The investigation should:
- Identify the root causes of the incident, not just the immediate cause
- Consider systems, processes, and human factors
- Identify any breaches of policy or procedure
- Consider whether training or changes to practice are needed
- Be impartial and free from defensiveness
- Be documented clearly
5
Providing the Outcome
You must provide the person with the outcome of the investigation. This should include:
- What the investigation found
- How the incident occurred
- What went wrong
- What steps you are taking to prevent the incident happening again
- Details of any compensation or redress being offered

Timescales and Requirements

Timescales for duty of candour are set out in Regulation 20 and are non-negotiable. Your service must have systems to ensure timescales are met.

Care professionals reviewing a written notification

Within 10 Working Days

Written notification must be provided within 10 working days of the incident being identified. This is a strict requirement. If you miss this deadline, you are in breach of the regulation. Your service should have a system to track incidents and ensure that written notification is sent on time.

Content of Written Notification

The written notification must include all of the following:

A clear statement that a notifiable safety incident has occurred
Details of the harm caused
An account of what happened
Details of the investigation
An expression of regret or apology
Information about support being offered
Details of next steps
Information about how to complain
Contact information

Many providers use a standard template for the written notification letter, which helps ensure consistency and reduces the risk of omitting required information.

Common Mistakes Providers Make

CQC inspection evidence shows that many providers struggle with duty of candour compliance. Understanding common mistakes can help you avoid them.

Care professional speaking with an older couple

Delayed Notifications

The most common breach is delayed notification. Some providers delay verbal notification because they are waiting for investigation findings. This is wrong. Verbal notification must happen as soon as the incident is identified, even if the investigation is ongoing.

Similarly, written notification is sometimes delayed beyond 10 working days. Organisations may miss the deadline because administrative systems are not in place to track incidents or ensure timely notification. You must have a clear system to ensure notifications are sent on time.

Failure to Document

Some providers notify the person verbally and in writing but fail to document that they have done so. When CQC inspectors ask to see evidence of duty of candour compliance, the provider cannot produce records. Documentation is essential. You must keep records of:

When notification was given
To whom it was given
Who gave the notification
What was communicated
Copies of written notification letters
Records of the investigation
Records of the outcome being shared

Confusing Duty of Candour with Complaints

Some providers treat duty of candour as part of the complaints process. This is incorrect. Duty of candour is a separate requirement from complaints handling. You must comply with duty of candour regardless of whether a formal complaint has been made. The person may not have raised a formal complaint but may still be entitled to duty of candour notification if a notifiable safety incident has occurred.

Defensive or Legalistic Responses

Some providers take a defensive approach, focusing on minimising liability or blaming the person using the service. This is contrary to the spirit of duty of candour. The duty requires honesty, openness, and an expression of regret. Defensive language or attempts to avoid responsibility will damage trust and may breach the duty.

Lack of Investigation

Some providers carry out minimal investigations or fail to investigate at all. A thorough investigation is required. It must identify root causes and determine what changes are needed to prevent recurrence. A cursory investigation will not satisfy the duty of candour requirement.

How CQC Assesses Duty of Candour

CQC inspectors assess duty of candour compliance by looking for specific evidence. Understanding what inspectors look for will help you prepare your service.

What Inspectors Look For

During inspection, CQC inspectors will:

Review incident records to identify notifiable safety incidents
Check whether duty of candour notification was given for each incident
Verify timescales for verbal and written notification
Review written notification letters to ensure they contain all required information
Speak with people who have experienced incidents to verify that they were notified
Review investigation records to assess quality and thoroughness
Check that systems are in place to identify incidents that trigger duty of candour
Review staff training on duty of candour
Interview staff and leaders about their understanding of the duty

Evidence Requirements

To demonstrate duty of candour compliance, you must have:

Incident records that clearly identify notifiable safety incidents
Records of verbal notification (date, time, person notified, who gave notification)
Copies of written notification letters, all sent within 10 working days
Investigation reports for each incident
Records of outcomes being shared with the person
Evidence of support being offered
Training records showing that staff have received duty of candour training
Policies and procedures setting out your duty of candour process

Minor harm, such as a small bruise from a fall that resolves quickly without medical intervention, does not trigger the duty. However, you must still investigate, document, and report the incident through your safeguarding and incident reporting procedures.

Link to Well-led Assessment

Duty of candour is assessed under the Well-led key line of enquiry. CQC inspectors look at whether your leadership and governance create an open, transparent culture. Failure to comply with duty of candour is assessed as a weakness in governance and leadership.

Duty of Candour vs Duty of Care: Clear Differentiation

A common area of confusion is the difference between duty of candour and duty of care. These are distinct obligations.

Duty of Care

Duty of care is the legal and professional obligation to provide safe, high-quality care to people using your service. It is an ongoing obligation that applies to all aspects of care delivery. Breach of duty of care can result in claims for compensation if harm occurs.

Care professional completing documentation

Duty of Candour

Duty of candour is the obligation to be open and honest when a notifiable safety incident has caused moderate harm or above. It applies after harm has occurred, not as a preventative measure. Duty of candour is about how you respond when things go wrong, not about preventing harm in the first place.

Key Differences

Duty of care is about preventing harm. Duty of candour is about being honest when harm has occurred. You can meet your duty of care (i.e. provide good quality care) but still breach duty of candour if you do not notify the person when an incident occurs. Conversely, you can respond honestly after an incident occurs (meeting duty of candour) but still have breached duty of care if your care fell below the standard that a reasonable care provider would provide.

How Care Sync Experts
Can Help

Duty of candour compliance requires clear policies, well-trained staff, and robust systems. Care Sync Experts specialises in supporting providers to understand and comply with their duty of candour obligations.

CareSync Experts supporting a CQC registration

CQC registration support

Guidance through the registration process, ensuring that duty of candour obligations are embedded from the outset

Policy packs

Comprehensive policy templates, including duty of candour procedures, notification templates, and investigation guidance

Training

Staff training on duty of candour, incident recognition, and investigation procedures

Systems development:

Help developing incident tracking systems and notification procedures

Mock inspections

Mock inspection focused on safeguarding and duty of candour

Investigation support

Guidance on conducting thorough investigations following incidents

Free Resources Hub

Access free CQC checklists, templates, and guides to help with registration, inspection preparation, and ongoing compliance.

Read the full guide

Frequently asked questions

Duty of care is the ongoing obligation to provide safe, high-quality care to people using your service. It is a preventative duty. Duty of candour is the obligation to be open and honest when a notifiable safety incident has caused harm. It applies after harm has occurred. You can meet your duty of care (provide good care) but breach duty of candour (not tell the person what happened). Conversely, you can meet duty of candour (tell the truth about what happened) but breach duty of care (because your care was poor quality).

Duty of candour applies when a notifiable safety incident has occurred that has caused moderate harm or above to a person using your service. A notifiable safety incident is an unintended or unexpected event that resulted in, or could have resulted in, harm. Moderate harm includes temporary harm requiring intervention (such as hospital admission), permanent loss of bodily function, or significant psychological or mental health deterioration requiring medical intervention. Minor harm does not trigger the duty.

A notifiable safety incident is an unintended or unexpected event that resulted in, or could have resulted in, harm to a person using your service. Examples include falls resulting in broken bones, medication errors causing adverse effects, pressure ulcers from inadequate care planning, unauthorised restraint or restriction, sexual or physical abuse, and care plan failures leading to deterioration in health. The incident must cause moderate harm or above to trigger duty of candour.

Verbal notification must be given without unreasonable delay after the incident occurs. Written notification must be provided within 10 working days of the incident being identified. This is a strict requirement. If written notification is not sent within 10 working days, you are in breach of Regulation 20. Your service must have clear systems to track incidents and ensure timely notification.

Breaching duty of candour is a breach of a fundamental standard. CQC can take enforcement action, including issuing a condition (which must be met within a specified timeframe), issuing a warning notice, restricting or suspending registration, or prosecution. Failure to comply can also result in loss of people's trust in your service, reputational damage, and complaints or legal claims from people who have been harmed.

Yes, duty of candour applies to all CQC-registered providers, including domiciliary care agencies. If a notifiable safety incident has occurred that has caused moderate harm or above to a person using your domiciliary care service, you must comply with duty of candour requirements, including verbal notification without unreasonable delay and written notification within 10 working days.

Still have questions?

Can't find the answer you're looking for? Please chat to our friendly team.

Get In Touch

Book a Free Consultation

Ready to take the next step? Speak to one of our care registration experts today. We will assess your situation, answer your questions, and give you a clear plan of action.

Book your free consultation

Learn how we can support your success

Email: hello@caresyncexperts.co.uk

Phone: 0333 577 0877

Duty of Candour: A Complete Guide for Health and Social Care Providers

What Is Duty of Candour?