A safeguarding policy can be in place, signed off, and named in every induction, and still not protect a single person. In one recent CQC safeguarding finding, the policy existed but was not consistently followed by staff or leaders, internal reporting was incomplete, and restrictive practices were not recognised as safeguarding concerns at all.
The uncomfortable part is that the paperwork looked fine. A signed policy and a completed induction record are easy to produce for an inspector. Neither one tells you a worried care worker knew what to do, or that their concern reached someone who could act on it.
A policy proves an intention. It does not prove that concerns are reaching the people who can act on them, or that a restriction on someone’s life was ever recognised for what it is.
Carevia Pro and Pro+ give you the safeguarding structure, the reporting standard and the governance oversight to evidence that concerns are recognised, reported and acted on, and that restrictions are lawful, proportionate and reviewed.
Why a safeguarding policy is not the same as safeguarding
Every service has a safeguarding policy. It is one of the first documents an inspector asks for, and one of the easiest to have ready. That is exactly why a policy on its own proves so little. It is a confidence signal. Whether it is followed is the assurance, and the two are routinely mistaken for each other.
A signed policy and a completed induction record tell you the words exist and were read out. They do not tell you that a care worker, alone on a Sunday evening, knows what counts as a concern, who to tell, and how. They do not tell you that the concern they raised actually reached a leader, or that anything happened as a result. When a CQC safeguarding finding describes a policy that “was not consistently followed by staff or leaders,” this is the gap it is pointing at.
The False Assurance Problem
A complete safeguarding policy proves the words exist. It does not prove that concerns are recognised, reported and acted on. The tidier the folder, the easier it is to assume the practice underneath it is just as tidy.
Confidence is not assurance. However, confidence is clever and can disguise itself as assurance, and a well-written safeguarding policy is one of its most convincing disguises. If your service has recently slipped on safeguarding, our breakdown of the governance reasons behind a Requires Improvement rating sets out how the same pattern shows up across a service.
The recognition gap: what read-and-sign cannot prove
That finding described internal reporting as incomplete, so that leaders could not investigate concerns or act in time. It is tempting to read that as a reporting problem. In practice, two things usually sit behind it, and the first is recognition. If a member of staff does not recognise a situation as a safeguarding concern, they cannot report it, however good the reporting route is.
The second is communication that is inconsistent, so that the concerns which are recognised are passed on in different ways, some written, some mentioned in passing, some not at all. A concern that is only ever said out loud, or never named as a concern in the first place, cannot reach a leader who can act on it.
This is also where read-and-sign quietly misleads. Asking staff to read the safeguarding policy and sign to say they have read and understood it is worth doing, because it creates accountability. But a signature proves the words were read. It does not prove the member of staff can look at a real situation on shift, someone’s phone being held “for safekeeping,” a person who has become withdrawn, and recognise it as the thing the policy is describing. Understanding the policy and understanding how it translates into practice are two different things, and the gap between them is where safeguarding usually breaks.
What this looks like when it goes wrong
A person is supported with personal care. One night, staff recognised their continence pad needed changing, but the person said they would prefer day staff to help. That was a reasonable choice to respect. At handover, though, the continence need was not passed on. When day staff arrived they asked the person if they wanted support to get up. The person declined and said maybe in a couple of hours. Day staff had no reason to ask about the pad, because they had not been told.
By the time it was changed, the person had been in a soiled pad for around seven hours. Every step had been recorded: the night entry, the person’s preference, the morning exchange. Nothing was hidden. What was missing was the thread that connected those entries into a single picture, and the moment where someone asked whether this should be considered and recorded as a safeguarding concern. No one person failed. The information was all there, and the dots were never joined.
Recognition is the first gate, and consistent communication is the second. Only once a concern is recognised and passed on does the reporting system matter, and there the test is simple. Can a leader pick any concern from the last month and follow it, without gaps, from the moment it was raised to the action taken and the outcome for the person? A concern that never reaches a leader cannot be investigated, escalated to the local authority, or acted on. It simply sits with the person who first noticed it, if it was noticed as a concern at all.
The restriction you did not call a safeguarding concern
The second half of that finding is the one worth sitting with. Restrictive practices were not always recognised as potential safeguarding concerns. Controlling people’s personal belongings and their electronic devices was applied without clear evidence of lawful justification, proportionality, or regular review.
These are restrictive practices, and they are easy to miss precisely because they can look like ordinary care. Holding someone’s phone “for safekeeping,” limiting access to their own money, deciding what they can keep in their room: each may feel routine, and each restricts a person’s rights and freedom. A restrictive practice applied without a lawful basis, that is not proportionate to a real and specific risk, and that is never reviewed, can be a safeguarding concern in its own right. It is a reasonable reading that it may amount to improper treatment under Regulation 13, which covers safeguarding people from abuse and improper treatment, including restraint that is not necessary and proportionate.
There is a wider point here too. Controlling someone’s belongings and access engages their right to a private life, and depending on the whole picture it can form part of the arrangements that amount to a deprivation of liberty. Since the June 2026 Supreme Court ruling, that question is judged by looking at the person’s whole situation rather than a single test, so recognising and reviewing these restrictions matters more, not less. Our guide to the new deprivation of liberty ruling and what CQC will expect sets out how that thinking has changed.
The four questions to hold against any restriction are simple to say and revealing to answer. What is the lawful basis for it? Is it proportionate to a specific, named risk? Is it the least restrictive way to manage that risk? And when was it last reviewed? A restriction that cannot answer all four is not safe, however routine it has become.
What this looks like when it goes wrong
In one inspection where the service scored the lowest possible mark for safeguarding, a policy was in place but was not consistently followed by staff or leaders. Internal reporting was incomplete, which meant leaders could not investigate concerns properly or act in time to keep people safe. Inspectors also found restrictive practices that had not been recognised as safeguarding concerns: people’s belongings and electronic devices were controlled without clear evidence that it was lawful, proportionate, or ever reviewed.
Nothing here needed a dramatic incident. The policy existed, the intention was there, and staff were not acting in bad faith. What was missing was the practice behind the policy: concerns reaching leaders, and restrictions being recognised and justified. That gap is enough for a serious safeguarding finding on its own.
RAOF in practice: testing whether safeguarding is real
The answer to a policy that is not followed is not another policy. It is a leadership habit that triangulates the evidence rather than trusting the folder. At Carevia we call it RAOF: Read, Ask, Observe, Feedforward. Each step tests a different source, so the picture holds together instead of resting on one reassuring document.
Read
Do not start with the concerns you already know about. Start with a sample of daily notes from the last month, because “we have not had any concerns” often means concerns were recorded as routine and never recognised. Read for the thing that should have prompted a question and did not: an unexplained bruise, poor moving and handling, a missed medication, personal care left late, repositioning that did not happen as it should, someone put to bed before they were ready, a device quietly removed. Then take any concern that was logged and follow it through: does it run without gaps from raised, to investigated, to action and outcome, or does the trail stop somewhere?
Ask
Ask staff to talk through a real or realistic situation and say whether it is a safeguarding concern and why. Recognition comes before reporting, so test whether they can spot the concern, not just recite the route. A signature on the policy does not tell you this; a conversation does.
Observe
Look at practice, including restrictions in use: belongings held, devices limited, access controlled. Are any of these restrictive practices that should have been recognised, justified, made proportionate, and reviewed?
Feedforward
Commit to one change, such as a restrictive practice register or a fix to the reporting route, and set a date to check whether concerns are now reaching leaders and restrictions are being reviewed.
This is sampling, not counting. A monthly tally of safeguarding referrals tells you how many forms were completed. It cannot tell you about the concern nobody recognised. Reading a sample of daily notes end to end, alongside the concerns that were logged, is the only way to see both the failures that were reported and the ones that were never named, which is the thing an inspector is really testing.
Stop your safeguarding policy passing the audit and failing the person
Carevia Pro gives you the safeguarding templates, reporting standard and restrictive practice tools. Carevia Pro+ adds the governance oversight that shows concerns are reaching leaders and restrictions are being reviewed.
A policy is the foundation. What demonstrates safeguarding month after month is a small set of habits that keep concerns moving and restrictions honest. Five hold it together:
Make reporting frictionless, and track it end to end. The easier it is to raise a concern, the more concerns you see. Every concern should be traceable from the moment it was raised to the action taken and the outcome for the person, so nothing stalls with the person who first noticed it.
Keep a restrictive practice register. List every restriction in use across the service, with its lawful basis, the specific risk it manages, why it is the least restrictive option, and the date it was last reviewed. A restriction that is written down is far harder to leave unquestioned.
Test whether staff recognise a concern. Check, by asking, that staff can name what they would report and how, including the quieter restrictive practices that look like ordinary care. Recognition is what a written policy cannot guarantee.
Close the loop on every concern. A concern is not finished when it is logged. It is finished when there is a recorded outcome and, where relevant, learning that changes practice.
Have leaders read the notes, not just count the referrals. A referral tally shows volume. Reading a sample of daily notes each month shows the concern that was written down as routine and never recognised, the unexplained bruise or the late personal care that nobody questioned. It is the only way a leader can honestly answer “show me how you know our safeguarding works,” rather than “show me how many forms we filed.”
Get those right and you move from proving a policy exists to proving that people are actually being kept safe. That is the standard behind the safeguarding quality statement, and it is closely tied to good governance under Regulation 17, which our guide to what CQC will expect on governance sets out in full.
This article is general governance guidance, not legal advice. Providers should follow their local authority’s safeguarding procedures, and take their own legal advice on the lawfulness of any restrictive practice where needed.
Frequently asked questions
What is the CQC safeguarding quality statement?
Under the CQC Single Assessment Framework, safeguarding is a quality statement within the Safe key question. It looks at whether staff recognise concerns in the first place, respond and report them consistently, refer appropriately, and work within the law, including the Mental Capacity Act and least restrictive practice. A low score usually reflects concerns not being recognised or connected, rather than simply a missing policy. A signed policy is not the same as staff who can spot a concern on shift.
Can a restrictive practice be a safeguarding concern?
Yes. A restriction applied without a lawful basis, that is not proportionate to a specific risk, or that is never reviewed, can be a safeguarding concern in its own right. It is a reasonable reading that it may amount to improper treatment under Regulation 13. Restrictive practices such as controlling a person’s belongings, money or devices should be recognised, justified, kept least restrictive, and reviewed regularly.
What should internal safeguarding reporting include?
A concern should be traceable from the moment it is raised through to the outcome. That means recording what was noticed and by whom, when and how it was reported, what the leader decided and why, whether it was referred to the local authority, what action was taken, and the outcome for the person. If any of those steps is missing, leaders cannot investigate or act in time.
Is controlling someone’s belongings or phone a safeguarding issue?
It can be. Holding a person’s phone, limiting access to their money, or deciding what they may keep are restrictive practices that limit their rights. They can be lawful where there is a clear basis, a proportionate response to a specific risk, and regular review. Applied without those, they can be a safeguarding concern and may also engage the person’s right to a private life and the law on deprivation of liberty.
What is the difference between a restrictive practice and a safeguarding concern?
A restrictive practice is anything that limits a person’s rights, movement or freedom. It is not automatically wrong: it can be lawful, proportionate and reviewed. It becomes a safeguarding concern when it is applied without a lawful basis, is disproportionate to the risk, is not the least restrictive option, or is never reviewed. The task for leaders is to recognise restrictive practices in the first place, then test each one against those questions.
What does CQC expect for safeguarding under the Single Assessment Framework?
Inspectors look for a policy that is actually followed, concerns that are recognised and reach leaders, timely investigation and referral, and restrictive practices that are recognised, justified and reviewed. They want to see the evidence behind the words, so the useful question to rehearse with your team is “show me how you know,” which separates a confident answer from an evidenced one.
A safeguarding policy on the shelf is not the same as a person kept safe
Carevia Pro and Pro+ give you the safeguarding structure, the reporting standard and the governance oversight to prove concerns are recognised, reported and acted on, and restrictions are lawful and reviewed.
