The Policy Volume Trap: Why Counting Policies Is the Wrong Question in Adult Social Care

147 Policies Across Four Homes

A sector voice recently shared an observation on LinkedIn. A care provider running four homes had 147 policies. The comment section agreed the number felt excessive. Another voice in the thread suggested the real number was probably higher once procedures and local variations were counted in.

Anyone working in adult social care will recognise the instinct. Say the word policies to a registered manager and you will see the same tired response — the eye-roll, the reference to the last update cycle that took weeks, the shelf of binders that nobody opens between audits. Policies have become one of the most complained-about features of the job, for reasons that are entirely justified.

So far, so familiar. But the diagnosis the sector tends to reach for — we have too many policies — is not quite right. And the solutions that follow from that diagnosis tend to miss the point. Underneath the volume conversation sits a deeper pattern that explains why policy libraries fail across services of every size.

What Policies Are For — and Why the Difference Between a Policy and a Procedure Matters

Before going further, there is a distinction the sector has quietly lost. Say policy and procedure to a registered manager and they will use the words almost interchangeably. Policy platforms sell them together. Inspection reports mention them together. CQC guidance references them together. Staff are told to read them together. Over time, the two words have fused into a single, vaguely compliance-flavoured object that sits on the server and has to be updated.

But they are not the same thing, and the difference matters.

A policy sets out what the service does and why. It holds the principles, the legal framework, and the standards the service commits to. A medication policy names the regulatory basis for safe medication support, the values that underpin it, the accountability structure, and the standards the service expects to meet. A policy is higher-level. It changes relatively rarely, because the principles and the law it rests on do not change every month.

A procedure sets out how the policy is carried out in practice. It is the step-by-step. It translates the policy’s principles into the actions a staff member takes on a shift. The medication procedure for this specific service tells a worker what to do when a PRN is prescribed, how to record it, when to escalate. A procedure is operational. It changes more often than the policy it sits under, because practice, staffing, systems and local context all shift.

Think of it this way. The policy is the position. The procedure is the action. You cannot safely have one without the other — a position without an action is a statement of intent; an action without a position is a habit no one can justify. Both need to exist, and they need to match.

The devaluing of policies in the sector — the eye-roll, the tired update cycles, the bulk deletions that some managers fantasise about — is largely a symptom of policies having been separated from the procedures they were supposed to govern. When a policy exists on the server but the procedure on the floor does not match it, the policy becomes a compliance artefact rather than a governance tool. That is what has happened across a significant part of adult social care. Policies became paperwork because the discipline connecting them to practice quietly fell away.

This article is about repairing that connection. Not defending policies in the abstract — defending the specific governance job they do when they are properly connected to procedure and to practice. That job is real, and it is not replaceable by a procedure alone. A service that has procedures but no policies is a service that cannot explain why it does what it does, which is the exact question Regulation 17 requires a service to answer.

From this point on, the article refers to three distinct things: the policy (the what and why), the procedure (the how), and the practice (what staff actually do on the shift). Good governance means all three of these align. When they do not — when policy says one thing, the written procedure says another, or practice has drifted from both — that is where the governance work has to happen. The sector’s habit of collapsing all three into a single mental category called policies is a significant part of why the gap between document and action stays invisible until an incident or an inspection surfaces it.

Why the Count Is the Wrong Question

Picture two services. They have the same number of policies — let’s say 85. That is a reasonable number for an adult social care service with multiple regulated activities. Neither service would attract comment for having too many or too few.

Service A has 85 policies, and each one is doing governance work. Every policy has been adapted from its source to the specific context of this service. Every policy has a live procedure sitting beneath it that translates it into the steps staff take on shift. When the service spots that policy, procedure or practice has drifted apart — and they always drift, over time — the gap is noticed, named, and closed. Either the policy is updated, the procedure is rewritten, or the practice is corrected, and the decision is recorded.

Service B also has 85 policies. Most were downloaded from a platform two years ago and have not been revisited since. The procedures underneath them are generic placeholders, if they exist at all. No one on shift tonight could tell you which policies govern the task they are about to perform. The policies are technically on the server. Practice has drifted away from them in a dozen small ways that nobody has noticed.

Same number. Very different services.

Service A is well-governed. Service B is not. The variable that determines the difference is not the policy count — it is identical in both cases. The variable is discipline. Whether each policy has been adapted, connected to a live procedure, and tested against practice. Whether the drift gets noticed and corrected, or whether it quietly accumulates.

This is what makes policy volume a trap. The number is an easy metric. It is also an uninformative one. Two services can have identical counts and utterly different governance. A sector conversation that focuses on how many policies a provider has — whether the complaint is that the number is too high or that it ought to be reduced — is spending its energy on the variable that tells you least. The policies a service needs depends on its regulated activities, the complexity of the people it supports, and the specific risks it manages. What matters is whether each policy the service holds is actually doing governance work.

Cutting policy count without addressing the discipline that connects policy to practice does not improve governance. It just removes paperwork. A manager who deletes forty policies from the server and changes nothing else has not made their service safer. They have simply made the gap between document and practice shorter to describe. The real work is in the discipline — and the discipline applies whether a service has 50 policies or 150.

What Regulation 17 Actually Requires

Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 — Good Governance — is where this argument is grounded in law. The regulation requires providers to have systems and processes that assess, monitor and drive improvement in the quality and safety of the services provided.

Three words in that requirement do real work, and each matters for policies.

• ✓Assess. A policy exists not to be filed, but to be measured against reality. What does the policy say should happen? What is actually happening? The gap between those two is the governance question.
• ✓Monitor. Policies need ongoing attention, not annual review cycles. Practice changes. Regulation changes. Staff turnover changes the shared understanding of what is expected. If a policy is not monitored in the interval between formal reviews, it is already drifting.
• ✓Drive improvement. This is the part most services miss. A policy that has not changed in two years, or that has been reviewed with no changes logged, is a policy that has stopped doing governance work. Driving improvement means the policy is a live document that responds to what the service is learning.

Nowhere in Regulation 17 is there a specified number of policies a service must have. The regulation is not concerned with volume. It is concerned with whether the policies you have — however many that is — actually govern the service. CQC inspectors assess this directly. They do not count your policies. They ask staff whether they know them, check daily practice against what the policies say, and look for evidence that the gap between document and practice is being actively closed.

A service with 50 genuinely live policies passes this test more easily than a service with 200 that nobody has opened — but equally, a service with 50 neglected policies fails the test just as badly as a service with 200 neglected ones. It is the discipline that is being tested, not the count.

How Policies Fail Quietly — The Five Failure Modes

Policies do not fail loudly. They fail in ways that are invisible until an incident, an audit, or an inspection exposes the gap. In my years of working with governance systems across multiple services, I have seen five consistent failure modes. Each of them happens regardless of how many policies the service has on its server.

Failure Mode 1: The Downloaded-and-Forgotten Policy

A policy was added to the service two years ago from a catalogue. It has the right title. It covers the right topic. But nobody on the current staff team adapted it to the specific context of this service, this set of people being supported, or this local procedure. It is generic, and generic is not the same as fit for this service. A CQC inspector can tell the difference in about three minutes of reading.

Failure Mode 2: The Reviewed-But-Not-Changed Policy

The review date on the front cover has been updated. A signature has been added. The content is identical to the version from eighteen months ago. Meanwhile, practice has moved, regulation has updated, or the way the service operates has shifted. The review happened on the calendar. It did not happen in substance. Inspectors spot this pattern quickly.

Failure Mode 3: The Policy–Procedure–Practice Gap

This is where three layers are supposed to align and don’t. The policy sets the principle. The procedure translates it into steps. Practice is what staff actually do. In a well-governed service, all three sit in alignment, and the service can show it. In most services that have let the discipline slip, there is drift somewhere in the chain.

Sometimes the drift is between policy and procedure — the policy has been updated to reflect a regulatory change but the procedure never caught up. Sometimes it is between procedure and practice — the written procedure is correct but staff have quietly evolved a different way of working. Sometimes it is between policy and practice directly — staff follow custom rather than either document. Each of these drifts produces different remedies, which is why naming where the drift sits matters. A manager who diagnoses “policy-practice gap” without specifying the middle layer will often apply the wrong fix, updating the policy when practice is actually being shaped by an out-of-date procedure. This failure mode is one of the most common findings in Requires Improvement reports.

Failure Mode 4: The Invisible Policy

The policy exists, but no member of staff could tell you what it says or where to find it. It is compliant in the sense that it is on the server. It is non-functional in the sense that it has no influence on what happens during a shift. Invisible policies are arguably the worst of the four modes, because the service thinks it is covered and isn’t.

Failure Mode 5: The Never-Tested Alignment

This is the failure that sits beneath the other four. A policy, its associated procedure, and the practice that is supposed to flow from them can all exist — and yet the alignment between the three has never been deliberately tested. Nobody has walked the building with the policy and procedure in mind. Nobody has asked staff what they actually do in the situations the documents cover. Nobody has observed whether written standard and delivered practice match across all three layers. Without that testing, there is no way for the service to know whether the chain holds.

Every other failure mode is a downstream consequence of this one. Generic policies stay generic because nobody has tested them against this service’s procedure and practice. Reviews become ceremonial because there is no live evidence to review against. Policy–procedure–practice gaps widen undetected because nobody went looking for them. Policies become invisible to staff because nobody tested whether staff were actually working to them. Test the alignment across all three layers, and most of the other failure modes surface on their own.

None of these failure modes are about volume. A service with 50 policies can have all five. A service with 200 can have all five. The habit that prevents them is the same whatever the size of the policy library.

All five failure modes are also expressions of the same underlying pattern. Each one is a way that a policy can look complete while not actually doing governance work. A downloaded-and-forgotten policy looks complete. A reviewed-but-not-changed policy looks complete. A policy with a procedure-practice gap looks complete. An invisible policy looks complete. Even an apparently-aligned policy looks complete if the alignment has never been deliberately tested. This is the False Assurance Problem applied to policies — and policies are where it does some of its most expensive work, because the policy library is the artefact most often presented as the headline evidence that a service is well-governed. When a library is producing false assurance across dozens of policies at once, the leadership confidence it generates is significant, and the shock when an inspection or incident reveals the gap is correspondingly larger.

Applying RAOF™ to Every Policy in Your Service

The RAOF framework — Read, Ask, Observe, Feedforward — was built for exactly this kind of question: is the chain from document to action actually holding? Applied to a policy, RAOF tests the alignment across all three layers. It looks at the policy itself, the procedure that translates it, and the practice that is supposed to flow from both. The fifth failure mode no longer applies to a service that holds this habit, because the alignment has been tested.

RAOF is not another audit to add to the governance calendar. The sector already has audit fatigue and it does not need more of the same. RAOF is a leadership habit — a way of looking at documents, care plans, policies, training, supervision and handover that becomes second nature to a manager who has internalised it. It takes minutes woven into existing routines, not hours added to them. Applied this way, it does not compete with the audits already in place. It makes the audits already in place mean more, because it brings living evidence to them.

RAOF is a complete cycle. Services that only Read tell themselves a tidy story. Services that only Ask end up with opinions. Services that only Observe collect impressions. It is the loop — held as a habit, not scheduled as a task — that gives leaders something they can trust. And crucially, the Feedforward step is what forces the diagnostic question: where is the drift? Because once you know which two layers are out of step, the remedy becomes specific rather than generic.

And here is the honest consequence. Services that embed RAOF as a habit across their policy library often find they have fewer policies after a year than before — not because they set out to cut, but because the habit exposes which policies and procedures have no practical function. That is a cleaner way to reduce volume than arbitrary pruning. It also produces a library the service can defend with confidence, because every surviving policy has earned its place through being tested for alignment with the procedure and practice it was meant to govern.

What a Purposeful Policy Library Looks Like

A policy library that governs practice has characteristics that are visible, even to an outsider.

• ✓Every policy has a clear author within the service, not just a platform-provided author. Someone in the service owns each one.
• ✓Policies are written in language that staff can understand at first reading, not in the kind of regulatory prose that requires a glossary.
• ✓Review history is substantive, not ceremonial. Change logs show what has actually been changed and why.
• ✓Supervision records reference policies by name. Staff discuss them in the course of ordinary conversations about practice.
• ✓Audits test the alignment across policy, procedure and practice — not paperwork against more paperwork. Walkaround findings flag where drift is sitting so the right layer is corrected.
• ✓When an incident occurs, the review explicitly considers whether a policy was followed, whether the policy itself was adequate, and whether either needs to change.
• ✓The library has been through a purposeful annual review in which policies without a clear function have been retired — and that retirement has been documented, so the service can show it was deliberate.

A library with these characteristics does not need to be small. It needs to be purposeful. Some services will legitimately need 40 policies, some 120, depending on regulated activities, the complexity of the people they support, and the specific risks the service manages. The test is never the count. The test is whether each policy does governance work.

A Self-Check for Registered Managers

Repeat this exercise across the library over a quarter. You will develop a clearer picture of which policies are doing governance work and which are sitting on the server. That picture is more useful than any policy count.

The Governance Trilogy: The Shared Pattern

This is the third article in a governance cluster that makes a single underlying argument. Each piece looks at a different governance artefact — audits, actions, and now policies — but the failure mode is the same across all three.

The common failure across all three is the same. An artefact is put in place — an audit, an action, a policy. The artefact looks like governance. It produces paperwork. It fills a compliance requirement. But it does not change practice. The service goes through the motions of governance without the discipline that makes governance real. This is the False Assurance Problem — the named pattern Carevia uses to describe the gap between artefact and practice. The shared diagnostic is the same in all three articles: completion can hide inadequacy. But the way the failure shows up depends on the artefact. In audits it appears as completed forms that miss the issue, as actions marked done where practice has not changed, and as audit cycles that produce confident green logs over a service that is drifting. In policies it appears as documents that look current but do not govern, and as whole libraries that fill folders without reaching the shift floor. Each artefact has its own natural failure points. The diagnostic is what binds them together.

The answer in all three cases is the same too. Artefacts do not govern; disciplines govern. RAOF applied consistently turns audits into learning, actions into improvement, and policies into living documents. Without that discipline, no amount of policy volume, audit frequency, or action tracking will make a service well-led.

That is the Carevia thesis. It is why the Inspection Readiness Dashboard, the RAOF Time Planner and the Learning Culture Toolkit all centre on the same principle: the artefact is not the governance. The discipline is.

— Founder, Carevia

Frequently Asked Questions

Carevia is not a legal service. Always refer to official CQC guidance and use professional judgement.