The Ultimate Compliance Checklist for UK Regulated Services

Compliance in a regulated service is not a project you complete. It is a standard you maintain every day. Documents expire. New staff join. Qualifications lapse. Inspections arrive with little or no warning.

What follows is a practical checklist covering every compliance area a CQC or Ofsted-regulated provider needs to manage. Use it to audit your current position, identify gaps, and build a process that keeps you inspection-ready at all times.

How to Use This Checklist

Work through each section and mark your current status honestly. For each item, ask two questions: do you have the record? And can you find it within five minutes if an inspector asks for it?

If the answer to either question is no, that item is a gap.

Section 1: Right-to-Work Requirements

Every person working in your service must have the legal right to work in the UK. Checking and recording this is a legal obligation. Employing someone without the right to work can result in a civil penalty of up to £60,000 per worker from 2024 onwards.

 
The check itself

• Right-to-work check completed before the first day of work
• Original documents seen in person (or via the Home Office online service for eVisa holders)
• Documents verified as genuine and belonging to the person presenting them
• Copy of documents retained on file (digital or physical)
• Date the check was carried out is recorded

 
Document types accepted

• UK or Irish passport (or passport card)
• Biometric Residence Permit
• Home Office share code (for eVisa holders) verified via gov.uk online checker
• EU Settlement Scheme status confirmed via online checker where applicable
• Certificate of Application (if worker is pending settled status) with additional checks in place

 
Ongoing requirements

• Time-limited right-to-work documents have a diary or alert for re-verification before expiry
• Re-verification completed before the existing permission expires
• Re-verification documented with same standard as initial check

“Right-to-work is one of the first things inspectors ask about. Not just whether the check was done, but whether the record proves exactly when it was done and what was seen.” — Orta

Section 2: DBS Checks and the Update Service

The Disclosure and Barring Service check is mandatory for all staff working in regulated activity with children or vulnerable adults. The level of check required depends on the role.

Check requirements by role

 
Pre-employment DBS checklist

• Correct level of DBS check identified for each role
• Application submitted before unsupervised work begins
• Certificate number and issue date recorded on file
• DBS certificate reviewed and outcome documented
• Decision made and recorded where any disclosure is noted

 
Update Service

• All staff on continuous contracts registered with the DBS Update Service
• Update Service consent obtained from each registered worker
• Status checks run annually as a minimum (or before a new role where relevant)
• Results of Update Service checks recorded on file with date

 
Ongoing management

• System in place to identify staff not registered with the Update Service
• Process for handling portable DBS certificates from previous employers
• Escalation process in place for certificates showing relevant disclosures

Section 3: Storing Documents for Audits

How you store compliance documents is as important as whether you hold them. Records that exist but cannot be located quickly, or that are held in inconsistent formats across multiple systems, will cause problems at inspection.

 
Storage requirements

• All staff compliance documents held in a single, accessible location (digital preferred)
• Documents stored securely with appropriate access controls (GDPR compliance)
• Physical documents, where used, stored in locked filing with controlled access
• Retention periods applied correctly (employment records typically 6 years post-employment)
• Deletion or destruction of records follows a documented process

 
Accessibility

• Any compliance document can be retrieved within five minutes
• Records accessible to authorised staff from multiple locations (cloud-based or equivalent)
• No critical compliance records held only in personal email accounts or individual desktops

 
Audit trail

• Record of who accessed or amended any document is maintained
• Version history available for key policy and procedural documents
• Date-stamped records of when each check was completed

 
For a full breakdown of what CQC inspectors look for in your records at the point of inspection, see Building Your Audit Trail from Day Zero.

Section 4: Verifying Qualifications and Professional Registrations

In care settings, certain roles require specific qualifications or active professional registration. These must be verified at point of hire and monitored throughout employment.

Qualification verification

• Role-specific qualifications identified for every position before recruitment begins
• Original certificates seen and copies retained on file
• Where qualifications are from overseas, verified as equivalent to UK standards (UK ENIC where applicable)
• Qualifications recorded in a central staff record, not just in a paper file

 
Professional registrations

Roles requiring active registration with a professional body include (but are not limited to):

• Registration checked directly with the relevant body at point of hire (not just from the certificate)
• Registration number recorded on file
• Annual renewal of registration confirmed and recorded
• Alert in place for registration renewal dates
• Process in place for handling lapsed registrations before a renewal is confirmed

 
Mandatory training

• Training requirements mapped to each role (training matrix)
• Completion certificates held on file for all required training
• Expiry dates tracked for time-limited training (e.g., moving and handling, first aid, fire safety)
• Refresher training completed before existing certification expires

Section 5: Tracking Renewals Across Your Workforce

Single-point checks at hire are necessary but not sufficient. The compliance picture changes constantly across a workforce of any size. The ability to track renewals proactively, rather than discovering gaps at inspection, is what separates providers with Good and Outstanding ratings from those receiving Requires Improvement.

What needs an expiry date tracker

• DBS certificates (where not on Update Service)
• Right-to-work documents (time-limited visas and permissions)
• Professional registrations (annual renewal)
• Moving and handling certification (usually annual)
• First aid certification (typically three years)
• Fire safety training (annually recommended)
• Food hygiene certification where relevant (usually three years)
• Safeguarding training (frequency varies by role and local authority requirements)
• Mental Health First Aid where applicable
• Any role-specific training with a defined renewal period

 
Alert standards

• 90-day alert: identifies upcoming renewals with sufficient time to plan
• 60-day alert: prompts active renewal process to begin
• 30-day alert: escalation to manager if renewal not yet in progress
• Zero-day alert: immediate action required; staff member should not be scheduled until renewed

 
Rota integration

• Staff with expired critical documents cannot be placed on shifts without manager override
• Rota-building process checks compliance status before confirming allocations
• Any override of a compliance-based scheduling block is documented with reason

“The providers who feel most confident at inspection are almost always the ones who can pull up a real-time compliance dashboard in under a minute. Not because they prepared for the inspection, but because they never stopped being prepared.” — Orta

For a closer look at how automated alerts work across a full workforce, read How to Set Up Compliance Alerts.

Section 6: Safer Recruitment (Ofsted-Regulated Settings)

For settings regulated by Ofsted, safer recruitment requirements are set out in Keeping Children Safe in Education (KCSiE) and the EYFS statutory framework. These overlap significantly with CQC requirements but include some additional steps.

• At least one member of every interview panel has completed safer recruitment training
• Application form (not just CV) used for all appointments, capturing full employment history
• Identity verified in person before appointment is confirmed
• Two references obtained in writing before the person starts (not just on arrival)
• References address specific questions about conduct and suitability
• Disqualification declaration obtained (Childcare Act 2006)
• Single Central Record (SCR) maintained and up to date
• SCR includes all required checks for every person working in the setting, including volunteers and contractors

Section 7: Ongoing Compliance Governance

Individual checks are the foundation. Governance is what holds the whole system together over time.

• Named person responsible for compliance oversight in each service
• Regular (at least monthly) review of compliance dashboard or records
• Process for staff to self-report changes that affect compliance (e.g., new criminal conviction, visa status change)
• Disciplinary process covers non-disclosure of relevant information
• Whistle-blowing policy in place and communicated to all staff
• Annual compliance audit completed against regulatory framework
• Action plan in place and monitored for any gaps identified in audit

Is Your Current Process Keeping Up?

The volume of compliance information a regulated service needs to track grows with every new hire. Processes that work at ten staff often start to fail at thirty. At fifty or more, manual tracking almost always produces gaps.

Book a demo with Orta to see how automated compliance tracking and expiry alerts work across a full workforce, and what inspection-ready looks like in practice.