A care home in the West Midlands received a "Requires Improvement" rating from the Care Quality Commission in late 2025. The quality of care was good. Residents were well looked after. Families were broadly satisfied. But the inspection report identified a critical failing under the Safe domain: the home could not demonstrate that all staff — particularly agency workers covering night shifts — had been subject to complete pre-employment checks.
The manager protested that the agency had assured her all workers were fully vetted. The inspector's response was straightforward: "You're the registered provider. The responsibility is yours."
This scenario is playing out across the sector. As CQC's inspection framework evolves and the Fair Work Agency prepares to launch with consolidated enforcement powers, care homes face a dual compliance challenge that many are not equipped to handle.
What CQC actually inspects
CQC's single assessment framework assesses providers across five key questions: Safe, Effective, Caring, Responsive, and Well-Led. Workforce compliance sits primarily within Safe and Well-Led, but its implications touch all five domains.
Under Safe, inspectors assess whether the provider has robust recruitment and selection processes. Regulation 19 of the Health and Social Care Act 2008 (Fit and Proper Persons Employed) requires providers to ensure that persons employed for the purposes of carrying on the regulated activity are of good character, have the qualifications, competence, skills and experience necessary, and are able to perform the work they are employed to perform.
In practice, this means inspectors will look for:
- Disclosure and Barring Service (DBS) checks — enhanced with barred list checks for all staff in regulated activity, including agency and temporary workers
- Right-to-work verification — compliant checks with copies retained, expiry dates tracked for time-limited permissions
- Identity verification — confirmation that the person presenting for work is the person whose credentials are on file
- References — at least two, including the most recent employer, obtained before the start date
- Qualification and registration checks — for nurses (NMC), social workers, and other regulated professionals
- Training records — mandatory training completed and in date, including safeguarding, moving and handling, medication management, and infection control
- Supervision and appraisal records — evidence of ongoing support and competency assessment
Under Well-Led, inspectors assess whether governance systems are effective. This includes whether the provider has reliable oversight of workforce compliance across the organisation, not just for individual employees but as a system. Can the registered manager demonstrate, at any point, which staff are working, whether their checks are current, and whether training is up to date?
The gaps inspectors keep finding
Across published CQC inspection reports, the same workforce compliance failings appear with striking regularity.
Incomplete agency worker records
This is the most common gap. Care homes rely on staffing agencies to fill shifts, particularly at short notice, on nights, and at weekends. The agency conducts its own pre-employment checks — DBS, right to work, references — and assures the care home that the worker is fully vetted.
But assurance is not evidence. CQC expects the care home, as the registered provider, to hold its own records demonstrating that agency workers meet the requirements of Regulation 19. This means either obtaining copies of the agency's check documentation or conducting independent verification at the point of arrival.
In practice, many care homes have no such records. The staffing crisis in social care means shifts are filled at the last minute, workers arrive with minimal notice, and the priority is getting someone on the floor, not checking their paperwork. The compliance gap is a direct consequence of operational pressure.
Lapsed DBS checks
DBS certificates do not have an expiry date. Once issued, they are technically valid indefinitely. However, CQC and most sector guidance recommend re-checking at intervals — typically every three years — to identify any new information that may have emerged since the original check.
Many care homes conduct a DBS check at the point of hiring and never revisit it. A worker hired five years ago may have had a clean DBS at that time, but circumstances change. Without a programme of periodic re-checking or subscription to the DBS Update Service, the provider has no visibility of changes.
Right-to-work expiry tracking
Care is one of the sectors most reliant on overseas workers. According to Skills for Care data, approximately 32% of new starters in adult social care in 2023-24 were non-British nationals. Many hold time-limited visas — Skilled Worker visas, Health and Care Worker visas, dependent visas — that require re-verification before expiry.
Tracking these dates across a workforce of 50, 100, or 200 staff, many of whom work variable hours across multiple sites, is a significant administrative challenge. The consequence of missing an expiry date is severe: the employer loses their statutory excuse, and a worker whose permission has lapsed becomes an undocumented worker on your premises. Under current legislation, that carries a civil penalty of up to £60,000 per worker.
Training matrix gaps
CQC expects care providers to maintain a training matrix showing which staff have completed which mandatory training modules and when. In homes with high turnover, this matrix quickly becomes outdated. Staff leave, new staff arrive, agency workers rotate through, and the matrix reflects a workforce that no longer matches reality.
Inspectors look not just for whether training has been completed but whether it is current. Safeguarding refresher training, for example, is typically required annually. If your records show that 30% of your current workforce has overdue safeguarding training, that is a finding that will appear in the inspection report.
The CQC and FWA double jeopardy
Here is where the compliance landscape becomes genuinely challenging for care providers. CQC and the Fair Work Agency operate independently, but their areas of interest overlap significantly when it comes to workforce compliance.
CQC inspects your compliance with Regulation 19, which covers recruitment, identity verification, DBS checks, and staffing suitability. The FWA enforces immigration and employment law, including right-to-work checks, penalties for illegal working, and employment standards.
A failing identified by one body can trigger scrutiny from the other. If CQC finds that your agency worker records are incomplete, that finding is now part of the public record. The FWA, conducting its own intelligence-led enforcement, has access to CQC inspection data. A "Requires Improvement" rating on Safe, particularly one citing workforce compliance gaps, is a signal that invites further investigation.
The reverse is also true. If the FWA identifies a right-to-work failure at your care home — an undocumented worker, a missed visa expiry, an absent audit trail — CQC will take that into account at the next inspection. A civil penalty from the Home Office is evidence of a governance failure that falls squarely within Well-Led.
This creates a reinforcing cycle. A failing in one domain increases the likelihood of scrutiny in the other. Care homes that have historically managed CQC compliance and immigration compliance as separate concerns need to recognise that they are now, in practice, the same concern assessed by different bodies.
How to prepare for both simultaneously
The good news is that the requirements of CQC and the FWA overlap sufficiently that a single, well-designed compliance system can address both. Here are the practical steps.
Centralise your workforce records
Every member of staff — permanent, bank, and agency — should have a digital record containing their identity verification, DBS status, right-to-work check, training completion, and supervision records. This record must be accessible to the registered manager and any designated compliance lead at any time, not stored in filing cabinets that nobody checks.
Conduct a full workforce audit
Review the records for every person currently working in or for your organisation. Identify gaps: missing DBS checks, expired right-to-work permissions, incomplete references, overdue training. Prioritise the gaps and work through them systematically. Do not wait for the next CQC inspection or FWA visit to discover what is missing.
Establish agency worker protocols
Agree clear terms with your staffing agencies about what documentation they must provide before (not after) a worker's first shift. At minimum, you need confirmation of DBS status, right-to-work verification, and identity confirmation. Ideally, you should be able to verify the worker's identity independently at the point of arrival — confirming that the person on your care floor is the person whose credentials are on file.
The safeguarding gap created by agency rotation is well documented. Closing it requires a verification step at the point of service, not just a paper trail generated days or weeks later.
Track expiry dates proactively
Build a system — digital, not paper-based — that alerts you to upcoming expirations for DBS rechecks, visa permissions, professional registrations (NMC, HCPC), and mandatory training. Ninety-day, thirty-day, and seven-day alerts give you sufficient time to act without scrambling at the last minute.
Test your retrieval time
Pick five staff members at random — including at least one agency worker. Time how long it takes you to produce their complete compliance file: identity, DBS, right to work, training, supervision. If the answer is minutes, you are in reasonable shape. If it is hours or days, you have a structural problem that needs addressing before your next inspection.
Technology as the compliance backbone
For care homes operating with stretched management teams and limited administrative support, maintaining this level of compliance manually is extraordinarily difficult. The volume of staff, the frequency of agency rotation, and the number of dates and documents to track make a paper-based or spreadsheet-based approach fragile and error-prone.
Certifyd's compliance portal is built for exactly this scenario. It creates a single, auditable record for every worker — permanent, bank, or agency — with real-time verification at the point of arrival, automated expiry tracking, and a dashboard that shows your compliance status across the entire workforce at a glance. When CQC arrives for an inspection or the FWA conducts an unannounced visit, the evidence is there, organised and accessible, not scattered across filing cabinets and email inboxes.
For care providers navigating the intersection of CQC and FWA compliance, explore how Certifyd supports the care sector.