16 checks before hiring an audit consultant

Consultant checklist

Compare a consultant’s experience, proposed work, fees and handling of care records before you hire them.

Start checklist
4 areas to check16 checksSaved in this browser
Reviewed against published CQC, ICO and Care England guidance · 4 September 2026
Before you appoint anyone

How to compare consultants

A private consultant can offer a useful fresh view, but the work is not a CQC inspection and the consultant cannot decide a rating. Ask for proof behind claims, insist on a written plan and understand exactly how sensitive records will be handled.

Use the same questions for every supplier, including GR Safi. Keep a dated note of what you checked, what remains unanswered and why the chosen reviewer suits the decision your service needs to make.

  1. 01
    Decide what you need

    Be clear whether you need an audit, correction support, a re-audit or ongoing monitoring.

  2. 02
    Check the answers

    Ask for current documents, relevant experience and a sample report. Mark each answer as confirmed, partly confirmed, not confirmed or not applicable.

  3. 03
    Agree the work before sharing records

    Confirm the scope, quote and signed agreement, including access, safe sharing and deletion of care data. Use the decision notes at the end to record your choice.

Current CQC position · checked 4 September 2026

Require a dated source, not an old “CQC checklist”.

CQC is testing a new assessment method during 2026. Its published update says tests run from June to October, with a final review planned for November, while the five key questions remain central. Ask every reviewer which current guidance and version they use.

Read CQC’s June 2026 pilot update

This is a buyer’s guide, not legal advice or an approval scheme. It does not certify a consultant, decide whether a contract is legally sound or replace the checks your organisation needs for its risks and data.

Private working copy0 of 16 reviewedSaved only in this browser
Area to check 01

Experience and independence

Can you check who the reviewer is, why their experience is relevant, their limits and their independence?

4 checks

Identity, qualifications and appointment checks can be verified.

Names, dates, roles and issuing organisations are clear enough to check. Important claims are supported by current documents or independent sources, not only by website wording.

Ask for a current CV, qualification or training evidence, relevant insurance and any criminal-record or right-to-work check the role requires. Confirm who issued each item, its date and whether it is still current.
Status for C1

Relevant care-sector experience is described precisely.

The reviewer separates direct care-service experience, management work, auditing, clinical expertise and knowledge of regulation instead of blending them into one vague claim.

Ask which service types, roles, review areas and recent jobs are genuinely relevant. Where appropriate, ask whether recent clients can confirm comparable work directly.
Status for C2

Conflicts and commercial relationships are disclosed.

The provider knows about any earlier work, referral deal, supplier relationship, competing interest or later paid work that could affect, or appear to affect, independence.

Ask: what conflicts have been checked, what will be disclosed and how will any conflict be managed?
Status for C3

Private status and limits are clear.

The reviewer does not imply that they work for CQC, have inspection powers or control CQC decisions. Terms such as “CQC-style” and “mock inspection” are clearly explained as private support.

Confirm: only CQC carries out official assessments and decides findings and ratings.
Status for C4
Area to check 02

What will be checked and how

Will the work answer the agreed question and be honest about what it cannot show?

4 checks

The question, goal and standards used are written down.

The written plan names the questions and service areas, and which current guidance, provider procedures, contracts or other standards will be used.

Confirm: source titles or links, relevant versions or dates checked, and what happens if guidance changes.
Status for S1

The proposed sample is sensible and explained.

The plan defines the locations, people, records, staff roles, time period, interviews and observations, or explains how they will be chosen according to risk.

Ask why the sample is enough, what cannot be concluded from it and when serious or repeated concerns would require a wider review.
Status for S2

The plan clearly states what is excluded and what the findings depend on.

The provider can see what is not covered, whether practice will be observed and when separate clinical, legal, financial or data-security advice may be needed.

For money-handling checks, distinguish care compliance and safeguarding from accountancy, tax, investment or FCA-regulated financial advice. Confirm all other exclusions too.
Status for S3

Access, responsibilities, timing and price are agreed.

The quote confirms on-site, remote or blended delivery, the sample and time period, meetings, report dates, fees and travel. It separates the audit, correction support, re-audit allowance and monitoring, with clear limits and a process for extra work.

Ask for a signed agreement after the scope and price are settled. Large services, several locations or months of records and extensive corrections need an appropriately scoped quote.
Status for S4
Area to check 03

Keeping records and data safe

Is only the information needed used and protected throughout the work?

4 checks

Data responsibilities, purpose and written terms are clear.

Both sides state why personal information is needed, who is responsible for it and whether a data-protection contract is required.

Ask the right privacy or legal lead to confirm the arrangement before sensitive information, such as health data, is shared.
Status for D1

Only the information needed is requested.

Names are removed or replaced with reference codes where possible, unneeded fields are removed and access is limited to the agreed sample instead of a large transfer “just in case”.

Confirm: which fields are needed, how details will be removed or replaced, the sample limits and who approves sharing.
Status for D2

Sharing, storage, access and working methods match the risk.

The provider understands how records will be sent, how they will be protected, who can access them, which devices, locations and suppliers are involved, whether backups exist and how working copies stay safe.

Do not place identifiable care records in a public enquiry form or an ordinary scoping email.
Status for D3

How long records are kept, returned or deleted, and what happens after a breach are stated.

Both sides know how long source records, notes, reports and backups may be kept, what will be returned or deleted, how deletion will be proved when needed and whom to contact if information is lost or shared wrongly.

Confirm: when the keeping period starts, final deletion, any legal reason to keep information, the breach contact and who must notify affected people or authorities.
Status for D4
Area to check 04

Report and follow-up

Will the report show how it reached each finding, be fair and useful, and make responsibilities clear?

4 checks

The report shows how it reached its findings.

It states the purpose, what was reviewed, standards used, sample, dates, method and limits, so a reader can see what was and was not checked.

Read a sample report and check that findings link back to what was reviewed before buying the service.
Status for O1

Facts, supporting records, professional opinion and recommendations are kept separate.

Important findings link to what was checked, professional opinion is labelled, and there is a clear way to correct factual errors or provide important missing information before the report is finished.

Fact checking should improve accuracy without allowing difficult findings to be bargained away.
Status for O2

Good practice and gaps are put in order without pretending to rate the service.

The report separates immediate safety or reporting needs from high, medium and longer-term improvement. It explains why and does not present a private score as a predicted CQC result.

Confirm which urgent concerns must be raised during the review instead of waiting for the final report.
Status for O3

Actions, owners, proof of completion and follow-up are practical.

Each action has a priority, owner, date and evidence needed for completion. Corrections must use genuine evidence and provider approval, without invention or false backdating. The provider retains care, clinical and regulatory decisions.

Ask how a re-audit records Closed, Partly Closed, Open and Urgent/High Risk actions, and what monitoring is included or charged separately.
Status for O4
Record the reasons

Keep a clear record of your decision.

Record only non-confidential buying notes here. The working copy stays in this browser until you clear it and is not sent to GR Safi.

Private working copy. These notes use local browser storage. Clear them before using a shared device, and do not enter confidential or identifiable information.

Check the official guidance

CQC’s approach is changing during 2026, while the five key questions and providers’ legal duties remain important. Information Commissioner’s Office guidance says data should be limited to what is needed and protected according to the risk.

Care-sector discussions have also called for clearer, more consistent private mock inspections and consultancy. This checklist turns those concerns into questions a provider can ask.

01
CQC assessment guidanceCurrent provider-assessment pages and updates
 02
CQC 2026 pilot updateTesting and evaluation of the new assessment method
 03
Regulation 17: Good governanceAudit, records, risk and improvement duties
 04
ICO data minimisationRelevant and limited to what is needed
 05
ICO data-security guideSecurity measures matched to the risk
 06
Care England sector discussionMock inspections, consultants and how to check claims
 07
Care England consultant checklistCriminal-record checks, insurance, legal status, relevant skills and references

Now use the same checks for GR Safi.

Check the qualifications, sample report, working method and limits. Compare the audit services and what they cover, then read the client agreement before deciding whether to get in touch.

Check the backgroundRead the working standardsRequest current evidencePlan a review