Fit and proper persons, and what a board must be able to evidence

The annual fit and proper persons submission to NHS England reports an outcome for every board member. The chair separately confirms that every member has completed their self-attestation. Both entries record a conclusion.

The material behind that conclusion is held as separate items, obtained at different times by different people. Take one non-executive director, appointed from outside the NHS. A reference for that appointment carries the date it arrived, and the disqualified directors check carries the name of whoever ran it, if that was written down at all. Someone accepted a six-month gap in the employment history and recorded the basis for it wherever they keep their notes. An organisation can hold all of that and still be unable to produce it for one director inside the window it is given.

Fit and proper persons obligations test whether the organisation can show its working on a named individual, at a time chosen by someone else.

Regulation 5 sets a duty to supply on request

Regulation 5 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 prevents a provider from appointing or retaining a director, or anyone in an equivalent role, unless five conditions are met. They cover good character, the qualifications and experience for the office, fitness by reason of health after reasonable adjustments, no serious misconduct or mismanagement in a regulated activity, and none of the Schedule 4 Part 1 grounds of unfitness.

Paragraph 5(5) creates the operational load. For every director, the information specified in Schedule 3, together with anything else the provider must keep under an enactment, has to be available to be supplied to the Care Quality Commission. The duty is availability, per director, on the regulator's timing. CQC's guidance on regulation 5, updated on 16 May 2025, adds that providers should keep documented records of the decisions they reached.

The board's file and the clinician's file come from the same nine items

Schedule 3 runs to nine numbered paragraphs, the last of them definitions. The other eight are the file. They open with proof of identity and a recent photograph, then a criminal record certificate under section 113A of the Police Act 1997 or an enhanced certificate under section 113B. They continue with satisfactory evidence of conduct in previous health or social care employment, verification of why that employment ended, documentary evidence of relevant qualifications, a full employment history with a satisfactory written explanation of any gaps, and satisfactory information about any health condition relevant to capability.

Regulation 19 applies that schedule to every person employed in the regulated activity and requires recruitment procedures to be established and operated effectively. Regulation 5(5) applies the same schedule to directors. The chief executive's file and the newly registered nurse's file come from one list, which is worth knowing before an organisation builds them two separate ways.

CQC cannot prosecute a breach of regulation 19. It can take regulatory action against the provider, which a board answers for.

Every twelve months, the whole test runs again

NHS England's fit and proper person test framework for board members, publication reference PRN00238_i, has been effective since 30 September 2023 and was last updated 16 April 2025. It covers executive and non-executive directors of NHS trusts, foundation trusts and integrated care boards, interim appointments included.

Four of its requirements shape what each board member's record contains.

Every board member completes an annual self-attestation confirming adherence to the framework. Chairs complete their own, and annually confirm that all members have completed theirs and that the test is being applied effectively.

The full assessment repeats within a twelve-month period of the previous one, to review anything that changed in between.

References reach back six years. Someone joining from another NHS organisation needs the current employer plus previous employers within the past six years. Someone joining from outside the NHS needs references validating six consecutive years of continuous employment or an explanation of the gaps, with character references where employer references cannot be obtained. All are obtained before the appointment starts, and retained. The non-executive director sits in that second group, so six years of history and a written explanation of the gap both belong in that file.

The framework applies the NHS Records Management Code of Practice six-year retention expectation for staff records.

The evidence behind the sign-off

The Electronic Staff Record carries data fields for the test, recording that the testing was carried out and that the chair signed it off as complete. The framework calls the resulting report "an audit trail of completed testing and sign off", run at local level. Other organisations cannot see ESR.

ESR does not hold the supporting evidence. Documentation evidencing the test, and the overall conclusion for each board member, must be retained separately. Right to work documentation and screenshots for the disqualified directors check are two of the framework's examples.

So the system of record confirms a decision was made. The material that would justify it sits in a local folder or a mailbox. For the non-executive director, ESR carries the sign-off and nothing behind it, and the note accepting the six-month gap is wherever its author filed it. The framework describes that arrangement, and a sample test walks into it.

Sample testing every three years and the CQC well-led assessment

Every three years, NHS organisations should commission an internal audit of the processes, controls and compliance supporting their fit and proper persons assessments. That audit should include sample testing of assessments and their documentation. Sampling removes the option of preparing one representative file.

A submission summarising results for all board members goes annually to the relevant NHS England regional director. Where a member was approved to continue in post despite a concern, the reasons and measures taken must be documented locally and summarised there.

NHS England is explicit about the well-led evidence CQC weighs. CQC looks at the quality of the processes and controls supporting the test, the quality of the individual assessments, board member references in relation to both the appointing organisation and the one that wrote them, and the collation and quality of the data held in local records. Personnel files of recently appointed board members are named as something CQC will look at.

Regulation 5, regulation 19, Schedule 3 and NHS England's framework all sit outside the assessment changes CQC set out in its consultation response of 25 March 2026.

Ten days to answer a concern about one named director

Where CQC notifies an organisation of a concern about a board member, the organisation must detail the steps it has taken to assure that person's fitness and provide a full response within ten days.

Suppose the concern lands on that non-executive director and every check on the appointment was logged with its date as it happened. The response starts in one place. It holds the identity check with its completion date, six years of employment references with the date each request went out and each reply came back, the disqualified directors check with the date it was run and the person who ran it, and the written explanation of the six-month gap with the date somebody accepted it. None of that has to be found. The ten days go on the substance of the concern.

Now suppose each check was recorded wherever the person doing it chose. Day one goes on establishing who ran the disqualified directors check, and the answer is somebody who has since left. Emails go out to three former employers asking them to confirm what they wrote and when. The person who accepted the six-month gap is asked to recall the basis for it, four years after the fact. Each of those threads has a reply time the organisation does not control, and the ten days run whether the replies arrive or not. What goes to CQC on day ten is assembled from whatever came back inside the window.

Making the record at the point of the check

Merco uses Credentially to run pre-employment checks on between 35 and 40 documents for each candidate it onboards. It reports 100 per cent on one NHS framework compliance audit and 99.82 per cent on a second.

Credentially registers each check as a dated, attributed event. Audit reporting and a logged activity trail show what was checked and which source the result came from, for board members and clinical staff in one record. Reference requests are issued from that record and chased by automated reminder, so each reply behind the non-executive director's six years of history arrives with its date attached. The written explanation of the six-month gap is filed with that employment history, dated and attributed to whoever accepted the gap. An internal auditor sampling that director's file is reading a report that already exists, with no separate exercise built for the auditor.

The fit and proper persons items worth putting on the next board agenda

Two dates belong on the agenda first: the last three-yearly internal audit of the fit and proper persons assessments, and the next one. A board that can produce neither does not know when its records will next be read from outside.

The eight substantive Schedule 3 items are then worth going through one at a time. Identity documents and criminal record certificates usually sit in a system that records who obtained them and when. Employment histories and written explanations of gaps sit in correspondence.

The next assessment cycle must run within twelve months of the last one, so its deadline is already fixed. A board can decide that every check in that cycle is logged as it is made, carrying its source and the person who ran it. That is the one decision on this agenda that changes what the next audit finds.

‍

References

1. Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, regulation 5, fit and proper persons: directors. https://www.legislation.gov.uk/uksi/2014/2936/regulation/5 (retrieved 5 August 2026)
2. Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, Schedule 3, information required in respect of persons employed. https://www.legislation.gov.uk/uksi/2014/2936/schedule/3 (retrieved 5 August 2026)
3. Care Quality Commission, Regulation 5: Fit and proper persons: directors, page last updated 16 May 2025. https://www.cqc.org.uk/guidance-regulation/providers/regulations-service-providers-and-managers/health-social-care-act/regulation-5 (retrieved 5 August 2026)
4. Care Quality Commission, Regulation 19: Fit and proper persons employed, page last updated 16 May 2025. https://www.cqc.org.uk/guidance-regulation/providers/regulations-service-providers-and-managers/health-social-care-act/regulation-19 (retrieved 5 August 2026)
5. NHS England, NHS England fit and proper person test framework for board members, PRN00238_i, effective from 30 September 2023, last updated 16 April 2025. https://www.england.nhs.uk/publication/nhs-england-fit-and-proper-person-test-framework-for-board-members/ (retrieved 5 August 2026)
6. NHS England, Fit and Proper Person Test for board members: guidance on electronic staff record. https://www.england.nhs.uk/long-read/fit-and-proper-person-test-for-board-members-guidance-on-electronic-staff-record/ (retrieved 5 August 2026)
7. Care Quality Commission, Our initial response to our public consultation: Better regulation, better care, 25 March 2026. https://www.cqc.org.uk/about-us/how-we-involve-you/consultations/initial-response-public-consultation-better-regulation-better-care (retrieved 5 August 2026)