Clinical Governance and Audit

One conventional model describes governance through a set of pillars, commonly given as clinical effectiveness, risk management, patient, athlete and service user involvement, audit, staff management, education and training, and information management. It is a model rather than the definition of governance, and many organisations use different quality frameworks. Labels vary between organisations, so the framework is a way of examining a service rather than a statutory checklist. What matters is translating each into something concrete for a squad.

Clinical effectiveness asks whether practice follows current evidence rather than what the last team did or what a rival club posted on social media. Risk management asks whether there is an emergency action plan, whether the medical bag is checked against a list, and whether near misses are recorded. Involvement means the athletes themselves have a route to raise concerns about their care that does not run through the coach. Audit asks whether anything is measured against a standard. Staff management covers who is qualified to do what, indemnity, and Disclosure and Barring Service checks. Education and training covers mandatory training and keeping it current. Information management covers records, storage and lawful sharing.

Three features make this harder in elite sport than in routine practice. The clinician is frequently employed by the organisation whose interests may conflict with the athlete's. Care is delivered at events, training grounds and temporary settings, which requires confirmation that the provider, the regulated activities, the locations and the governance arrangements meet the applicable regulatory requirements. Registration turns on who is providing the service and which regulated activities are carried out, not simply on whether a room is a clinical one. And the informality of the environment encourages clinical decisions to be made in conversations and unapproved messaging that never reach the formal record.

Clinical audit is one form of quality improvement. It compares care against explicit criteria and acts to close the gap, whereas research is prospectively designed to generate new generalisable knowledge. The distinction rests on purpose, the use of explicit criteria and whether treatment is allocated by protocol, rather than on the single word standard, and the Health Research Authority publishes a decision tool for cases that are genuinely unclear.

The cycle has four stages. Preparation and planning selects a topic that matters, identifies the standard to measure against, and defines the sample. Measuring performance collects the data, expressed as a numerator over a denominator: the number meeting the standard over the number who should have. Implementing change acts on what the measurement showed. Remeasuring and sustaining improvement confirms whether the intervention changed performance and whether the change held. This is the step most often omitted, and while an initial measurement against criteria is still an audit, it is an incomplete one without it. The Healthcare Quality Improvement Partnership (HQIP) sets out criteria for best practice, including that the topic should be a priority, the standard should be evidence-based, and the organisation should enable staff to take part.

Useful team care audits are usually unglamorous. Proportion of pitchside emergency bags checked within the interval required by the organisation's own equipment policy. Proportion of return to play decisions with a documented rationale. Proportion of squad with immunisations current before travel. Each has a clear standard, a countable denominator and an obvious action if the number is poor.

Local incident and significant event systems should capture adverse incidents and relevant near misses so that the system learns rather than the individual is blamed. Terminology and reporting thresholds vary between organisations, and internal incident reporting, statutory or regulator notification, the professional duty of candour and significant event review are separate processes rather than interchangeable ones. A near miss is often more valuable than an incident because it exposes the same latent weakness at no cost to the athlete. If the emergency bag is discovered to be missing an airway adjunct on an away trip and nothing goes wrong, that should be recorded and reviewed, proportionately: a minor near miss does not need the same formal process as a serious safety incident.

A structured report covers what happened, when and where, who was involved, what went well, what went less well, why, what will change, and who owns that change by when. Reports are of no value unless the last two are completed and followed up. Alongside reporting sit debriefs after incidents, complaints handling, reflective practice and the willingness of senior staff to describe their own errors, which does more to establish psychological safety than any policy document.

Two pressures work against this in sport. The squad is small, so anonymity is limited and reporting feels personal. And the performance environment rewards confidence, so admitting error carries social cost. Naming both openly, and taking a just and learning approach, which examines system factors while still addressing reckless conduct, deliberate violations or genuine competence concerns appropriately, is what makes a reporting system used rather than merely available.

The Caldicott principles provide principles for the appropriate use and sharing of confidential health and care information. They sit alongside the common law duty of confidentiality, data protection law and professional standards rather than replacing any of them. There are eight, originally six in 1997, with a seventh added in 2013 and an eighth in 2020.

In order they require that the purpose for using confidential information is justified, that it is used only when necessary, that the minimum necessary is used, that access is on a strict need to know basis, that everyone with access understands their responsibilities, that the law is complied with, that the duty to share information is recognised as being as important as the duty to protect it, and that patients are informed about how their confidential information is used.

The last two carry the most weight in practice and are the two most often examined. Principle seven exists because excessive caution harms people: necessary and proportionate sharing for safe care can be as important as protecting confidentiality. It is not a freestanding authority to disclose everything, and the minimum necessary rule still applies. Principle eight, added in 2020, is the no surprises principle. People should have clear expectations about how and why their information is used and what choices they have, which in a team setting means agreeing in advance what will normally be shared with coaching staff rather than deciding case by case under pressure. Such an agreement is not permanent blanket authority, and the purpose, recipient, information requested and the athlete's wishes should be revisited whenever a new disclosure arises. Records themselves should be contemporaneous, legible, attributable, accurate and stored securely. Unapproved personal messaging creates risks around confidentiality, access control, retention, retrieval and audit trail, and professional guidance recognises that appropriately safeguarded instant messaging can be useful provided workplace policy is followed. The requirement that does not bend is that clinically important decisions are transferred promptly into the formal record.

• •Governance pillars are a way of examining a service, not a statutory checklist, and the labels vary between organisations.
• •The audit cycle is preparation and planning, measuring performance, implementing change, sustaining improvement. Re-audit closes the loop.
• •Audit measures practice against a standard; research asks what the standard should be.
• •Near misses are significant events and are often more informative than actual incidents.
• •Caldicott principle seven: the duty to share is as important as the duty to protect.
• •Caldicott principle eight, added in 2020, is the no surprises principle on informing people how their information is used.