Organisation culture, roles and competencies
The first foundational element covers the culture that lets people raise a concern, the roles that carry responsibility, and the competencies those roles need.
What the public record carries
Not stated in the public record beyond the element title. The public introduction describes the four parts each element carries. The text of 5.2.2 is not public.
Basis. The public contents name the element. The four parts of the element are not public.
Why it matters in a health estate
A culture that punishes the reporter loses the information the programme needs most. The element is placed in governance rather than in training because culture, roles and competencies are structural: they decide who is appointed, what they are taught and what happens when they speak. For a CISO, the practical test is whether a clinician or a developer can raise a safety concern about a security decision without it being treated as an IT ticket.
What to do now
Record how a concern is raised, who receives it, what happens next and what the reporter hears back. Check that every role with a responsibility in the register has a named competency requirement and a dated record of it being met.
The evidence a reviewer will ask for
| Evidence | What it is |
|---|---|
| Concern route | How a concern is raised, who receives it and what the reporter hears back |
| Role competencies | The competency requirement for each role in the register |
| Training record | A dated record per person, not a completion percentage for a team |
| Culture evidence | The last concerns raised and what changed as a result |
What a reviewer will ask
A reviewer will ask what happens to a person who raises a concern. A policy that promises no blame and a process that logs a ticket do not agree.
Common gaps
- A concern about a security control is handled as an IT ticket with no clinical reading
- Competency is recorded as a course completion with no assessment of practice
- A role is filled by someone with no record against its competency requirement
- The culture survey is the only evidence and no concern has been acted on
Before the draft publishes
Follow one concern from report to change and write the path. If it cannot be traced, the culture claim is untested.
If the draft changes this row
The draft is edition 2 and 62 pages, one page more than the first edition. Its text and any change summary are not public as at 21 October 2026. This row follows the published first edition's structure, which is what your procedure should name today. The change watch emails you when the record changes or the draft text lands, and the row is re-read then. No one can tell you what moved before that, and this page does not guess.
Related rows
Who this binds. The people lead, the CISO and every manager who appoints a role with a responsibility in the life cycle.