Support

Knowledge Base

A practical help centre for implementation, governance workflows, role-specific usage, troubleshooting, and inspection readiness.

Guidance here is operational and product-specific. It does not replace legal advice, clinical advice, or regulatory determinations.

Implementation guides

Role guides

Troubleshooting

FAQ

Governance workflows

Issue management, remediation approvals, effectiveness review, learning logs, and evidence traceability.

• Issue registration standards
• Root-cause and action planning
• Closure and residual risk
• Audit trail expectations

Role-based guidance

Clear expectations for every role the platform supports — Nominated Individuals, Responsible Individuals, Directors, Managers, Organisation Admins, Staff, Group Admins, and Inspectors.

• NI/RI weekly review rhythm
• NI/RI Control Tower across organisations
• Director and Org Admin oversight view
• Manager action ownership
• Staff policy acknowledgement
• Group Admin cross-provider benchmarking
• Inspection companion usage

Implementation support

Rollout sequencing, provider onboarding, evidence ownership, and enterprise operating models.

• Single-service rollout
• Multi-service rollout
• Data migration planning
• Readiness baseline setup

Troubleshooting

Operational fixes for stale evidence, overdue actions, permissions mismatches, and inspection preparation pressure.

• Missing evidence references
• Overdue action cleanup
• Role access checks
• Inspection mode recovery

Operational playbooks

Step-by-step workflows for the moments that matter most.

Onboard a new provider site: from integration to operational

1. Setup: create the provider account, confirm legal entity details, and assign Nominated Individual (or Responsible Individual), Director, and Manager roles.
2. Setup: configure each service — regulator, service type, registration ID — and set the reporting rhythm and evidence owners.
3. Integration: connect source systems (webhook, API, CSV, or email) or import historic data — see 'Connect a source system' and 'Import your existing governance data' below.
4. Integration: seed your policy library and build or clone your first audit template, or start from the seeded defaults.
5. Validation: run the opening baseline review to surface governance gaps, overdue actions, and missing evidence before go-live.
6. Go-live: approve the go-live checklist, install the mobile app for NI/RI and managers, and confirm automated escalation is active.
7. Operational: move into the weekly governance rhythm — review open issues and overdue actions, and let automated escalation and Risk Radar surface patterns between reviews.

Run a governance issue lifecycle

1. Register the issue with severity, regulation context, and owner.
2. Record interim controls and immediate risk containment.
3. Approve a remediation plan with dated actions and updates.
4. Review completion evidence and challenge overdue items.
5. Close only after effectiveness review and recorded learning.

Prepare for inspection mode

1. Review high-risk open items and missing evidence first.
2. Generate the latest governance and readiness bundles.
3. Activate inspection mode to preserve record integrity.
4. Coordinate retrieval roles so teams are finding evidence, not rewriting history.
5. Capture any inspection-day follow-up actions in the action register afterwards.

Manage multi-site oversight (Enterprise plan)

1. More than one registered service under one account is part of the Enterprise plan. Add each service under your Provider account so it has its own governance record.
2. Assign managers to specific services from Organisation → Team → Change homes — they'll only see governance data for their assigned services.
3. Directors and Organisation Admins see every service from one dashboard, and so does an NI unless you assign them specific homes — no switching between accounts.
4. Use the Risk Radar heatmap to spot patterns across services, weighted by severity, by service and issue category, not just raw counts.
5. Review cross-site readiness weekly and escalate services that fall below your threshold.

Set up manager access controls

1. Go to Organisation and open the Team tab (NI, Organisation Admin or Director).
2. Find the manager and select Change homes.
3. Tick the services they should see, then select Save homes. The change applies the next time they sign in.
4. Once assigned, the manager will only see issues, actions, and diary entries for their services.
5. To give a manager access to all services, leave every box unticked — this is the default.

Import your existing governance data

1. Option 1: CSV Import — Export your existing spreadsheets as CSV, then upload via Connectors → Import CSV. The system validates each row and reports errors.
2. Option 2: Source System Integration (Growth and Enterprise plans) — Connect your source system via webhook. Events flow automatically into your governance dashboard.
3. Option 3: Manual Entry — Create governance issues, actions, and diary entries directly in the platform. Best for providers starting fresh.
4. For Enterprise customers: our team provides assisted data migration — we map your existing data into AssuraFlow format and import it for you.
5. After import, review the data in your dashboard and verify all issues, actions, and evidence are correctly linked.

Connect a source system (Growth and Enterprise plans)

1. Go to the Integrations page to see the supported source-system patterns.
2. Choose the source system and follow the setup guide — most use webhook integration (events send automatically to AssuraFlow).
3. Select which events to send: incidents, safeguarding alerts, medication errors, audit completions, compliance alerts.
4. Test the connection by triggering a test event from the source system — it should appear in your NI/RI dashboard within seconds.
5. Once connected, governance-relevant events flow automatically — no manual data entry needed.

Add and configure a service

1. Go to Organisation → Services tab and click 'Add Service'.
2. Enter the service name, select the regulator (CQC, Ofsted, CIW, Care Inspectorate, or RQIA), and choose the service type (Residential, Nursing, Children's, etc.).
3. Add the registration ID (CQC Location ID or Ofsted URN), capacity, address, and registered manager name.
4. The service inherits your organisation's settings (branding, terminology) but the regulator determines whether it uses 'NI' or 'RI' terminology.
5. Assign an NI or RI to the service — they'll only see governance data for their assigned services.

Set up multiple NIs/RIs within one organisation

1. Go to Organisation → Team tab to see all users.
2. Invite a new NI or RI via the Invitations tab — they'll receive an email to join.
3. Once they've joined, open their profile from the Team tab and assign them to specific services.
4. Each NI/RI will only see governance data for their assigned services — they cannot see other NIs' services.
5. The Organisation Admin and Directors always see all services for oversight purposes.

Engage an NI/RI who works across several organisations

1. This is different from assigning an internal NI/RI to services — it is for an accountable individual who is the NI or RI for more than one organisation and wants to see them all in one login.
2. In Organisation → NI/RI Engagements, enter the person's email and send the engagement. If they already have an account it becomes a pending engagement; if not, they receive an invitation to create one.
3. The NI/RI accepts from their own account, under Account → Engagements. Your organisation then appears in their Control Tower alongside any others.
4. You keep full control: end the engagement at any time from the same screen and your organisation's data leaves their view immediately. Your subscription and data ownership are unaffected.
5. To keep the classic model — where your NI/RI is tied to this organisation only — turn off 'Allow this organisation to engage an NI/RI who also works elsewhere' in Organisation → Settings.
6. Switching context: when an NI/RI has active engagements with two or more organisations, an 'Active organisation' switcher appears in the sidebar (and on mobile). Selecting one re-scopes every screen to that organisation.

Set up the mobile app

1. The Android app is in pilot and not yet in an app store (iPhone to follow): ask your account team for it, then sign in with your existing account — no separate licence or setup.
2. Your role and service assignments carry over automatically from the desktop app.
3. Use the Diary tab to log visits, meetings, decisions, and escalations from site, synced with the desktop timeline.
4. Use the Action Register and Evidence tabs to update ownership and readiness without waiting to get back to a desk.
5. Inspection mode behaves identically on mobile — records lock and retrieval-only access applies on both platforms.

Build and publish a custom audit template

1. Go to Audit Templates and choose 'New Template', or clone an existing one to start from a working baseline.
2. Add sections, then add questions to each section — Text, Checkbox, Date, or Multiple Choice.
3. Multiple Choice questions need at least two answer options — the platform validates this before saving.
4. Set evidence rules and mark questions as required or critical where a gap should surface in Evidence Readiness.
5. Publish when ready, or keep it in Draft while you refine it — publishing doesn't stop you cloning it again later.

Roll out a policy for staff acknowledgement

1. Go to Policies and create a new policy, or upload a new version of an existing one — version history is kept automatically.
2. Write or attach the policy content and save it as a Draft while it's reviewed internally.
3. Publish the policy once approved — this is the point staff acknowledgement tracking begins.
4. Monitor the completion-percentage rollup to see who has and hasn't acknowledged it yet.
5. When a policy needs retiring, archive it rather than delete it — archiving preserves the acknowledgement evidence you've already collected.

Understand automatic escalation

1. Automated escalation runs on a fixed schedule and needs no setup — it's active by default on every account.
2. It targets two things: critical or high-severity issues that haven't been acknowledged, and remediation actions that have gone overdue.
3. When it fires, the record escalates to the accountable NI/RI or manager, and the escalation is written permanently into that record's history.
4. Acknowledging an issue or updating an overdue action before the sweep runs prevents escalation — it only chases what's actually been missed.
5. Escalation history shows up in the Diary and Action Register alongside your own entries, in context rather than as a separate alert feed.

Track personal allowances and review flagged transactions

1. Record each deposit, withdrawal, or purchase against the person's profile — the running balance updates immediately.
2. Set a suspicious-transaction threshold (amount) and window (frequency) for your provider, or leave the platform defaults active.
3. Review any transaction flagged for exceeding the threshold or occurring too many times in the configured window.
4. Attach a receipt to any transaction that needs supporting evidence.
5. Reconcile the period once physical records are checked — this stamps who confirmed it and when.

Schedule and conduct a Reg 44/45 visit

1. Tag an audit template as Ofsted-specific (or use one already tagged) so it's ready to run a visit.
2. Schedule the visit against a service — pick Reg 44 or Reg 45, a due date, and a cadence.
3. When it's due, start the visit: this begins a real audit run using the tagged template's checklist.
4. Complete the checklist, attach evidence, and take it through the same staged sign-off as any other audit run.
5. Once signed off, the next visit on that cadence is scheduled automatically — nothing to set up again.

Role guides

Who should do what inside the governance rhythm.

Nominated Individual / Responsible Individual

• Review open critical and high-risk issues weekly.
• Approve remediation plans only when ownership and interim controls are clear.
• Use effectiveness review as the formal closure decision point.
• If you're accountable for more than one organisation, start each week in the Control Tower for the cross-organisation picture, then switch into whichever one needs work.

Director

• Monitor repeated themes, overdue actions, and unresolved group risks.
• Challenge sites where evidence quality is weak or updates are stale.
• Use trend visibility to decide where executive intervention is required.

Manager

• Keep issue descriptions specific and operationally accurate.
• Update actions with evidence, not reassurance-only commentary.
• Escalate blockers early when dates or dependencies shift.

Troubleshooting

Common friction points and the fastest recovery path.

An issue cannot be closed confidently.

Check whether the remediation actions are merely marked complete or whether an effectiveness review has actually been recorded with residual risk and outcome.

Evidence exists, but teams struggle to retrieve it quickly.

Review naming, ownership, and whether the document is linked to the relevant issue, bundle, or workflow. Retrieval speed is a governance quality problem, not just a filing problem.

A manager says they cannot see the provider they should manage.

Confirm the user is assigned to the correct provider, then recheck their role and any impersonation/session context before changing permissions.

A manager can't see issues from another service.

This is by design. If the manager has been assigned to specific services, they can only see data for those services. The NI can grant access to additional services from Organisation → Team → Change homes.

The NI wants a manager to see all services temporarily.

Untick all of the manager's homes in Organisation → Team → Change homes. With no specific services assigned, they'll see all services within the provider. Re-assign them when the temporary access is no longer needed.

Inspection mode feels disruptive.

Rehearse who retrieves evidence, who answers governance questions, and which records should remain read-only. Inspection mode should protect integrity, not create confusion.

An organisation has disappeared from an NI/RI's Control Tower.

That organisation has ended the engagement (or the NI/RI left it). This is by design — access is granted per organisation and revoked the same way. The engagement history is still recorded; the live data is not. If it was a mistake, the organisation can re-send the engagement from Organisation → NI/RI Engagements.

An NI/RI can't switch to an organisation they expect to see.

The 'Active organisation' switcher only lists organisations where the engagement is Active. Check Account → Engagements: a pending engagement needs accepting first, and a declined or ended one needs the organisation to re-send it.

An organisation can't engage an external NI/RI.

Either that organisation has turned off 'Allow this organisation to engage an NI/RI who also works elsewhere' in Organisation → Settings, or the NI/RI's own primary organisation has. Both must allow it.

FAQ

Does AssuraFlow make compliance decisions for the provider?

No. The platform supports governance workflows, evidence readiness, and structured oversight. Decisions remain with the provider leadership team and NI/RI.

Can the platform support multi-site groups without mixing data?

Yes. Provider records remain separated while group leadership can review patterns, escalations, and readiness themes at the right oversight level.

Can managers be restricted to only see their own service?

Yes. The NI, RI, or admin can assign managers to specific services. Once assigned, they only see governance data for those services. NIs, RIs, and Directors always see all services.

How many services can one organisation run in AssuraFlow?

Starter and Growth cover one registered service. More than one registered service under one account, with a group dashboard across them, is part of the Enterprise plan. An NI/RI accountable to several separate organisations sees them all in the Control Tower, whatever plan each organisation is on.

Compare plans

Can one NI or RI be accountable for several separate organisations?

Yes. An organisation engages the NI/RI by email from Organisation → NI/RI Engagements; the NI/RI accepts from Account → Engagements. That organisation then appears in the NI/RI's Control Tower — a live cross-organisation roll-up of open issues, overdue actions, audits in progress, and visits due — alongside any others. One click switches into an organisation to work on its records. Each organisation grants and ends the engagement independently.

What does it cost the NI or RI to work across several organisations?

Nothing: each organisation pays for its own plan.

What happens to the data when an engagement ends?

Each organisation always owns its own governance records. The NI/RI's Control Tower is computed live per request and never copied into a personal store, so when an organisation ends the engagement its data disappears from that NI/RI's view immediately. Only the fact that the engagement started and ended is kept, in the audit trail.

What should be reviewed every week by the NI?

Open high-risk issues, overdue remediation actions, recent evidence gaps, pending approvals, and whether any closed issues still lack effectiveness review discipline.

How do I get my existing data into AssuraFlow?

Three options: 1) CSV Import — upload spreadsheets via the Connectors page. 2) Source System Integration — connect your source system via webhook for automatic data flow (Growth and Enterprise plans). 3) Manual Entry — create records directly in the platform. Enterprise customers get assisted migration.

Which source systems can I connect?

Any system with webhook, API, or CSV export capability. No SDK required.

Can I have multiple NIs managing different services?

Yes. Your Organisation Admin can assign each NI or RI to specific services. NI 'A' only sees their assigned services — they cannot see NI 'B's services. This is ideal for large organisations with services under different regulators.

What settings can I configure per service?

Each service has: regulator (CQC/Ofsted/CIW/Care Inspectorate/RQIA), service type (Residential/Nursing/Children's/etc.), capacity, registration ID, address, registered manager, and assigned NI/RI. The regulator determines whether the service uses 'Nominated Individual' or 'Responsible Individual' terminology. CQC and Ofsted mappings are fully verified; CIW, Care Inspectorate, and RQIA reference-code mappings are live but flagged pending final compliance review — check the current status for your regulator before relying on the generated reference list unsupervised.

What happens when an NI or RI leaves?

AssuraFlow has a formal handover process. The outgoing NI/RI signs off the governance state, the incoming NI/RI reviews and accepts, and role-appointment history keeps a permanent, queryable record of who held the NI/RI/Manager role and when — not just the offboarding moment. The full transition is recorded in the audit trail with electronic signatures. No governance data is lost. This is your organisation's own governance-continuity record — it doesn't replace the separate statutory notification you must still send to your regulator (e.g. CQC's Regulation 15 'Notice of changes') when your Nominated or Responsible Individual changes.

When should inspection mode be used?

When the provider needs to preserve governance-record integrity during an active inspection or equivalent high-scrutiny event where read-only access is safer than live editing.

Is there a mobile app?

An Android phone app is in pilot and not yet in an app store; an iPhone app is to follow. Setting it up is covered in the guide above.

What it covers, in the pricing FAQ

Can we build our own audit templates, or are we limited to the defaults?

You can build your own. The template builder supports sections, question types including multiple-choice, evidence rules, and required/critical flags, and templates can be published or cloned across services.

How does policy management and staff acknowledgement tracking work?

Policies are versioned and move through Draft, Published, and Archived states. Staff acknowledgement tracking starts the moment a policy is published, and a completion-percentage rollup shows who has and hasn't acknowledged it. Archiving a policy preserves its acknowledgement evidence rather than deleting it.

Does escalation happen automatically, or do I have to chase issues myself?

Both, by design. A scheduled sweep automatically escalates unacknowledged critical or high-severity issues and overdue remediation actions to the accountable person, so nothing relies purely on someone remembering to chase it. Acting on an item before the sweep runs simply prevents the escalation.

Do you support dark mode or other accessibility options?

Yes. The dashboard supports Light, Dark, and System themes, switchable from the sidebar on any page, including keyboard and screen-reader accessible controls.

Is support available outside office hours?

The AI support desk answers at any time; sensitive topics such as safeguarding, data protection and contract questions are passed to a person to follow up.

Support on each plan

How do you handle personal allowances or residents'/service users' money?

Each person has a running allowance balance that updates with every deposit, withdrawal, or purchase — reversible cleanly if a record is deleted, so the balance is never left wrong. A transaction over a threshold you configure, or too many in a short window, is flagged for review automatically. Receipts attach to individual transactions, and a monthly reconciliation is stamped and attributed to whoever confirmed it.

How does AssuraFlow know which incidents need reporting to my regulator?

Incidents are auto-classified from what's written — falls, medication errors, safeguarding concerns, injuries, property damage, near misses — and given a statutory notification deadline based on that classification's severity, escalated automatically if it's missed. Regulator-specific notification guidance is shown alongside it: verified for CQC today, with every other regulator's guidance clearly flagged as pending compliance review rather than guessed at.

Can the AI create governance issues or actions on its own?

No. The AI assistant — whether drafting from a chat conversation or triggered by a recurring incident/risk pattern crossing a threshold you set — only ever produces a draft proposal. Governance issues, remediation actions, and standalone tasks are permanently excluded from auto-execution by design; an NI/RI always reviews and approves before anything becomes a real record.

Can I redact personal information before sharing an audit pack or export?

Yes, as an opt-in checkbox on the export — never applied silently. Redaction targets structured identifiers with a well-defined format: UK National Insurance number, NHS number (checksum-verified, not just any 10-digit run), email address, phone number, and postcode. It does not attempt to redact names or free-text addresses — no reliable detector for those exists, and claiming to catch them would be riskier than not offering the feature at all.

Does AssuraFlow support Ofsted's Regulation 44/45 visits?

Yes. Schedule the next independent-visitor review (Reg 44) or quality-of-care review (Reg 45) per service with your own cadence. Starting a visit runs the same checklist, evidence, and staged sign-off as any other audit template — tag a template as Ofsted-specific and it's ready to use. Once a visit is signed off, the next one on that cadence schedules itself automatically.

Need a tailored rollout or operating model?

Work with the AssuraFlow team on role mapping, provider setup, evidence ownership, and governance adoption sequencing.

Request implementation support View platform modules