Linkedin-in
(Guest)

LSCA End-Hirer's Audit Dashboard

Start, complete, revisit, analyse, store, print or send your essential Agency LSCA Audits by choosing from the menu below.

End-Hirer Agency Audit

Important Information

This section helps end-hirers assess the compliance, financial, and reputational risks linked to labour supply agencies — a critical control area ahead of HMRC’s 2026 legislation introducing Joint and Several Liability (JSL) for umbrella tax non-compliance.

Under the new strict liability regime, end-hirers may be held financially liable for unpaid PAYE/NICs even if the breach occurs further down the chain.

By verifying agency legitimacy, ownership history, affiliations with umbrella companies, and audit controls, end-hirers can detect signs of phoenixing, tax avoidance structures, or links to non-compliant umbrellas.

These checks are essential to demonstrate “reasonable prevention procedures” under the Criminal Finances Act 2017, meet Modern Slavery Act obligations, and maintain defensible oversight under the new 2026 supply chain compliance framework.

Evidence Expectations

In an HMRC audit, superficial responses will not meet compliance standards.

Agencies may be asked to provide:

  • Contracts, KIDs, onboarding scripts, pay breakdowns
  • Risk assessments, IR35/SDS logs, onboarding due diligence
  • Third-party audit outcomes, governance records, and escalation logs
  • Mini umbrella red flag checks, VAT/Kittel assurance, and group structure disclosures

By using the form, you acknowledge acceptance of OPRaaS LTD’s data handling policies and terms and conditions of use.

info@opraas.co.uk

User and Company Details

Please enter the company details for the entity you are auditing.  If you are performing a Self-Assessment, please insert your own company details here.

Section 1 – Corporate Legitimacy & Structure

This section ensures the agency or umbrella company is a legally constituted, active business with transparent trading identity and tax registrations.

Verifying incorporation, PAYE/VAT status, and ownership history enables the end-hirer to screen for shell companies, phoenixing, or fraudulent structures — key to meeting HMRC supply chain assurance duties and due diligence expectations.

Corporate Legitimacy & Structure

001. Is the agency/umbrella registered at Companies House with up-to-date details and a consistent trading name across all documents? — Justification: Confirms legal trading status/identity. Red flag: inconsistent names across CH/invoices/payslips; dormant but trading; overdue filings.

Select answer

Upload evidence for HMRC

CH certificate & live snapshot; specimen invoice/contract/payslip showing identical legal name.

Short reason if answered N/A

Comments / Notes (Optional)

Does the agency have senior management oversight of labour supply chain compliance (e.g. board/SMT reporting)?
- Justification: Oversight at senior level is required to demonstrate accountability and “reasonable prevention procedures” under CFA 2017.
Red Flags: No board/SMT reporting; compliance left to junior staff; no audit trail.

Select answer

Upload evidence for HMRC

Board/SMT reports; compliance meeting minutes

Short reason if answered N/A

Comments / Notes (Optional)

002. Have the agency's latest statutory accounts and corporation tax returns (CT600) been filed on time? — Justification: Demonstrates active trading and corporate compliance. Red flag: overdue/qualified accounts; “micro” yet large headcount; going-concern warnings.

Select answer

Upload evidence for HMRC

Filed accounts on CH; CT600 acknowledgment (redacted).

Short reason if answered N/A

Comments / Notes (Optional)

003. Is the agency's VAT registration valid, active and current? — Justification: Confirms VAT compliance; reduces denied-VAT risk. Red flag: deregistered or mismatched VAT; VIES “invalid/unknown”; frequent VAT number changes.

Select answer

Upload evidence for HMRC

VAT certificate; recent VAT return/Gateway screenshot; VIES check log.

Short reason if answered N/A

Comments / Notes (Optional)

004. Is a PAYE scheme registered and active in the same legal name that employs/pays workers? — Justification: Validates PAYE/NIC remittance. Red flag: PAYE in a different entity; RTI submitted by another company; “pending registration.”

Select answer

Upload evidence for HMRC

HMRC PAYE reference letter/screenshot; sample RTI header.

Short reason if answered N/A

Comments / Notes (Optional)

005. Have all the agency's Persons with Significant Control (PSCs) been verified for identity and legitimacy? — Justification: Confirms transparent ownership. Red flag: nominee/opaque trusts; unverified IDs; overseas/PO-box PSC.

Select answer

Upload evidence for HMRC

PSC register extract; KYC/ID checks (redacted).

Short reason if answered N/A

Comments / Notes (Optional)

006. Are any agency PSCs/directors linked to dissolved, struck-off, or non-compliant entities? — Justification: Screens phoenix/fraud history. Red flag: multiple struck-off companies; common addresses/agents; repeat patterns.

Select answer

Upload evidence for HMRC

CH officer history search; adverse-media report.

Short reason if answered N/A

Comments / Notes (Optional)

007. Are agency directors free from disqualification/insolvency/financial misconduct? — Justification: Ensures fitness to run a UK company. Red flag: current/previous disqualification; bankruptcy/IVA; court orders.

Select answer

Upload evidence for HMRC

CH disqualified register check; credit/adverse-media report.

Short reason if answered N/A

Comments / Notes (Optional)

008. Has the agency/umbrella confirmed no mini-umbrella structures (MUCs) are used? — Justification: Prevents artificial splitting to exploit NIC/VAT reliefs. Red flag: clusters of small new companies at same address/agent; rapid worker moves between entities.

Select answer

Upload evidence for HMRC

Written attestation; internal supplier/worker mapping review.

Short reason if answered N/A

Comments / Notes (Optional)

009. Are agency compliance overrides (where applicable) logged and independently reviewed? — Justification: Proves exceptions are controlled. Red flag: manual net-pay uplifts/off-cycle payments without sign-off.

Select answer

Upload evidence for HMRC

Exception/override log; independent/NED review minutes.

Short reason if answered N/A

Comments / Notes (Optional)

010. Is the agency business accredited (REC/APSCo) and in good standing? — Justification: Indicates external oversight and periodic audits. Red flag: expired/unverifiable membership; logo use without certificate.

Select answer

Upload evidence for HMRC

Membership certificate; validation email/screenshot with expiry.

Short reason if answered N/A

Comments / Notes (Optional)

011. Are directors/PSCs linked to open HMRC/FCA/GLAA investigations across connected entities? — Justification: Surfaces unresolved enforcement risk. Red flag: refusal to disclose; “ongoing but confidential.”

Select answer

Upload evidence for HMRC

Regulatory disclosure statement; redacted correspondence if any.

Short reason if answered N/A

Comments / Notes (Optional)

012. Are trading bank accounts in the exact legal entity name and verified by Confirmation of Payee (CoP)? — Justification: Blocks third-party/diverted payments and phoenix risk. Red flag: payments to third-party/overseas IBAN; CoP mismatch.

Select answer

Upload evidence for HMRC

Bank letter/void cheque; CoP screenshot; payroll pay-in details.

Short reason if answered N/A

Comments / Notes (Optional)

013. Are UBO/PSCs screened for sanctions/PEP/adverse media with dated results? — Justification: Detects hidden control/overseas influence. Red flag: positive hits unresolved; screening older than 12 months.

Select answer

Upload evidence for HMRC

Sanctions/PEP screening report; PSC register; dated log.

Short reason if answered N/A

Comments / Notes (Optional)

014. Is a group/ownership structure published showing any connected umbrellas/payroll providers? — Justification: Reveals related-party/round-tripping risk. Red flag: undisclosed connected umbrella or shared directors.

Select answer

Upload evidence for HMRC

Org chart; inter-company/service agreements.

Short reason if answered N/A

Comments / Notes (Optional)

015. Have CCJs, going-concern notes or HMRC Time-to-Pay agreements been disclosed in the last 24 months? — Justification: Indicates financial/compliance fragility. Red flag: multiple recent CCJs; undisclosed TTP; repeat arrears.

Select answer

Upload evidence for HMRC

Credit report; auditor note; HMRC TTP letter (redacted).

Short reason if answered N/A

Comments / Notes (Optional)

016. Do Corporate Criminal Offence (CFA 2017) prevention procedures exist (policy, risk assessment, training)? — Justification: Evidences “reasonable prevention procedures.” Red flag: no policy/training/incident log.

Select answer

Upload evidence for HMRC

CCO policy; risk assessment; training logs; incident register.

Short reason if answered N/A

Comments / Notes (Optional)

Section 2 – Right to Work, Contracts & Onboarding

Section Justification (End-Hirer View):

To ensure all labour supplied into your business has been onboarded lawfully and transparently by the agency and any umbrella employers involved.

Failures in this area can lead to illegal working, employment rights breaches, and significant liabilities under:

  • Immigration, Asylum and Nationality Act 2006
  • Employment Rights Act 1996
  • Criminal Finances Act 2017
  • Modern Slavery Act 2015
  • Joint & Several Liability reforms (2026

Right to Work, Contracts & Onboarding

001. Has your agency conducted Right to Work (RTW) checks for all workers before assignment? — Justification: Required by law; prevents illegal working and civil penalties. Red flag: checks done after start date, undated copies, uncertified screenshots, expired visas.

Select answer

Upload evidence for HMRC

Dated RTW copies (passport/visa), check record, RTW audit log.

Short reason if answered N/A

Comments / Notes (Optional)

002. Has your agency confirmed that umbrella companies also perform RTW checks and retain records? — Justification: Umbrella is legal employer; liability can still touch the end-hirer. Red flag: “We rely on agency checks only”; no sample evidence from umbrella.

Select answer

Upload evidence for HMRC

Written confirmation; sample RTW records from umbrella; audit trail.

Short reason if answered N/A

Comments / Notes (Optional)

003. Are worker IDs, NI numbers, and bank details verified before onboarding? — Justification: Prevents identity/payroll fraud and reduces modern slavery risk. Red flag: shared bank accounts across multiple workers; unverifiable NI numbers.

Select answer

Upload evidence for HMRC

Onboarding checklist; ID/NI verification; fraud-screen logs.

Short reason if answered N/A

Comments / Notes (Optional)

004. Are signed contracts in place between the agency and worker before assignment? — Justification: Ensures lawful engagement and clarity on terms. Red flag: unsigned PDFs; signatures after start; terms missing pay/deductions.

Select answer

Upload evidence for HMRC

Signed contracts (digital/physical) + e-sign audit trail; templates.

Short reason if answered N/A

Comments / Notes (Optional)

005. For umbrella workers, does the agency verify the umbrella has issued a compliant employment contract? — Justification: Confirms employee status and statutory rights. Red flag: “assignment schedule only”; zero mention of holiday pay, AWR, or statutory deductions.

Select answer

Upload evidence for HMRC

Sample umbrella contracts; compliance confirmation.

Short reason if answered N/A

Comments / Notes (Optional)

006. Has the agency documented how the worker is paid (PAYE, umbrella PAYE, CIS)? — Justification: Clarifies status, prevents misclassification, ensures correct tax treatment. Red flag: model not stated; switch between models mid-assignment without audit.

Select answer

Upload evidence for HMRC

Onboarding form; status declaration; payroll records.

Short reason if answered N/A

Comments / Notes (Optional)

007. Are assignment details (role, rate, hours, location) captured and retained for each worker? — Justification: Enables auditability and lawful pay. Red flag: rate emails missing; verbal bookings only; missing location/hours for NMW checks.

Select answer

Upload evidence for HMRC

Assignment schedules; rate confirmations; booking confirmations.

Short reason if answered N/A

Comments / Notes (Optional)

008. Does the agency prohibit non-compliant umbrella models (offshore, loans, unlawful salary-sacrifice)? — Justification: Protects against disguised remuneration and JSL exposure. Red flag: marketing of loan/expenses models; no approved-supplier list.

Select answer

Upload evidence for HMRC

Due-diligence policy; signed declarations; umbrella vetting results.

Short reason if answered N/A

Comments / Notes (Optional)

009. Are RTW/onboarding details re-verified for re-engaged or long-term workers? — Justification: RTW may expire; roles/rates can change. Red flag: long assignments with no repeat checks; expired visas still on file.

Select answer

Upload evidence for HMRC

Re-check log; updated assignment letters/contracts.

Short reason if answered N/A

Comments / Notes (Optional)

010. Does the agency have a written onboarding & compliance policy (RTW, contracts, umbrella checks, worker status)? — Justification: Demonstrates structured due diligence and CFA 2017 compliance. Red flag: undocumented practices; staff unaware of policy.

Select answer

Upload evidence for HMRC

Policy document; staff training logs; process maps.

Short reason if answered N/A

Comments / Notes (Optional)

011. If using a digital IDSP, is it certified and are identity-check logs retained? — Justification: Ensures Home Office compliant RTW. Red flag: non-certified provider; no evidence of liveness/validity checks.

Select answer

Upload evidence for HMRC

IDSP certification; audit trail/screenshots; sample checks.

Short reason if answered N/A

Comments / Notes (Optional)

012. Are duplicate worker bank accounts (same sort/account across multiple workers) flagged before first payment? — Justification: Detects coercion/mini-umbrella skimming. Red flag: repeated pay-to accounts; ignored alerts.

Select answer

Upload evidence for HMRC

Payroll analytics report; exception log; remediation notes.

Short reason if answered N/A

Comments / Notes (Optional)

013. Is an Umbrella Due-Diligence Pack required before first assignment (PAYE reg., insurances, sample payslips, RTI proof)? — Justification: Front-loads risk control under JSL/CCO. Red flag: workers placed before vetting; missing RTI/AE evidence.

Select answer

Upload evidence for HMRC

Pack checklist; received documents; approval record.

Short reason if answered N/A

Comments / Notes (Optional)

014. Do worker Key Information Documents (KIDs) clearly explain the pay model for the assignment (e.g., charge/assignment rate vs pay rate, statutory deductions, umbrella margin) and are the example pay illustrations consistent with the rate that was confirmed to the worker? — Justification: Prevents mis-selling and unlawful deductions. KIDs are illustrative, not exact rates, so the worked example must transparently show how the confirmed rate converts to pay. Red flags: KID issued after start date; KID example uses a notional rate that doesn’t align with the rate confirmation; missing/obscure employer costs or umbrella margin; rolled-up holiday shown as basic pay; KID refers only to an “umbrella rate” without explaining the worker’s pay rate.

Select answer

Upload evidence for HMRC

Sample KIDs (time-/date-stamped before assignment), rate confirmations/booking forms, KID vs rate comparison note, version-control log, worker acknowledgements, example pay calc sheets; (optional) spot check of first payslip against KID illustration for reasonableness.

Short reason if answered N/A

Comments / Notes (Optional)

Section 3 – PAYE & Payroll Compliance

This section ensures that all parties in the labour supply chain — agencies and umbrella companies — comply with UK payroll, PAYE, and wage legislation.

It helps end-hirers detect misclassification, unlawful deductions, underpayment of holiday, or use of disguised remuneration models.

Regular auditing of payroll records ensures:

  • Workers receive correct pay in line with contractual terms and NMW/NLW
  • All deductions (tax, NI, pensions) are correctly calculated and remitted to HMRC
  • Holiday pay is correctly accrued, calculated, and itemised
  • Payroll is transparent, auditable, and GDPR compliant.

Failure to monitor payroll exposes end-hirers to liability under:

  • Criminal Finances Act 2017
  • National Minimum Wage Regulations 2015
  • Modern Slavery Act 2015
  • Joint & Several Liability reforms (2026)

PAYE & Payroll Compliance

001. Are agency /umbrella workers provided with up-to-date employment contracts or terms that comply with PAYE rules? — Justification: Confirms lawful engagement; avoids misclassification/NMW breaches. Red flags: missing/late/unsigned contracts; umbrella “employment” issued after start; terms inconsistent with booking/KID.

Select answer

Upload evidence for HMRC

Signed contracts; assignment schedules; KIDs.

Short reason if answered N/A

Comments / Notes (Optional)

002. Is payroll documentation stored securely and accessible for audit? — Justification: Ensures GDPR compliance and audit readiness. Red flags: can’t retrieve source files; uncontrolled access; no audit trail.

Select answer

Upload evidence for HMRC

Data access policy; DPA/ISO statement; access/request logs.

Short reason if answered N/A

Comments / Notes (Optional)

003. Is payroll documentation reviewed and updated regularly? — Justification: Shows controls track legal/finance changes. Red flags: outdated policies; no review/version control.

Select answer

Upload evidence for HMRC

Policy register; change log; review minutes.

Short reason if answered N/A

Comments / Notes (Optional)

004. Are payslips available for audit on request? — Justification: Verifies gross-to-net in practice. Red flags: refusal to share; no itemisation; “other” deductions unexplained.

Select answer

Upload evidence for HMRC

Payslip samples (blinded).

Short reason if answered N/A

Comments / Notes (Optional)

005. Are RTI submissions available for audit on request? — Justification: Confirms PAYE/NICs reported to HMRC. Red flags: late/missing FPS/EPS; totals don’t match payroll.

Select answer

Upload evidence for HMRC

RTI logs; HMRC Gateway screenshots.

Short reason if answered N/A

Comments / Notes (Optional)

006. Are payroll summaries available for audit on request? — Justification: Provides consolidated compliance view. Red flags: ad-hoc spreadsheets only; totals don’t agree to RTI.

Select answer

Upload evidence for HMRC

Period payroll reports; reconciliation logs.

Short reason if answered N/A

Comments / Notes (Optional)

007. Are BACs payment confirmations available for audit on request? — Justification: Proves nets on payslips were actually paid. Red flags: third-party accounts/prepaid cards; split payments not on payslip.

Select answer

Upload evidence for HMRC

BACs/SEPA files; bank remittances.

Short reason if answered N/A

Comments / Notes (Optional)

008. Is there a three-way reconciliation each pay period (timesheets → payslips → BACs)? — Justification: Confirms paid exactly what was calculated. Red flags: hours/value mismatches; negative/duplicate nets; manual overrides.

Select answer

Upload evidence for HMRC

Reconciliation worksheet; sample timesheets; BACs file.

Short reason if answered N/A

Comments / Notes (Optional)

009. Are salary-sacrifice/salary-exchange arrangements controlled (written variation, OpRA, NMW floor test, allowed benefits only)? — Justification: Closes disguised-remuneration loopholes. Red flags: sacrifice pushes below NMW; no employee consent; non-qualifying benefits.

Select answer

Upload evidence for HMRC

Policy; signed elections; OpRA/NMW checks.

Short reason if answered N/A

Comments / Notes (Optional)

010. Are RTI timeliness/exceptions monitored (late FPS/EPS, re-subs, alignment issues) with corrective actions? — Justification: Validates true PAYE reporting. Red flags: persistent lateness; unexplained re-subs; alignment failures.

Select answer

Upload evidence for HMRC

Exception reports; HMRC acceptance receipts; CAPA log.

Short reason if answered N/A

Comments / Notes (Optional)

011. Are deductions (tax, NI, pension) correctly calculated and submitted to HMRC? — Justification: Confirms PAYE/NIC compliance. Red flags: arrears/Time-to-Pay; net-to-gross anomalies; control-account dumps.

Select answer

Upload evidence for HMRC

Deduction ledgers; RTI; HMRC statements.

Short reason if answered N/A

Comments / Notes (Optional)

012. Are advertised/contracted rates cross-checked against actual payslips? — Justification: Detects hidden deductions/uplifts. Red flags: admin/umbrella fees added later; “workplace costs”; rate drift.

Select answer

Upload evidence for HMRC

Rate confirmations vs payslip sample; audit worksheet.

Short reason if answered N/A

Comments / Notes (Optional)

013. Does the agency/umbrella check that NMW/NLW is correctly applied? — Justification: Prevents unlawful underpayment. Red flags: deductions/expenses take net below NMW; work time excluded; day-rate masking hours.

Select answer

Upload evidence for HMRC

NMW audit; rate validation tool/worksheet.

Short reason if answered N/A

Comments / Notes (Optional)

014. Is pension auto-enrolment applied with lawful postponement/opt-out handling? — Justification: Confirms Pensions Act 2008 compliance. Red flags: day-1 “opt-outs”; repeated postponement; missed contributions.

Select answer

Upload evidence for HMRC

AE letters; assessment reports; provider confirmations.

Short reason if answered N/A

Comments / Notes (Optional)

015. Are pension AE files & payment confirmations retained and reconciled monthly? — Justification: Avoids arrears and regulator risk. Red flags: unpaid schedules; differences vs payroll.

Select answer

Upload evidence for HMRC

Contribution schedules; provider receipts; reconciliation log.

Short reason if answered N/A

Comments / Notes (Optional)

016. Is holiday pay compliant with current WTR (correct method for worker type; rolled-up only where lawful and clearly itemised)? — Justification: Aligns with current rules; reduces tribunal risk. Red flags: rolled-up without itemisation; wrong method (e.g., 12.07% on regular hours).

Select answer

Upload evidence for HMRC

Holiday policy/addendum; calc method; itemised payslips.

Short reason if answered N/A

Comments / Notes (Optional)

017. Where applicable, is the correct 52-week reference period used? — Justification: Required for regular-hours workers; fairness/accuracy. Red flags: flat % used where reference needed; no records.

Select answer

Upload evidence for HMRC

Reference-period logs; sample calculations.

Short reason if answered N/A

Comments / Notes (Optional)

018. Is holiday pay itemised separately from basic pay/expenses on payslips? — Justification: Prevents unlawful rolled-up pay. Red flags: holiday included as basic; “holiday pot” deductions with no entitlement record.

Select answer

Upload evidence for HMRC

Payslip breakdowns; ledger mapping.

Short reason if answered N/A

Comments / Notes (Optional)

019. Are workers informed of their holiday entitlement and encouraged to take leave? — Justification: Supports wellbeing; mitigates claims. Red flags: no comms; no leave records for long periods.

Select answer

Upload evidence for HMRC

Onboarding/HR comms; leave records.

Short reason if answered N/A

Comments / Notes (Optional)

020. Has the agency’s payroll been independently audited in the last 12 months? — Justification: Confirms currency of controls. Red flags: no audit; scope excludes NMW/holiday/RTI.

Select answer

Upload evidence for HMRC

Independent payroll audit report; letter of findings.

Short reason if answered N/A

Comments / Notes (Optional)

021. Does the agency/umbrella provide evidence of payroll compliance (incl. NMW, holiday pay, lawful deductions)? — Justification: Deters disguised remuneration and exploitation. Red flags: selective samples; refusal to provide umbrella packs.

Select answer

Upload evidence for HMRC

Umbrella audit pack; payslip/RTI samples; attestations.

Short reason if answered N/A

Comments / Notes (Optional)

022. Are audit findings shared with the end-hirer and breaches escalated/addressed? — Justification: Ensures oversight and remediation. Red flags: repeat findings; overdue actions; no CAPA tracking.

Select answer

Upload evidence for HMRC

Findings register; CAPA plan; closure evidence.

Short reason if answered N/A

Comments / Notes (Optional)

023. Does the end-hirer receive confirmation that umbrella workers are paid legal rates and deductions are compliant? — Justification: Fulfils due diligence under CFA 2017. Red flags: generic statements with no evidence tie-out.

Select answer

Upload evidence for HMRC

Compliance statements; payslip/RTI tie-out sample.

Short reason if answered N/A

Comments / Notes (Optional)

024. Are escalation protocols in place for underpayment, fraud, or payroll risks? — Justification: Provides a route to protect workers/end-hirer. Red flags: no whistleblowing/escalation path; unresolved incidents.

Select answer

Upload evidence for HMRC

Escalation SOP; incident & resolution logs.

Short reason if answered N/A

Comments / Notes (Optional)

025. Do you maintain a list of pre-approved umbrellas (based on audits or accreditations)? — Justification: Ensures only vetted umbrellas are engaged. Red flags: using non-approved umbrellas; expired/withdrawn accreditations.

Select answer

Upload evidence for HMRC

Approved list; accreditation proof; onboarding checks.

Short reason if answered N/A

Comments / Notes (Optional)

Section 4 – CIS Compliance

End-hirers have a legal duty to exercise oversight over labour supply chains using the Construction Industry Scheme (CIS).

Failure to ensure correct CIS treatment — whether by agencies or umbrella intermediaries — can result in:

  • Tax loss liability under the Kittel principle or Criminal Finances Act 2017
  • Onshore Intermediaries Reporting failures
  • Exposure under 2026 Joint and Several Liability reforms (JSL)

This section confirms CIS deductions, worker verification, status assessments, and reporting are compliant at all tiers of the supply chain.

CIS Compliance

001. Are UTRs and CIS status (verified/unverified) confirmed for all CIS workers? — Justification: Verifies correct tax treatment and prevents hidden risk. Red flags: workers paid without UTR; unverifiable UTRs; bulk “verified” with no logs.

Select answer

Upload evidence for HMRC

UTR checks/lookup logs; CIS verification reports.

Short reason if answered N/A

Comments / Notes (Optional)

002. Are HMRC verification numbers retained for each subcontractor and rate (0/20/30%)? — Justification: Proves correct rate application. Red flags: missing/duplicate verification numbers; generic screenshots.

Select answer

Upload evidence for HMRC

HMRC verification printouts; audit trail.

Short reason if answered N/A

Comments / Notes (Optional)

003. Are gross-status (0%) subcontractors reviewed quarterly for continuing eligibility? — Justification: Prevents status drift/under-deduction. Red flags: gross status left unchecked >3 months; no re-verification.

Select answer

Upload evidence for HMRC

Review log; HMRC re-verification evidence.

Short reason if answered N/A

Comments / Notes (Optional)

004. Have subcontractor contracts been reviewed for SDC/self-employment clauses? — Justification: Ensures status clarity is built into contracts. Red flags: missing SDC language; umbrella templates reused for CIS.

Select answer

Upload evidence for HMRC

Annotated contracts; legal review notes.

Short reason if answered N/A

Comments / Notes (Optional)

005. Do CIS contracts include substitution rights and no mutual obligation (no-MOO)? — Justification: Confirms genuine self-employment. Red flags: exclusivity/MOO; control clauses.

Select answer

Upload evidence for HMRC

Sample contracts with substitution/no-MOO clauses.

Short reason if answered N/A

Comments / Notes (Optional)

006. Are SDC assessments (e.g., CEST) completed at assignment start and re-reviewed if roles change? — Justification: Prevents misclassification and creates audit trail. Red flags: copy-paste CEST; no re-assessment after role change.

Select answer

Upload evidence for HMRC

CEST outputs; signed assessments; review updates.

Short reason if answered N/A

Comments / Notes (Optional)

007. Is SDC/self-employment documentation shared with the end-hirer during onboarding? — Justification: Keeps end-hirer aware of risk/status. Red flags: end-hirer not provided with SDC pack.

Select answer

Upload evidence for HMRC

Worker SDC summaries; onboarding packs.

Short reason if answered N/A

Comments / Notes (Optional)

008. Does the agency/umbrella maintain a written SDC/self-employment policy and share it? — Justification: Promotes consistency and governance. Red flags: undocumented practice; staff unaware.

Select answer

Upload evidence for HMRC

Policy docs; flowcharts; training records.

Short reason if answered N/A

Comments / Notes (Optional)

009. Are CIS deductions (20% verified / 30% unverified) applied accurately to all CIS workers? — Justification: Prevents under-deductions/secondary liability. Red flags: uniform 20% rate; mis-rated workers.

Select answer

Upload evidence for HMRC

Verification checks; deduction summaries; status logs.

Short reason if answered N/A

Comments / Notes (Optional)

010. Are invoices, payment records, BACs and CIS deductions provided for audit? — Justification: Enables traceability/anomaly detection. Red flags: third-party payers; missing BACs evidence.

Select answer

Upload evidence for HMRC

Invoices; BACs proof; deduction ledgers.

Short reason if answered N/A

Comments / Notes (Optional)

011. Are monthly CIS300 returns accessible for end-hirer review? — Justification: Validates declared deductions. Red flags: refusal to share; totals don’t reconcile.

Select answer

Upload evidence for HMRC

CIS300 submissions; HMRC confirmations.

Short reason if answered N/A

Comments / Notes (Optional)

012. Does the agency/umbrella share reconciliation summaries (gross pay, tax deducted, HMRC reported)? — Justification: Confirms alignment between payroll and HMRC. Red flags: large reconciling items; unreconciled periods.

Select answer

Upload evidence for HMRC

Reconciliation reports; payment audit extracts.

Short reason if answered N/A

Comments / Notes (Optional)

013. Are monthly/quarterly audit packs (UTRs, status, deductions) made available? — Justification: Demonstrates ongoing due diligence. Red flags: one-off onboarding pack only.

Select answer

Upload evidence for HMRC

Audit packs; reconciliation logs.

Short reason if answered N/A

Comments / Notes (Optional)

014. Do contractor invoices split labour vs materials/plant clearly and align with CIS & VAT DRC treatment? — Justification: Avoids CIS/VAT overlap errors. Red flags: single line items; DRC not applied when required.

Select answer

Upload evidence for HMRC

Invoice samples; policy for splits; internal review notes.

Short reason if answered N/A

Comments / Notes (Optional)

015. Where self-billing is used, are agreements in place and reviewed annually? — Justification: HMRC requirement; prevents invoice fraud. Red flags: expired/no agreement; unilateral rate changes.

Select answer

Upload evidence for HMRC

Self-billing agreements; annual review log.

Short reason if answered N/A

Comments / Notes (Optional)

016. Are CIS suffered/deducted reconciled monthly to CIS300 and HMRC payment receipts? — Justification: Ensures figures actually paid. Red flags: ledger ≠ CIS300; late payments.

Select answer

Upload evidence for HMRC

CIS300; HMRC payment confirmations; ledger reconciliation.

Short reason if answered N/A

Comments / Notes (Optional)

017. Has the umbrella’s UTR been confirmed as valid and CIS-registered? — Justification: Confirms intermediary legitimacy. Red flags: trading as unregistered PAYE umbrella under CIS.

Select answer

Upload evidence for HMRC

UTR confirmation; CIS300 in umbrella name.

Short reason if answered N/A

Comments / Notes (Optional)

018. Is documentation provided confirming worker CIS status, deduction rate and umbrella UTR? — Justification: Ensures correct treatment for umbrella-supplied CIS workers. Red flags: unknown umbrella UTR; missing status letters.

Select answer

Upload evidence for HMRC

Deduction summaries; CIS status letters.

Short reason if answered N/A

Comments / Notes (Optional)

019. Does the umbrella make accurate CIS deductions and file CIS300 returns? — Justification: Prevents tax fraud; mitigates JSL exposure. Red flags: mismatch vs BACs; late/missed CIS300.

Select answer

Upload evidence for HMRC

Umbrella declarations; HMRC receipts.

Short reason if answered N/A

Comments / Notes (Optional)

020. Are CIS300 returns from umbrella companies shared with the end-hirer? — Justification: Enables audit traceability. Red flags: only summary spreadsheets.

Select answer

Upload evidence for HMRC

CIS300 submissions; cover emails.

Short reason if answered N/A

Comments / Notes (Optional)

021. Are umbrella contracts reviewed for substitution/no-mutuality clauses? — Justification: Confirms genuine status. Red flags: employee-style T&Cs for CIS.

Select answer

Upload evidence for HMRC

Umbrella CIS contracts; legal review notes.

Short reason if answered N/A

Comments / Notes (Optional)

022. Has the umbrella conducted SDC assessments and are they independently signed off? — Justification: Identifies false classification risk. Red flags: contractor self-declares; no review.

Select answer

Upload evidence for HMRC

CEST outputs; independent review forms.

Short reason if answered N/A

Comments / Notes (Optional)

023. Are SDC assessments re-reviewed when assignments extend or change? — Justification: Prevents status drift/misclassification. Red flags: extensions with no reassessment.

Select answer

Upload evidence for HMRC

Re-assessment logs; updated reviews.

Short reason if answered N/A

Comments / Notes (Optional)

024. Are umbrella SDC policies and validation summaries shared with the end-hirer? — Justification: Ensures process visibility. Red flags: policy “available on request” but never supplied.

Select answer

Upload evidence for HMRC

SDC policy; validation summary.

Short reason if answered N/A

Comments / Notes (Optional)

025. Does the umbrella comply with Onshore Intermediaries Legislation (EIRR)? — Justification: Ensures reporting of workers via intermediaries. Red flags: no EIRR submissions; data gaps.

Select answer

Upload evidence for HMRC

Submitted intermediary reports.

Short reason if answered N/A

Comments / Notes (Optional)

026. Are intermediary reports reconciled against onboarding and UTR data? — Justification: Validates report accuracy; prevents penalties. Red flags: EIRR workers with no onboarding/UTR match.

Select answer

Upload evidence for HMRC

Reconciliation logs; onboarding vs UTR match.

Short reason if answered N/A

Comments / Notes (Optional)

027. Has the agency confirmed whether CITB levy applies to its CIS supply chain? — Justification: Ensures levy obligations identified. Red flags: “not applicable” with no analysis.

Select answer

Upload evidence for HMRC

Written confirmation; levy applicability assessment.

Short reason if answered N/A

Comments / Notes (Optional)

028. Are CITB levy deductions calculated and applied correctly to CIS labour payments? — Justification: Prevents over/under-deduction and liability transfer. Red flags: flat % applied irrespective of trade/rate.

Select answer

Upload evidence for HMRC

Levy calculation logs; deduction summaries.

Short reason if answered N/A

Comments / Notes (Optional)

029. Has the agency submitted accurate CITB returns and made payments on time? — Justification: Demonstrates statutory compliance. Red flags: late/estimated returns; arrears.

Select answer

Upload evidence for HMRC

CITB return confirmations; payment receipts.

Short reason if answered N/A

Comments / Notes (Optional)

030. Does the agency provide the end-hirer with access to CITB levy reconciliation records? — Justification: Allows end-hirer to verify compliance. Red flags: totals don’t reconcile to payroll.

Select answer

Upload evidence for HMRC

Reconciliation reports; audit extracts.

Short reason if answered N/A

Comments / Notes (Optional)

031. Have any CITB audits/inspections been completed in the last 12 months, and were outcomes disclosed? — Justification: Provides transparency on historic risk. Red flags: adverse findings undisclosed.

Select answer

Upload evidence for HMRC

CITB audit reports; correspondence.

Short reason if answered N/A

Comments / Notes (Optional)

Section 5 – Expenses, Allowances & Lodging

This section ensures that all expense and allowance payments across the supply chain are lawful, transparent, and not misused to disguise remuneration.

Improper use of tax-free expenses (e.g., travel, subsistence, lodging) can breach HMRC rules, NMW thresholds, and create disguised remuneration risks.

End-hirers must confirm that:

  • Expenses are only paid where legally permitted (e.g., Working Rule Agreement (WRA), temporary workplace test)
  • All claims are evidenced with receipts, records, and reconciliations
  • Expense policies exclude unlawful practices (e.g., dispensations, flat-rate claims)
  • Lodging payments are compliant with HMRC/WRA criteria and properly documented.

Failure to assure this area may result in:

  • Breaches of National Minimum Wage Regulations 2015
  • PAYE/NIC non-compliance
  • Criminal Finances Act 2017 liability
  • Joint & Several Liability exposure (2026)

Expenses, Allowances & Lodging

001. Does the agency/umbrella have a written expenses policy for PAYE workers? — Justification: Ensures lawful, transparent treatment of expenses; avoids disguised remuneration. Red flags: “policy in draft”, staff unaware; policy not issued to workers.

Select answer

Upload evidence for HMRC

Policy document; onboarding packs.

Short reason if answered N/A

Comments / Notes (Optional)

002. Are dispensations / flat-rate claims expressly prohibited in policy and training? — Justification: Prevents legacy misuse (abolished 2016). Red flags: references to dispensations; fixed weekly “expense” amounts.

Select answer

Upload evidence for HMRC

Policy; training slide; signed staff attestation.

Short reason if answered N/A

Comments / Notes (Optional)

003. Is there a documented approval hierarchy and digital receipt capture with retention schedules? — Justification: Strengthens evidential chain; supports audit. Red flags: manager self-approval; no receipt imaging or retention.

Select answer

Upload evidence for HMRC

Workflow screenshots; sample audit trail; retention policy.

Short reason if answered N/A

Comments / Notes (Optional)

004. Are receipts required for all expense claims and retained? — Justification: Prevents unverifiable or blanket tax-free payments. Red flags: spreadsheet-only claims; missing receipts; recurring identical amounts.

Select answer

Upload evidence for HMRC

Receipts; expense logs; audit trail.

Short reason if answered N/A

Comments / Notes (Optional)

005. Are worker expenses shown separately from gross/taxable pay on payslips? — Justification: Prevents misclassification or unlawful net pay uplifts. Red flags: expenses included in “basic pay”; single rolled figure.

Select answer

Upload evidence for HMRC

Payslip samples; payroll analysis.

Short reason if answered N/A

Comments / Notes (Optional)

006. Does the agency/umbrella check that expenses do not reduce net pay below NMW/NLW thresholds? — Justification: Protects compliance with NMW Regulations 2015. Red flags: negative impact on net; breach warnings ignored.

Select answer

Upload evidence for HMRC

Gross-to-net reconciliations; NMW checks; payslip audits.

Short reason if answered N/A

Comments / Notes (Optional)

007. Are workers notified in writing about any expense deductions or reimbursements? — Justification: Ensures transparency (Employment Rights Act 1996). Red flags: deductions appear without prior notice/consent.

Select answer

Upload evidence for HMRC

Contracts; payslip notices; onboarding comms.

Short reason if answered N/A

Comments / Notes (Optional)

008. For lodging payments, are payments only made under WRA or HMRC-approved exemptions? — Justification: Ensures legitimacy of lodging allowances. Red flags: lodging paid without WRA reference; blanket hotel allowances.

Select answer

Upload evidence for HMRC

WRA documents; HMRC exemption approval (where applicable).

Short reason if answered N/A

Comments / Notes (Optional)

009. Are lodging allowance forms completed, signed, retained and evidence-based? — Justification: Verifies claims are documented and lawful. Red flags: missing forms; photocopied signatures; no evidence of stay/site.

Select answer

Upload evidence for HMRC

Signed lodging forms; application/approval records.

Short reason if answered N/A

Comments / Notes (Optional)

010. Does the agency/umbrella confirm workers meet HMRC “temporary workplace” test before lodging payments? — Justification: Prevents incorrect or ineligible claims. Red flags: assignments >24 months still paid tax-free; multiple sites treated as one.

Select answer

Upload evidence for HMRC

Assignment history; site logs; decision record.

Short reason if answered N/A

Comments / Notes (Optional)

011. Are lodging payments reconciled against assignment length/location to confirm ongoing eligibility? — Justification: Prevents fraud; confirms WRA compliance. Red flags: lodging continues after site/workplace changes; no periodic review.

Select answer

Upload evidence for HMRC

Timesheets; assignment reconciliation records.

Short reason if answered N/A

Comments / Notes (Optional)

012. Are reimbursed expenses handled in line with HMRC rules and exempt from tax only where eligible? — Justification: Confirms legal compliance. Red flags: per-diems treated as tax-free; umbrella margin embedded in “expenses”.

Select answer

Upload evidence for HMRC

Policy statement; sample expense reports.

Short reason if answered N/A

Comments / Notes (Optional)

013. Does the agency/umbrella audit expense claims periodically (incl. umbrella reimbursements)? — Justification: Detects fraud and confirms HMRC compliance. Red flags: no sampling; repeated declines to share audit results.

Select answer

Upload evidence for HMRC

Audit logs; reconciliation records; findings & actions.

Short reason if answered N/A

Comments / Notes (Optional)

014. Are expense/lodging policies reviewed annually (or when rules change) and version-controlled? — Justification: Ensures controls remain up-to-date. Red flags: undated policies; no owner/review cycle.

Select answer

Upload evidence for HMRC

Policy review log; updated procedures; version history.

Short reason if answered N/A

Comments / Notes (Optional)

015. Does the agency/umbrella share updated expense policies with the end-hirer? — Justification: Maintains transparency and auditability. Red flags: “commercially sensitive – cannot share.”

Select answer

Upload evidence for HMRC

Communication logs; updated policy documents.

Short reason if answered N/A

Comments / Notes (Optional)

016. Are reconciliations in place to ensure expenses are not used to meet NMW or inflate “take-home” (no OpRA misuse)? — Justification: Closes disguised-remuneration loopholes. Red flags: “salary sacrifice” labelled as expenses; fixed “allowances” each pay.

Select answer

Upload evidence for HMRC

Reconciliation worksheet; OpRA/NMW checks; benefit specs.

Short reason if answered N/A

Comments / Notes (Optional)

017. Are any accommodation/transport deductions demonstrably optional and free of coercion/over-recovery? — Justification: Worker-welfare & NMW safeguard. Red flags: deductions tied to hiring; charges exceed cost; tied housing.

Select answer

Upload evidence for HMRC

Worker consent forms; rate card; deduction audit.

Short reason if answered N/A

Comments / Notes (Optional)

018. Where third-party providers (e.g., travel agents/landlords) are used, are conflicts disclosed and kick-backs prohibited? — Justification: Prevents undisclosed profit from expenses. Red flags: related-party vendors; rebates not declared.

Select answer

Upload evidence for HMRC

Supplier list; COI register; contract clauses.

Short reason if answered N/A

Comments / Notes (Optional)

Section 6 – GDPR & Data Protection

End-hirers must ensure agencies and umbrella companies handle worker data lawfully, securely, and in compliance with UK GDPR.

Where personal data (e.g., ID, RTW documents, tax, or bank details) is processed by third parties, the end-hirer remains jointly responsible under GDPR (as joint controller or controller in common).

Key obligations under Articles 28 & 30 UK GDPR:

  • Clear definition of controller/processor roles
  • Data Processing Agreements (DPAs) and Records of Processing Activities (RoPA)
  • Adequate organisational and technical security measures

Failure to assure GDPR compliance risks fines, ICO enforcement, reputational damage, and payroll data misuse.

GDPR & Data Protection

001. Does the agency/umbrella confirm that payroll and employment data is processed in line with UK GDPR? — Justification: Legal requirement; ensures personal data is safeguarded. Red flags: no named DPO/lead; reliance on email spreadsheets for payroll.

Select answer

Upload evidence for HMRC

Data protection policy; privacy notice; DPO/DPM appointment; payroll system access logs.

Short reason if answered N/A

Comments / Notes (Optional)

002. Are GDPR controls in place (secure systems, role-based/restricted access, MFA, encryption, backups, retention policies)? — Justification: Confirms security measures are embedded in operations. Red flags: shared logins; no MFA; open access to payroll; unencrypted storage.

Select answer

Upload evidence for HMRC

Information security policy; RBAC matrix; MFA screenshots; encryption/backup statements; internal audit.

Short reason if answered N/A

Comments / Notes (Optional)

003. Have any payroll-related data breaches been reported in the last 12 months? — Justification: Identifies integrity risks and ICO-reportable incidents. Red flags: incidents not logged; repeated breaches; no root-cause actions.

Select answer

Upload evidence for HMRC

Breach register; incident reports; ICO notifications (if any); CAPA records.

Short reason if answered N/A

Comments / Notes (Optional)

004. Does your PSL/contract explicitly grant the end-hirer audit rights over payroll data (e.g., payslips, BACs, RTIs)? — Justification: Enables transparency to detect payroll non-compliance. Red flags: supplier claims “GDPR prevents sharing”; no audit clause.

Select answer

Upload evidence for HMRC

PSL/MSA clause excerpt; sample audit report/data room access log.

Short reason if answered N/A

Comments / Notes (Optional)

005. Is there a signed Data Processing Agreement (Art. 28) and a maintained Record of Processing Activities (RoPA; Art. 30)? — Justification: Statutory requirement; clarifies controller/processor roles. Red flags: templated DPA missing Art. 28 obligations; no RoPA.

Select answer

Upload evidence for HMRC

Executed DPA; RoPA extract listing payroll/umbrella activities.

Short reason if answered N/A

Comments / Notes (Optional)

006. Has a Data Protection Impact Assessment (DPIA) been completed for payroll/umbrella processing, including sub-processors and breach SLAs? — Justification: Risk-based GDPR control. Red flags: DPIA “in progress”; sub-processor list absent; no breach notification SLA.

Select answer

Upload evidence for HMRC

DPIA document; vendor/sub-processor register; breach-SLA in contract.

Short reason if answered N/A

Comments / Notes (Optional)

007. Do any international transfers use valid safeguards (UK IDTA / SCCs) with a transfer risk assessment (TRA)? — Justification: Ensures lawful cross-border processing. Red flags: reliance on invalid frameworks; no TRA; unknown hosting region.

Select answer

Upload evidence for HMRC

Transfer register; signed IDTAs/SCCs; TRA summary; hosting region statement.

Short reason if answered N/A

Comments / Notes (Optional)

008. Is there a data-retention schedule and secure deletion protocol for payroll/RTW records? — Justification: Reduces data-minimisation risk. Red flags: “keep indefinitely”; no deletion logs; RTW kept beyond statutory limits.

Select answer

Upload evidence for HMRC

Retention policy; deletion/archival logs; destruction certificates.

Short reason if answered N/A

Comments / Notes (Optional)

009. Is there a Joiners-Movers-Leavers (JML) process with prompt access revocation for payroll systems? — Justification: Prevents unauthorised access. Red flags: leaver accounts still active; generic mailboxes with payroll access.

Select answer

Upload evidence for HMRC

JML procedure; access change tickets; quarterly access review evidence.

Short reason if answered N/A

Comments / Notes (Optional)

010. Are vendor assurance and security certifications in place (e.g., ISO 27001, Cyber Essentials Plus) for payroll/umbrella and key sub-processors? — Justification: Independent assurance over controls. Red flags: expired certs; no third-party assurance.

Select answer

Upload evidence for HMRC

Current certificates; SoA; latest audit report/attestation.

Short reason if answered N/A

Comments / Notes (Optional)

011. Is there a defined process and SLA for data subject rights (e.g., SARs) related to workers’ payroll data? — Justification: Confirms ability to meet 1-month statutory deadlines. Red flags: ad-hoc handling; no redaction tooling.

Select answer

Upload evidence for HMRC

SAR log; procedure; sample response pack (redacted).

Short reason if answered N/A

Comments / Notes (Optional)

012. Are penetration tests/vulnerability scans and backup restore tests performed at least annually on payroll systems? — Justification: Tests resilience and recovery. Red flags: last test >12 months; backups untested.

Select answer

Upload evidence for HMRC

Test reports; remediation plan; backup restore test evidence.

Short reason if answered N/A

Comments / Notes (Optional)

Section 7 – Modern Slavery & Worker Welfare

This section ensures agencies and umbrella companies actively identify, prevent, and address the risk of labour exploitation, trafficking, or coercion in their supply chains.

Under the Modern Slavery Act (MSA) 2015 and the 2026 Joint & Several Liability (JSL) regime, end-hirers must demonstrate that they took reasonable steps to protect workers and prevent criminal facilitation of exploitation.

Key controls include:

  • Policies and risk assessments
  • Staff training and right-to-work checks
  • Umbrella compliance checks (fees, deductions, worker welfare)
  • Whistleblowing channels and incident response
  • Contractual clauses and end-hirer assurance

Modern Slavery & Worker Welfare

001. Does the agency have a Modern Slavery Policy covering all suppliers, including umbrellas? — Justification: Confirms baseline governance and supplier expectations. Red flags: policy older than 12 months; umbrellas excluded; no board approval.

Select answer

Upload evidence for HMRC

Modern Slavery Policy; supplier code of conduct; review/approval record.

Short reason if answered N/A

Comments / Notes (Optional)

002. Has the agency assessed modern slavery risks in its supply chain within the last 12 months? — Justification: Shows proactive risk identification (e.g., umbrella misuse, high-risk roles/locations). Red flags: no heatmap/tiering; “one-size” assessment.

Select answer

Upload evidence for HMRC

Risk assessment; supplier tier mapping; heatmaps; action plan.

Short reason if answered N/A

Comments / Notes (Optional)

003. Is modern-slavery training provided to onboarding/payroll/contract staff? — Justification: Ensures frontline teams can spot exploitation red flags. Red flags: induction only; <90% completion; no role-specific content.

Select answer

Upload evidence for HMRC

Training materials; LMS completion logs; staff attestations.

Short reason if answered N/A

Comments / Notes (Optional)

004. Does the agency conduct Right-to-Work checks directly (not outsourced to the umbrella) and retain ID/visa records? — Justification: Prevents trafficking/illegal working; maintains control of ID verification. Red flags: copies not retained; remote checks without certification; expired visas.

Select answer

Upload evidence for HMRC

RTW records; ID copies; RTW audit samples.

Short reason if answered N/A

Comments / Notes (Optional)

005. Has the agency confirmed umbrellas do not charge unlawful fees or coercive deductions? — Justification: Addresses debt-bondage/restriction-of-movement risks. Red flags: “admin fees”, uniform/tooling loans, paid-for timesheet portals, “joining fees”.

Select answer

Upload evidence for HMRC

Payslip reviews; worker declarations; umbrella confirmations; policy extracts.

Short reason if answered N/A

Comments / Notes (Optional)

006. Is a confidential whistleblowing / anonymous reporting mechanism available to workers? — Justification: Enables risk escalation from within the workforce. Red flags: hotline not publicised; English-only; no external channel; no SLA.

Select answer

Upload evidence for HMRC

Whistleblowing policy; hotline stats; posters/comms; incident logs.

Short reason if answered N/A

Comments / Notes (Optional)

007. Has the agency taken action in the last 12 months on any modern-slavery concerns? — Justification: Tests responsiveness and governance. Red flags: issues closed without remediation; no root-cause review; repeat allegations at same supplier.

Select answer

Upload evidence for HMRC

Investigation reports; outcomes/CAPA; referral records (GLAA/police/ICO).

Short reason if answered N/A

Comments / Notes (Optional)

008. Does the end-hirer receive annual assurance confirming agency MSA compliance and supplier vetting? — Justification: Provides transparency and defensible oversight for JSL. Red flags: self-cert only; no evidence pack; no board sign-off.

Select answer

Upload evidence for HMRC

Signed MSA statement; supplier audit results; board approval minute.

Short reason if answered N/A

Comments / Notes (Optional)

009. Are modern-slavery clauses in PSL/agency contracts with escalation/termination rights? — Justification: Embeds enforceable accountability. Red flags: clauses missing audit/termination rights; no cooperation duty.

Select answer

Upload evidence for HMRC

PSL/MSA extracts; sample contract clauses; sanctions/escalation ladder.

Short reason if answered N/A

Comments / Notes (Optional)

010. Does the agency monitor umbrellas for MS indicators (high turnover, housing tie-ins, withheld wages)? — Justification: Ensures active detection of red flags in practice. Red flags: forced accommodation; cash wage top-ups; group bank accounts.

Select answer

Upload evidence for HMRC

Worker surveys/interviews; payslip analytics; turnover metrics; audit reports.

Short reason if answered N/A

Comments / Notes (Optional)

011. Are no-recruitment-fee commitments required and monitored across agencies/umbrellas? — Justification: Core ILO/MS standard; prevents debt bondage. Red flags: workers paying introduction or “switch” fees; fees to umbrella.

Select answer

Upload evidence for HMRC

Contract clauses; supplier attestations; audit findings; worker statements.

Short reason if answered N/A

Comments / Notes (Optional)

012. Are bank-account anomalies (shared/managed accounts) investigated before payment? — Justification: Identifies control/coercion risks and wage skimming. Red flags: multiple workers to one account; “handler” accounts.

Select answer

Upload evidence for HMRC

Exception reports; resolution notes; payroll system screenshots.

Short reason if answered N/A

Comments / Notes (Optional)

013. If accommodation is offered, is it independent, optional, and fairly priced? — Justification: Prevents tied housing exploitation. Red flags: rent deducted without consent; below-standard housing; forced occupancy.

Select answer

Upload evidence for HMRC

Provider contracts; worker consent forms; pricing review/benchmark.

Short reason if answered N/A

Comments / Notes (Optional)

014. Are confidential worker interviews/surveys run periodically, with an independent reporting route? — Justification: Worker voice and assurance that channels work. Red flags: interviews conducted by the accused supplier; low participation; retaliation reports.

Select answer

Upload evidence for HMRC

Survey tools; anonymised results; hotline stats; corrective actions.

Short reason if answered N/A

Comments / Notes (Optional)

015. (Sectoral) Is GLAA licensing checked where applicable and recorded? — Justification: Mandatory for GLAA-regulated sectors (e.g., food, agriculture). Red flags: expired/suspended license; trading name mismatch.

Select answer

Upload evidence for HMRC

GLAA licence check record; Companies House match; monitoring diary.

Short reason if answered N/A

Comments / Notes (Optional)

016. Are wage deductions (advances, loans, transport) transparent, optional and below NMW impact? — Justification: Protects NMW compliance and worker welfare. Red flags: net pay routinely below NMW; blanket “transport” or “umbrella margin” deductions.

Select answer

Upload evidence for HMRC

Payslip samples; deduction policy; consent forms; NMW checks.

Short reason if answered N/A

Comments / Notes (Optional)

017. Are recruitment agents/brokers vet­ted (no overseas fee-charging, legal right to operate)? — Justification: Reduces risks in international worker routes. Red flags: cash recruitment fees; passport retention; confiscated RTW docs.

Select answer

Upload evidence for HMRC

Broker due-diligence pack; contracts; worker declarations; spot-check results.

Short reason if answered N/A

Comments / Notes (Optional)

Does the agency obtain and review Modern Slavery statements from its umbrella and subcontractor partners, where legally required?
Justification: - Agencies must evidence Modern Slavery Act checks across their supply chain, not just internally.
Red Flags: Supplier missing statements despite >£36m turnover; generic statements with no detail; copy-paste policies.

Select answer

Upload evidence for HMRC

Supplier Modern Slavery statements; review logs

Short reason if answered N/A

Comments / Notes (Optional)

Section 8 – Business Continuity & Risk Management

Staffing agencies and umbrella companies play a critical role in labour supply. Disruption — through insolvency, HMRC enforcement, cyberattacks, accreditation loss, or structural changes — can lead to payroll failure, unpaid workers, or reputational damage for the end-hirer.

This section ensures agencies and umbrellas have robust governance and resilience measures to:

  • Maintain payroll continuity and protect workers
  • Safeguard supply in the event of financial, operational, or cyber shocks
  • Provide transparency on risks (ownership, compliance investigations, accreditation status)
  • Demonstrate corporate due diligence consistent with ISO 22301, FCSA Codes, and BEIS principles

Business Continuity & Risk Management

001. Does the agency notify the end-hirer of changes in ownership or control? — Justification: Ownership shifts can change compliance risk (phoenixing, undisclosed control) and invalidate prior checks. Red flags: new PSCs not disclosed; trading name/bank details change with no notice.

Select answer

Upload evidence for HMRC

Companies House (CH) snapshot; PSC/ownership register; board approvals/filings.

Short reason if answered N/A

Comments / Notes (Optional)

002. Does the agency notify the end-hirer of significant amendments to business structure/operations? — Justification: Structural change can disrupt payroll continuity and risk profile. Red flags: sudden site closures, payroll platform change, or outsourcing with no impact assessment.

Select answer

Upload evidence for HMRC

Board minutes; restructure plan; org-chart updates; SoW change notice.

Short reason if answered N/A

Comments / Notes (Optional)

003. Does the agency disclose any ongoing or completed HMRC investigations? — Justification: Indicates enforcement exposure and due-diligence red flags. Red flags: HMRC contact known but not disclosed; repeated enquiries.

Select answer

Upload evidence for HMRC

HMRC correspondence; enquiry/ref number; settlement/closure letter.

Short reason if answered N/A

Comments / Notes (Optional)

004. Does the agency notify the end-hirer of suspensions/revocations of accreditations (REC, FCSA, etc.)? — Justification: Accreditation loss is a leading indicator of compliance failure. Red flags: accreditation “lapsed” without cause; conditions imposed by the scheme.

Select answer

Upload evidence for HMRC

Accreditation notices; regulator correspondence; suspension/appeal letters.

Short reason if answered N/A

Comments / Notes (Optional)

005. If any of the above apply, does the agency provide full disclosure with supporting documentation? — Justification: Ensures transparent risk evaluation and timely mitigation. Red flags: verbal updates only; missing root-cause or CAPA.

Select answer

Upload evidence for HMRC

Narrative summary; evidence pack; root-cause & corrective-action plan.

Short reason if answered N/A

Comments / Notes (Optional)

006. Has the agency experienced any data breaches or cyber incidents in the last 12 months? — Justification: Payroll data breaches create GDPR and operational risk. Red flags: repeated phishing/RDP incidents; ICO notifications.

Select answer

Upload evidence for HMRC

Incident tickets; cyber audit; ICO notifications (if any).

Short reason if answered N/A

Comments / Notes (Optional)

007. If Yes, does the agency provide impact, response, and mitigation details? — Justification: Tests incident handling, containment, and lessons learned. Red flags: no DPO report; no patching/re-test evidence.

Select answer

Upload evidence for HMRC

DPO report; timeline; remediation evidence; pen-test/patch logs.

Short reason if answered N/A

Comments / Notes (Optional)

008. Does the end-hirer perform annual due diligence on the agency’s legal/trading status? — Justification: HMRC expects demonstrable labour-supply checks (CFA/JSL readiness). Red flags: outdated CH/VAT checks; no supplier questionnaire.

Select answer

Upload evidence for HMRC

Due-diligence log; supplier questionnaire; refreshed CH & VAT checks.

Short reason if answered N/A

Comments / Notes (Optional)

009. Has the agency confirmed whether the umbrella has had ownership/structural changes? — Justification: Umbrella changes can shift risk (banking, payroll ops, governance). Red flags: new bank/payroll platform with no notice.

Select answer

Upload evidence for HMRC

CH updates; umbrella confirmation letter; PSC changes.

Short reason if answered N/A

Comments / Notes (Optional)

010. Has the agency confirmed whether the umbrella is subject to HMRC investigations? — Justification: Ensures visibility of downstream enforcement risk. Red flags: HMRC letters addressed to connected entities only.

Select answer

Upload evidence for HMRC

Umbrella declaration; HMRC letters; enquiry status.

Short reason if answered N/A

Comments / Notes (Optional)

011. Has the agency confirmed whether the umbrella has lost or suspended accreditations? — Justification: Signals breakdown in compliance controls. Red flags: SafeRec/FCSA conditions; removal from PSL lists elsewhere.

Select answer

Upload evidence for HMRC

FCSA/SafeRec notices; regulator updates; reinstatement conditions.

Short reason if answered N/A

Comments / Notes (Optional)

012. If Yes, does the agency ensure full disclosure is provided to the end-hirer? — Justification: Enables informed decisioning (pause/terminate/escalate). Red flags: refusal to share report scope; vague timelines.

Select answer

Upload evidence for HMRC

Disclosure pack; CAPA plan; milestone tracker.

Short reason if answered N/A

Comments / Notes (Optional)

013. Has the agency confirmed whether the umbrella experienced cyber or data-breach incidents? — Justification: Protects worker data and payroll continuity across tiers. Red flags: shared credentials; unmanaged third-party processors.

Select answer

Upload evidence for HMRC

Umbrella incident summary; ICO notice (if any); forensics/assurance.

Short reason if answered N/A

Comments / Notes (Optional)

014. If Yes, does the agency provide incident details, impact, and corrective actions? — Justification: Confirms accountability and sustained remediation. Red flags: no post-incident review or re-test evidence.

Select answer

Upload evidence for HMRC

Incident register; PIR report; re-test/closure evidence.

Short reason if answered N/A

Comments / Notes (Optional)

015. Agency: Is there a tested BCP/DR for payroll with RTO/RPO targets and annual test evidence? — Justification: Verifies ability to pay workers on time during outages. Red flags: paper plan only; failed tests with no actions.

Select answer

Upload evidence for HMRC

BCP/DR plan; RTO/RPO; annual test report; action log.

Short reason if answered N/A

Comments / Notes (Optional)

016. Umbrella: Does the agency verify the umbrella has an up-to-date BCP? — Justification: Confirms downstream resilience and alignment. Red flags: last test >12 months; no IT recovery plan.

Select answer

Upload evidence for HMRC

Umbrella BCP; last test results; IT recovery policy.

Short reason if answered N/A

Comments / Notes (Optional)

017. Is there a back-up payroll route (secondary platform/provider) documented? — Justification: Ensures continuity if the primary system fails. Red flags: vendor single-point dependency; no switch-over test.

Select answer

Upload evidence for HMRC

Contingency SoW/contract; switch-over test evidence.

Short reason if answered N/A

Comments / Notes (Optional)

018. Are payroll funds segregated (client/safeguarding account) with daily reconciliation? — Justification: Protects worker pay in crisis; prevents commingling risk. Red flags: trading account used; reconciliation < daily.

Select answer

Upload evidence for HMRC

Bank letter confirming safeguarding; daily reconciliation logs.

Short reason if answered N/A

Comments / Notes (Optional)

019. Do contracts include mandatory notification triggers for insolvency, HMRC action, loss of accreditation? — Justification: Creates early-warning triggers for fast mitigation/escalation. Red flags: notices limited to “material” events only.

Select answer

Upload evidence for HMRC

Contract clause extract; example vendor notice; escalation playbook.

Short reason if answered N/A

Comments / Notes (Optional)

020. Are insurance covers adequate (PI/EL/Crime/Cyber) with current certificates? — Justification: Provides financial back-stop for incidents and losses. Red flags: lapsed policies; low cyber limits; high deductibles without reserves.

Select answer

Upload evidence for HMRC

Policy schedules; current certificates; broker confirmation; (redacted) claims history.

Short reason if answered N/A

Comments / Notes (Optional)

Section 9 – Tax & VAT Fraud Prevention

End-hirers are jointly responsible for preventing VAT fraud and disguised tax practices in their supply chains.

Under the Kittel principle, Criminal Finances Act 2017, and 2026 Joint & Several Liability reforms, HMRC can deny input VAT or hold end-hirers liable if VAT fraud was “known or should have been known.”

This section ensures that VAT registration, invoicing, and payment practices across agencies and umbrella companies are legitimate, transparent, and regularly verified.

Passive reliance on supplier assurances is not enough — end-hirers must evidence active checks and maintain due diligence logs.

Tax & VAT Fraud Prevention

001. Have you confirmed your suppliers’ VAT registration and corporate structure? — Justification: Proves legitimacy; detects shell/phoenix entities. Red flags: recently incorporated with frequent name changes; dissolved/strike-off warnings.

Select answer

Upload evidence for HMRC

VAT certificates; Companies House (CH) snapshot; group/ownership chart.

Short reason if answered N/A

Comments / Notes (Optional)

002. Have you verified directors and ultimate beneficial owners (UBOs) of suppliers? — Justification: Identifies hidden ownership/undeclared relationships. Red flags: overseas PSCs/trusts with opaque control; nominee directors.

Select answer

Upload evidence for HMRC

UBO declarations; CH officer/PSC records; sanctions/PEP screen print.

Short reason if answered N/A

Comments / Notes (Optional)

003. Are supplier VAT numbers checked regularly on HMRC/VIES? — Justification: Confirms valid/active registrations. Red flags: mismatch of name vs VAT record; frequent changes.

Select answer

Upload evidence for HMRC

HMRC/VIES screenshots; periodic check log.

Short reason if answered N/A

Comments / Notes (Optional)

004. Have suppliers been checked for VAT deregistration, phoenixing, or insolvency risk? — Justification: Detects high-risk/non-compliant suppliers. Red flags: repeated dissolved entities with same directors; CCJs.

Select answer

Upload evidence for HMRC

Supplier disclosure form; CH status/insolvency watch; credit report.

Short reason if answered N/A

Comments / Notes (Optional)

005. Are supplier invoices compliant (correct legal name, VAT breakdown, registered entity)? — Justification: Required for lawful input VAT claims. Red flags: trading style not equal to VAT entity; missing VAT rate/time of supply.

Select answer

Upload evidence for HMRC

2–3 invoice samples; invoice controls checklist.

Short reason if answered N/A

Comments / Notes (Optional)

006. Do supplier invoices reconcile with payment records and declared VAT returns? — Justification: Detects carousel/fabricated invoices. Red flags: payments to third-party/overseas accounts; round-sum invoices.

Select answer

Upload evidence for HMRC

Invoice-to-ledger reconciliation; payment audit extract.

Short reason if answered N/A

Comments / Notes (Optional)

007. Have supplier VAT returns or HMRC payment confirmations been reviewed? — Justification: Confirms VAT is remitted; reduces liability. Red flags: refusal to evidence returns; persistent late filings.

Select answer

Upload evidence for HMRC

VAT100/quarterly return copy; HMRC payment receipt (if available).

Short reason if answered N/A

Comments / Notes (Optional)

008. Are CIS Domestic Reverse Charge (DRC) rules applied correctly on construction-related invoices? — Justification: Ensures VAT Notice 735 compliance. Red flags: VAT charged where DRC should apply; missing DRC wording.

Select answer

Upload evidence for HMRC

DRC policy; annotated invoice samples; staff guidance.

Short reason if answered N/A

Comments / Notes (Optional)

009. Are suppliers explicitly aware of their DRC obligations? — Justification: Prevents shared risk under CIS. Red flags: contracts silent on DRC; agencies issue mixed messages.

Select answer

Upload evidence for HMRC

Contract clauses; supplier onboarding template; attestations.

Short reason if answered N/A

Comments / Notes (Optional)

010. Do you block VAT claims from mini-umbrella company (MUC) invoices? — Justification: MUCs often mask PAYE/NIC avoidance. Red flags: sequential tiny companies; shared directors/addresses; split payroll.

Select answer

Upload evidence for HMRC

Supply-chain map; due-diligence log; blacklist/PSL controls.

Short reason if answered N/A

Comments / Notes (Optional)

011. Are disguised payroll/hybrid self-employment models detected in VAT invoicing? — Justification: Prevents off-payroll abuse hidden as VAT services. Red flags: “management fee” replacing PAYE; worker-paid fees.

Select answer

Upload evidence for HMRC

Contracts/SOW; SDS status checks; audit reports.

Short reason if answered N/A

Comments / Notes (Optional)

012. Do youas an agency formally assess Kittel risk (whether VAT fraud was “known/should have been known”)? — Justification: HMRC can deny recovery even without intent. Red flags: no Kittel log; reliance on supplier assurances only.

Select answer

Upload evidence for HMRC

Kittel assessment log; staff training record; escalation trail.

Short reason if answered N/A

Comments / Notes (Optional)

013. Are all labour-supply payments made only to UK bank accounts in the supplier’s legal name? — Justification: Prevents invoice fraud/fund diversion. Red flags: payee ≠ invoice entity; virtual/EMI wallets; overseas IBAN.

Select answer

Upload evidence for HMRC

Payment ledger; verified bank details; Confirmation-of-Payee screenshot.

Short reason if answered N/A

Comments / Notes (Optional)

014. Do you maintain a VAT/tax due-diligence log for all suppliers? — Justification: Provides ongoing audit trail (CFA 2017 & JSL). Red flags: one-off onboarding only; no periodic refresh.

Select answer

Upload evidence for HMRC

Verification log; onboarding records; review cadence.

Short reason if answered N/A

Comments / Notes (Optional)

015. Are third-party payment requests (split payments, overseas accounts) prohibited unless pre-approved by tax/finance? — Justification: Classic Missing-Trader red flag. Red flags: finance bypass via operational staff approvals.

Select answer

Upload evidence for HMRC

SOP/policy; exception register; approval emails.

Short reason if answered N/A

Comments / Notes (Optional)

016. Is there a Kittel risk decision log for labour-supply invoices (why satisfied/refused to trade)? — Justification: Creates defendable VAT position. Red flags: no rationale saved; inconsistent outcomes.

Select answer

Upload evidence for HMRC

Decision log; checks performed; outcome notes.

Short reason if answered N/A

Comments / Notes (Optional)

017. Do staff receive CFA 2017 anti-facilitation training with an escalation route to a named compliance owner? — Justification: Strengthens prevention procedures. Red flags: no refresher; incidents handled informally.

Select answer

Upload evidence for HMRC

Training logs; escalation policy; incident register.

Short reason if answered N/A

Comments / Notes (Optional)

018. Are supplier terminations/holds documented where VAT/compliance doubt exists? — Justification: Shows active risk management. Red flags: continue trading after red flags; no remediation plan.

Select answer

Upload evidence for HMRC

Stop-trade notices; communications; remediation/exit plan.

Short reason if answered N/A

Comments / Notes (Optional)

Section 10 – 2026 JSL & Umbrella Legislation Readiness

From 2026, umbrella companies will fall under new UK regulation, and Joint & Several Liability (JSL) provisions will hold end-hirers accountable for supply chain non-compliance — even when breaches occur downstream.

This section ensures that end-hirers and their agencies are proactively preparing for this strict liability regime by:

  • Mapping supply chains and identifying all intermediaries
  • Preventing use of mini-umbrella structures and disguised remuneration
  • Enforcing audit rights, contractual obligations, and whistleblowing channels
  • Embedding readiness through training, policies, and supplier declarations.

Failure to implement preventative controls will expose end-hirers to liability for unpaid PAYE/NICs, tax fraud, and worker exploitation.

2026 JSL & Umbrella Legislation Readiness

001. Has the agency board appointed a named senior owner for umbrella/JSL compliance with a RACI? — Justification: Sets tone from the top; someone is Accountable. Red flags: no named owner; not board-level; RACI unclear/overlapping.

Select answer

Upload evidence for HMRC

Board/committee minute; RACI matrix; role profile.

Short reason if answered N/A

Comments / Notes (Optional)

002. Does the agency have a documented JSL readiness plan (policies, audits, worker-whistleblowing access, supplier mapping) with milestones? — Justification: Converts intent to a tracked programme. Red flags: draft only; no owners/dates; plan not reviewed.

Select answer

Upload evidence for HMRC

Plan; risk register; milestone tracker; status report.

Short reason if answered N/A

Comments / Notes (Optional)

003. Has the agency mapped the labour supply chain, including all intermediaries involved in payroll/payment delivery? — Justification: JSL expects full visibility & traceability. Red flags: intermediaries missing (PSCs, MSPs, bureaux); no bank/payment chain.

Select answer

Upload evidence for HMRC

Supply-chain map; supplier list; onboarding logs.

Short reason if answered N/A

Comments / Notes (Optional)

004. Does the agency conduct due diligence on all umbrellas (payroll model, PAYE registration, audit history)? — Justification: Prevents onboarding non-compliant umbrellas. Red flags: reliance on self-cert only; >12 months old; no evidence pack.

Select answer

Upload evidence for HMRC

DD questionnaire; audit results; accreditation checks.

Short reason if answered N/A

Comments / Notes (Optional)

005. Does the agency verify & record that umbrellas do not use MUCs/shell entities? — Justification: Protects against NIC evasion/tax fraud. Red flags: sequential tiny companies; shared addresses/PSCs; off-shore links.

Select answer

Upload evidence for HMRC

Written confirmation; PSC/ownership diagrams; MUC checklist.

Short reason if answered N/A

Comments / Notes (Optional)

006. Has the agency implemented documented controls to prevent tax evasion/disguised remuneration in its umbrella supply chain? — Justification: Core JSL/CFA expectation. Red flags: no policy; no staff training; exceptions not logged/reviewed.

Select answer

Upload evidence for HMRC

Tax-evasion prevention policy; SOPs; training logs; exceptions log.

Short reason if answered N/A

Comments / Notes (Optional)

007. Does the agency ensure umbrellas do not outsource payroll to third parties without disclosure/due diligence? — Justification: Stops hidden tiers & uncontrolled risk. Red flags: unknown processors; aggregator models; no sub-processor review.

Select answer

Upload evidence for HMRC

Supplier agreements; third-party due-diligence pack.

Short reason if answered N/A

Comments / Notes (Optional)

008. Are umbrella contracts legally binding with PAYE, NMW/NLW, tax-compliance & cooperation clauses? — Justification: Enforceable obligations. Red flags: missing investigation-cooperation clause; vague compliance wording.

Select answer

Upload evidence for HMRC

Template contracts; signed agreements; PSL clauses.

Short reason if answered N/A

Comments / Notes (Optional)

009. Does the agency grant end-hirer audit rights over umbrella payslips, RTIs, BACs & contracts? — Justification: Enables “reasonable procedures” evidence. Red flags: no audit clause; repeated access refusals/delays.

Select answer

Upload evidence for HMRC

MSA/PSL extracts; access logs; sample audit notices.

Short reason if answered N/A

Comments / Notes (Optional)

010. Are escalation/termination clauses included in PSLs if an umbrella breaches JSL-related obligations? — Justification: Gives teeth when things go wrong. Red flags: clauses absent; thresholds unclear; never exercised.

Select answer

Upload evidence for HMRC

PSL extracts; termination/escalation playbook; sample letters.

Short reason if answered N/A

Comments / Notes (Optional)

011. Does the agency regularly review payslips & payroll models of umbrellas to detect skimming/disguised deductions? — Justification: Early detection of JSL exposure. Red flags: complaint-only reviews; no sampling plan; no defect log.

Select answer

Upload evidence for HMRC

Payslip samples; sampling plan; review findings & actions.

Short reason if answered N/A

Comments / Notes (Optional)

012. Have agency audit rights been tested on at least one umbrella this year (payslip/RTI/BACs/contract sampling)? — Justification: Proves rights are operable, not just paper. Red flags: never tested; pushback; scope too narrow.

Select answer

Upload evidence for HMRC

Audit notification; sampling results; remediation tracker.

Short reason if answered N/A

Comments / Notes (Optional)

013. Has the agency confirmed umbrellas are preparing for 2026 JSL (updated policies, training, declarations)? — Justification: Confirms forward-looking readiness. Red flags: no awareness; no board updates; no training plan.

Select answer

Upload evidence for HMRC

Policy updates; training records; written umbrella declarations.

Short reason if answered N/A

Comments / Notes (Optional)

014. Does the agency have a whistleblowing/escalation procedure for umbrella-related non-compliance? — Justification: Clear route to raise & address risks. Red flags: not anonymous; poorly publicised; zero usage.

Select answer

Upload evidence for HMRC

Whistleblowing policy; hotline logs; incident reports.

Short reason if answered N/A

Comments / Notes (Optional)

015. Do agency workers supplied via umbrellas have access to an independent whistleblowing line (not the umbrella)? — Justification: Reduces suppression of issues; worker protection. Red flags: umbrella-owned hotline; no multilingual comms; low awareness.

Select answer

Upload evidence for HMRC

Hotline service contract; worker comms/posters; usage stats.

Short reason if answered N/A

Comments / Notes (Optional)

016. Does the end-hirer receive annual assurance on agency JSL readiness & umbrella compliance? — Justification: Defensible oversight trail. Red flags: boilerplate attestations without evidence; no board sign-off.

Select answer

Upload evidence for HMRC

Annual assurance statement; evidence pack; board approval minute.

Short reason if answered N/A

Comments / Notes (Optional)

Section 11 – Final Declaration and Signoff

This section confirms that the agency audit has been completed, reviewed, and authorised by a suitably responsible person from the end-hirer.

It also collects confirmation from the agencies and umbrella companies that they understand the expectations of accuracy, transparency, and cooperation with ongoing compliance duties.

Final Declaration and Agency Signoff

I, the undersigned, confirm on behalf of the end-hirer that::

1) The agency audit has been completed diligently and, to the best of my knowledge, is accurate, complete, and a fair reflection of our labour supply chain compliance procedures

2) All documentation referenced in this audit can be made available upon legitimate request (e.g. by clients, HMRC, enforcement bodies)

3) We acknowledge our responsibilities under relevant legislation, including the 2026 Joint and Several Liability reforms and the Criminal Finances Act 2017

4) This declaration reflects our organisation’s commitment to ethical labour supply, tax compliance, and continuous oversight of agencies and intermediaries

5) The agency has confirmed the accuracy of their submitted self-audit

6) The umbrella has confirmed the accuracy of their submitted self-audit

7) The Agency and/or Umbrella has acknowledged that the audit may be shared with HMRC and compliance bodies

8) The Umbrella has agreed to notify the agency of any material changes in compliance status

9) The Agency and/or Umbrella has confirmed that supporting documentation be made available upon request