Linkedin-in
(Guest)

LSCA End-Hirer's Audit Dashboard

Start, complete, revisit, analyse, store, print or send your essential Agency LSCA Audits by choosing from the menu below.

End-Hirer Umbrella CIS Audit

Important Information

This checklist supports end-hirers in auditing CIS umbrella suppliers to ensure transparency, tax compliance, and risk mitigation.

It covers:

  • Corporate structure and director legitimacy
  • CIS status assessments and SDC compliance
  • Accurate CIS tax deduction and reporting
  • Alignment with CFA 2017 and CIS340
  • Controls against mini umbrella fraud and supply chain layering
  • Prevention of “purported umbrella” risk under 2026 PAYE debt rules — where self-employment is misrepresented or misunderstood

End-hirers should demonstrate:

  • Robust due diligence on all CIS umbrella providers
    Clear evidence of worker status, payments, and controls
  • Escalation of non-compliant practices (e.g. disguised employment or misuse of CIS)
  • That the self-employed status is clearly communicated to avoid PAYE liability triggered by assumption

High-risk models (e.g. substitution clauses, hybrid PAYE/CIS, third-party payroll) require enhanced scrutiny.

Assertions without evidence may fail HMRC standards.

Unless specified otherwise, evidence must be dated within the last 12 months; reconciliations and CIS submissions must be monthly; insurance must be in force with ≥ 6 months remaining or broker confirmation of renewal.

Evidence Expectations

In an HMRC audit, superficial responses will not meet compliance standards.

Agencies may be asked to provide:

  • Contracts, KIDs, onboarding scripts, pay breakdowns
  • Risk assessments, IR35/SDS logs, onboarding due diligence
  • Third-party audit outcomes, governance records, and escalation logs
  • Mini umbrella red flag checks, VAT/Kittel assurance, and group structure disclosures

By using the form, you acknowledge acceptance of OPRaaS LTD’s data handling policies and terms and conditions of use.

info@opraas.co.uk

User and Company Details

Please enter the company details for the entity you are auditing.  If you are performing a Self-Assessment, please insert your own company details here.

Section 1 – Corporate & Director Integrity

This section verifies that the CIS umbrella company engaged by the end-hirer has a legitimate corporate structure and fit-and-proper leadership. HMRC expects transparency in ownership, accurate tax registration, and assurance that those running the business are not disqualified, financially unstable, or linked to previous misconduct.

Ensuring legal identity and ethical leadership is essential for end-hirer supply chain assurance.

Corporate & Director Integrity

001. Has the umbrella confirmed its legal name and Companies House registration number? — Justification: Confirms legal identity & incorporation. Red flag: no CH record or mismatched trading name.

Select answer

Upload evidence for HMRC

CH certificate of incorporation, CH extract

Short reason if answered N/A

Comments / Notes (Optional)

002. Has the umbrella provided its 10-digit Unique Taxpayer Reference (UTR)? — Justification: Confirms HMRC registration. Red flag: no UTR or unverifiable number.

Select answer

Upload evidence for HMRC

HMRC UTR confirmation letter

Short reason if answered N/A

Comments / Notes (Optional)

003. Does the umbrella operate a UK business bank account in its legal entity name (matching CH records)? — Justification: Prevents shell/fraudulent entities. Red flag: offshore or third-party account.

Select answer

Upload evidence for HMRC

Bank statement, bank verification letter

Short reason if answered N/A

Comments / Notes (Optional)

004. Has the umbrella disclosed all directors, shadow directors, PSCs, and Ultimate Beneficial Owners (UBOs)? — Justification: Ensures ownership transparency. Red flag: undisclosed PSCs/UBOs.

Select answer

Upload evidence for HMRC

CH PSC register, UBO declaration

Short reason if answered N/A

Comments / Notes (Optional)

005. Have directors been screened for disqualification, insolvency history, or HMRC enforcement action? — Justification: Detects governance risk. Red flag: director with disqualification or phoenix history.

Select answer

Upload evidence for HMRC

CH disqualification search, insolvency records

Short reason if answered N/A

Comments / Notes (Optional)

006. Have directors declared no misconduct (e.g., financial crime, late tax filings, improper claims)? — Justification: Confirms personal integrity. Red flag: past fraud, tax evasion, or benefit abuse.

Select answer

Upload evidence for HMRC

Director self-certification, HMRC correspondence

Short reason if answered N/A

Comments / Notes (Optional)

007. Has the umbrella disclosed whether it subcontracts CIS/payroll services to third parties? — Justification: Identifies supply-chain scope. Red flag: undisclosed outsourcing.

Select answer

Upload evidence for HMRC

Subcontractor agreements, scope statements

Short reason if answered N/A

Comments / Notes (Optional)

008. If subcontractors are used, is there evidence of due diligence (UTR, VAT, PAYE, directors, MUC checks)? — Justification: Prevents hidden risk. Red flag: no due-diligence packs, shell subcontractors.

Select answer

Upload evidence for HMRC

Verification packs, HMRC checks, Companies House extracts

Short reason if answered N/A

Comments / Notes (Optional)

009. Has the umbrella confirmed subcontractors do not use Mini Umbrella Company (MUC) structures? — Justification: Prevents fraud/supply-chain layering. Red flag: MUCs or multiple small PAYE schemes.

Select answer

Upload evidence for HMRC

Subcontractor declarations, audit reports

Short reason if answered N/A

Comments / Notes (Optional)

010. Are payroll/compliance functions operationally separate from sales/commercial teams? — Justification: Ensures governance independence. Red flag: sales staff influencing compliance.

Select answer

Upload evidence for HMRC

Org chart, job descriptions

Short reason if answered N/A

Comments / Notes (Optional)

011. Are compliance overrides (exceptions during onboarding) logged and independently reviewed? — Justification: Provides governance oversight. Red flag: no override log = unmanaged risk.

Select answer

Upload evidence for HMRC

Override register, governance meeting minutes

Short reason if answered N/A

Comments / Notes (Optional)

012. Is the umbrella accredited by a recognised compliance body (e.g., FCSA, Professional Passport)? — Justification: External validation. Red flag: no industry accreditation.

Select answer

Upload evidence for HMRC

Accreditation certificate

Short reason if answered N/A

Comments / Notes (Optional)

013. Is the accreditation/membership current and valid? — Justification: Demonstrates ongoing oversight. Red flag: lapsed or expired membership.

Select answer

Upload evidence for HMRC

Renewal notice, website confirmation

Short reason if answered N/A

Comments / Notes (Optional)

014. Does the umbrella hold valid Professional Indemnity (PI) insurance? — Justification: Protects against negligence claims. Red flag: expired or no policy.

Select answer

Upload evidence for HMRC

PI insurance certificate

Short reason if answered N/A

Comments / Notes (Optional)

015. Is Employers’ Liability (EL) insurance in place (even if CIS workers)? — Justification: Covers contingent claims. Red flag: no EL cover despite CIS challenge risk.

Select answer

Upload evidence for HMRC

EL insurance certificate

Short reason if answered N/A

Comments / Notes (Optional)

016. Is Public Liability (PL) insurance in place? — Justification: Protects against injury/property claims. Red flag: no PL cover.

Select answer

Upload evidence for HMRC

PL insurance schedule

Short reason if answered N/A

Comments / Notes (Optional)

Section 2 – Tax Registrations & Supply-Chain Mapping

This section ensures the CIS umbrella company has active and accurate tax registrations (UTR, VAT if applicable), declares all group entities, and discloses any subcontractors in the labour supply chain.

It provides the end-hirer with a single, transparent view of who engages and pays CIS subcontractors, preventing fraud, disguised employment, phoenix activity, and weak links in the chain.

HMRC expects due diligence to extend beyond the umbrella itself to all subcontractors and affiliates, with documented evidence of CIS deductions, VAT, and tax remittance.

Tax Registrations & Supply-Chain Mapping

001. Is the umbrella actively VAT-registered (if applicable), and do details match Companies House? — Justification: Confirms VAT legitimacy. Red flag: invalid/dormant VAT number, mismatch with CH record.

Select answer

Upload evidence for HMRC

VAT certificate, HMRC VAT checker, CH extract

Short reason if answered N/A

Comments / Notes (Optional)

002. Does the umbrella hold a valid 10-digit Unique Taxpayer Reference (UTR), and has it been verified with HMRC? — Justification: Confirms HMRC registration. Red flag: unverifiable or shared UTR.

Select answer

Upload evidence for HMRC

HMRC UTR confirmation letter

Short reason if answered N/A

Comments / Notes (Optional)

003. If operating PAYE in parallel, is the PAYE scheme registered and active? — Justification: Confirms hybrid model is legitimate. Red flag: PAYE run without HMRC registration.

Select answer

Upload evidence for HMRC

PAYE reference, HMRC letter

Short reason if answered N/A

Comments / Notes (Optional)

004. Have all group entities (subsidiaries, affiliates, parent companies) that engage CIS subcontractors been disclosed? — Justification: Ensures transparency and prevents phoenixing. Red flag: hidden or undisclosed group entities.

Select answer

Upload evidence for HMRC

Group org chart, CH records, PSC register

Short reason if answered N/A

Comments / Notes (Optional)

005. Does the umbrella use a UK-based business bank account exclusively for CIS payments? — Justification: Confirms funds flow through UK entity. Red flag: offshore/third-party accounts.

Select answer

Upload evidence for HMRC

Bank statement, verification letter

Short reason if answered N/A

Comments / Notes (Optional)

006. Are subcontractors or intermediaries disclosed, named, and audited? — Justification: Prevents hidden labour chain risk. Red flag: undeclared subcontractors.

Select answer

Upload evidence for HMRC

Subcontractor list, audit reports

Short reason if answered N/A

Comments / Notes (Optional)

007. Are subcontractors contractually bound to CIS/HMRC compliance standards? — Justification: Provides legal accountability. Red flag: contracts silent on compliance.

Select answer

Upload evidence for HMRC

Subcontract agreements, SLA

Short reason if answered N/A

Comments / Notes (Optional)

008. Are outsourced payroll, onboarding, or compliance functions disclosed and under contract? — Justification: Identifies hidden outsourcing. Red flag: third-party operators undisclosed.

Select answer

Upload evidence for HMRC

Outsourcing contracts, service agreements

Short reason if answered N/A

Comments / Notes (Optional)

009. Are audit trails in place to evidence CIS deductions and payments in line with HMRC standards? — Justification: Confirms traceability. Red flag: no reconciliation logs, gaps in submissions.

Select answer

Upload evidence for HMRC

CIS reconciliation logs, HMRC submission exports

Short reason if answered N/A

Comments / Notes (Optional)

010. Has the umbrella (or group) had accounts frozen or been investigated by HMRC/FCA in the past 5 years? — Justification: Detects integrity risks. Red flag: undisclosed investigations.

Select answer

Upload evidence for HMRC

HMRC/FCA correspondence, enforcement notices

Short reason if answered N/A

Comments / Notes (Optional)

011. Are internal audits or spot checks performed on subcontractors and outsourced providers? — Justification: Demonstrates ongoing oversight. Red flag: no audit cycle.

Select answer

Upload evidence for HMRC

Internal audit reports, compliance review logs

Short reason if answered N/A

Comments / Notes (Optional)

012. Can the umbrella evidence supply chain mapping of all subcontractors/intermediaries it uses? — Justification: Provides end-to-end visibility. Red flag: missing or outdated supply chain maps.

Select answer

Upload evidence for HMRC

Supply chain map, subcontractor list

Short reason if answered N/A

Comments / Notes (Optional)

013. If operating PAYE in parallel, is the PAYE scheme registered and active? — Justification: Confirms hybrid model is HMRC-recognised. Red flag: PAYE used without HMRC scheme.

Select answer

Upload evidence for HMRC

PAYE reference, HMRC letter

Short reason if answered N/A

Comments / Notes (Optional)

Section 3 – Banking, Money Flows & Outsourcing

This section tests financial transparency, the exclusive use of UK business bank accounts in the umbrella’s legal entity name, and disclosure of any outsourced CIS/payroll services.

HMRC flags phoenixing, hidden intermediaries, offshore accounts, and third-party banking as key indicators of fraud. Independent review of overrides and segregation of duties (payroll vs sales) are critical for CIS assurance.

Banking, Money Flows & Outsourcing

001. Are all CIS payments made into a UK business bank account in the umbrella’s legal entity name (matching Companies House)? — Justification: Prevents fraud/diversion of funds. Red flag: offshore, third-party, or mismatched accounts.

Select answer

Upload evidence for HMRC

Bank statement, verification letter

Short reason if answered N/A

Comments / Notes (Optional)

002. Do invoice bank details match the umbrella’s legal entity at Companies House? — Justification: Detects false invoicing or hidden accounts. Red flag: invoices with unrelated bank details.

Select answer

Upload evidence for HMRC

Sample invoices, CH extract, bank verification

Short reason if answered N/A

Comments / Notes (Optional)

003. Has the umbrella disclosed any subcontracted CIS/payroll services? — Justification: Identifies hidden outsourcing. Red flag: undeclared third-party processing.

Select answer

Upload evidence for HMRC

Subcontractor disclosure list

Short reason if answered N/A

Comments / Notes (Optional)

004. If subcontractors are used, has the umbrella completed full due diligence (UTR, VAT, PSC, MUC checks)? — Justification: Prevents hidden supply-chain fraud. Red flag: no due diligence or unverifiable subcontractors.

Select answer

Upload evidence for HMRC

Due diligence packs, HMRC/CH checks

Short reason if answered N/A

Comments / Notes (Optional)

005. Are payroll and compliance functions operationally separate from sales/commercial teams? — Justification: Ensures independence of governance. Red flag: sales staff influence compliance decisions.

Select answer

Upload evidence for HMRC

Org chart, job descriptions

Short reason if answered N/A

Comments / Notes (Optional)

006. Are any compliance overrides (e.g., non-standard payments, onboarding exceptions) logged and independently reviewed? — Justification: Confirms oversight of high-risk actions. Red flag: override log missing or no independent review.

Select answer

Upload evidence for HMRC

Override register, governance/audit logs

Short reason if answered N/A

Comments / Notes (Optional)

Section 4 – Payroll & Financial Assurance (CIS)

This section ensures CIS deductions are calculated and remitted accurately, reconciled with HMRC submissions, and supported by timely reporting. It checks whether the umbrella has been subject to HMRC CIS audits and how findings were addressed.

Payroll assurance in a CIS context means confirming that subcontractors’ tax deductions match filings, funds are not misapplied, and no disguised remuneration models are in use.

These controls protect workers, maintain supply chain integrity, and ensure the end-hirer is not exposed to hidden liabilities under HMRC or the 2026 JSL regime.

Payroll & Financial Assurance (CIS)

001. Does the umbrella reconcile CIS deductions against HMRC submissions on a monthly basis? — Justification: Ensures deductions declared equal those submitted. Red flag: discrepancies between payslips and HMRC returns.

Select answer

Upload evidence for HMRC

CIS reconciliation logs, HMRC portal exports

Short reason if answered N/A

Comments / Notes (Optional)

002. Has the umbrella been subject to any HMRC CIS compliance audit in the past 3 years, and were findings shared with end-hirers? — Justification: Demonstrates transparency and readiness. Red flag: adverse audit findings undisclosed.

Select answer

Upload evidence for HMRC

HMRC audit reports, correspondence

Short reason if answered N/A

Comments / Notes (Optional)

003. Are reconciliation statements provided to end-hirers confirming CIS deductions align with assignment rates and contracts? — Justification: Protects against under/over deductions. Red flag: no reconciliation pack for clients.

Select answer

Upload evidence for HMRC

Worker statements, reconciliation packs

Short reason if answered N/A

Comments / Notes (Optional)

004. Has the umbrella disclosed any subcontractors used for payroll/CIS processing, and have these been audited? — Justification: Ensures subcontractor transparency. Red flag: undisclosed payroll subcontractors.

Select answer

Upload evidence for HMRC

Subcontractor lists, due diligence packs

Short reason if answered N/A

Comments / Notes (Optional)

005. Are subcontractors contractually bound to HMRC CIS compliance standards? — Justification: Provides legal accountability. Red flag: vague/absent compliance clauses.

Select answer

Upload evidence for HMRC

Contracts, SLA clauses

Short reason if answered N/A

Comments / Notes (Optional)

006. Are outsourced CIS/payroll providers subject to regular compliance reviews and audit? — Justification: Confirms oversight. Red flag: no review logs for third-party providers.

Select answer

Upload evidence for HMRC

Audit reports, compliance logs

Short reason if answered N/A

Comments / Notes (Optional)

007. Are up-to-date contracts and SLAs in place for all outsourced CIS providers? — Justification: Confirms governance. Red flag: expired or missing SLAs.

Select answer

Upload evidence for HMRC

Contracts, SLA records

Short reason if answered N/A

Comments / Notes (Optional)

008. Are internal audits or spot checks performed on CIS deductions and submissions? — Justification: Strengthens assurance. Red flag: no internal checks performed.

Select answer

Upload evidence for HMRC

Audit reports, compliance logs

Short reason if answered N/A

Comments / Notes (Optional)

009. Has the umbrella received any HMRC penalties, late CIS return notices, or enforcement actions in the past 3 years? — Justification: Confirms compliance history. Red flag: repeated or ongoing penalties.

Select answer

Upload evidence for HMRC

HMRC penalty letters, correspondence

Short reason if answered N/A

Comments / Notes (Optional)

Section 5 – Worker Pay & Protections (CIS)

This section ensures CIS subcontractors are clearly informed of their financial responsibilities, payment terms, and deductions. HMRC and the 2026 JSL rules emphasise that end-hirers must prevent disguised employment, mis-selling of CIS, or wage skimming disguised as deductions.

Red flags include: lack of margin disclosure, misleading payslips, coercion into CIS without informed choice, or expenses used to mask taxable income.

Worker Pay & Protections (CIS)

001. Has the umbrella assessed whether CIS workers understand their self-employment responsibilities (tax, NIC, no holiday pay entitlements)? — Justification: Confirms workers know CIS ≠ employment. Red flag: workers think they are employees with rights.

Select answer

Upload evidence for HMRC

Worker onboarding survey, signed declaration

Short reason if answered N/A

Comments / Notes (Optional)

002. Are CIS payslips/remittances itemised to show gross pay, CIS deduction, and umbrella margin? — Justification: Ensures transparency of deductions. Red flag: hidden deductions/margin skimming.

Select answer

Upload evidence for HMRC

Sample remittances, pay breakdowns

Short reason if answered N/A

Comments / Notes (Optional)

003. Are CIS deductions reconciled against HMRC submissions and explained to workers? — Justification: Ensures workers can verify accuracy. Red flag: payslips don’t match HMRC filings.

Select answer

Upload evidence for HMRC

CIS reconciliation logs, HMRC submission records

Short reason if answered N/A

Comments / Notes (Optional)

004. Are subcontractors given a written comparison of CIS vs PAYE vs umbrella models before onboarding? — Justification: Ensures informed choice. Red flag: workers pushed into CIS without comparison.

Select answer

Upload evidence for HMRC

Comparison docs, onboarding scripts

Short reason if answered N/A

Comments / Notes (Optional)

005. Has the umbrella confirmed CIS workers do not receive employment-style benefits (holiday pay, grievance rights, paid leave)? — Justification: Prevents disguised employment. Red flag: CIS workers given employee-style rights.

Select answer

Upload evidence for HMRC

Worker contracts, policy statements

Short reason if answered N/A

Comments / Notes (Optional)

006. Are workers advised in writing they must save for tax/NIC and are not entitled to pensions or AWR parity? — Justification: Reinforces self-employment responsibilities. Red flag: workers assume umbrella covers tax or pensions.

Select answer

Upload evidence for HMRC

Onboarding packs, induction scripts

Short reason if answered N/A

Comments / Notes (Optional)

007. Are CIS expenses limited to allowable HMRC categories and supported by receipts? — Justification: Prevents disguised remuneration. Red flag: inflated or false expenses.

Select answer

Upload evidence for HMRC

Expense policy, receipts, logs

Short reason if answered N/A

Comments / Notes (Optional)

008. Are workers provided with Key Information Documents (KIDs) tailored for CIS? — Justification: Ensures pay transparency. Red flag: no CIS-specific KID issued.

Select answer

Upload evidence for HMRC

Sample CIS KID, onboarding documents

Short reason if answered N/A

Comments / Notes (Optional)

009. Have staff been trained to explain CIS deductions and spot coercion, mis-selling, or exploitation risks? — Justification: Confirms compliance awareness. Red flag: staff unable to explain deductions or spot abuse.

Select answer

Upload evidence for HMRC

Training logs, compliance manuals

Short reason if answered N/A

Comments / Notes (Optional)

010. Does the umbrella confirm that Employer NIC is not deducted from worker pay under CIS? — Justification: Protects against disguised PAYE. Red flag: NIC costs shifted onto workers.

Select answer

Upload evidence for HMRC

Payslips, payroll logs

Short reason if answered N/A

Comments / Notes (Optional)

011. Are controls in place to prevent CIS being used as disguised remuneration (e.g., loan schemes, net pay disguises)? — Justification: Ensures HMRC compliance. Red flag: CIS used to mask PAYE income.

Select answer

Upload evidence for HMRC

Worker contracts, payment flow review

Short reason if answered N/A

Comments / Notes (Optional)

Section 6 – Employment Status Assessment (CIS)

This section verifies that CIS umbrellas are correctly assessing employment status before paying workers. HMRC requires CIS status checks, retained evidence, and periodic reviews to avoid misclassification.

Red flags include workers treated as employees (e.g. fixed hours, direction, statutory rights) while under CIS, or no evidence of SDC reviews.

Employment Status Assessment (CIS)

001. Does the umbrella assess CIS worker status before making the first payment? — Justification: Confirms upfront compliance. Red flag: CIS payments made with no assessment.

Select answer

Upload evidence for HMRC

Status assessment forms, SDC questionnaires

Short reason if answered N/A

Comments / Notes (Optional)

002. Is there a documented policy or SOP for conducting CIS status reviews? — Justification: Ensures consistent approach. Red flag: ad hoc/unwritten processes.

Select answer

Upload evidence for HMRC

Policy document, SOP

Short reason if answered N/A

Comments / Notes (Optional)

003. Is there retained evidence of all CIS status determinations? — Justification: Enables audit trail. Red flag: no evidence = HMRC assumes non-compliance.

Select answer

Upload evidence for HMRC

Archived records, CRM screenshots

Short reason if answered N/A

Comments / Notes (Optional)

004. Can the umbrella report the number of CIS vs PAYE workers, by sector or role? — Justification: Provides visibility for risk analysis. Red flag: no workforce data split.

Select answer

Upload evidence for HMRC

Workforce reports, sector breakdowns

Short reason if answered N/A

Comments / Notes (Optional)

005. For CIS workers outside SDC, does the umbrella confirm they control how work is done? — Justification: Validates self-employment. Red flag: client/umbrella dictates working methods.

Select answer

Upload evidence for HMRC

Assessment responses, contracts

Short reason if answered N/A

Comments / Notes (Optional)

006. Is it confirmed the worker’s job location cannot be changed without their consent? — Justification: Protects autonomy. Red flag: unilateral reallocation of sites.

Select answer

Upload evidence for HMRC

Onboarding questionnaires, signed terms

Short reason if answered N/A

Comments / Notes (Optional)

007. Is it confirmed the worker chooses their own working hours? — Justification: Confirms independence. Red flag: fixed hours imposed.

Select answer

Upload evidence for HMRC

Worker declarations, contracts

Short reason if answered N/A

Comments / Notes (Optional)

008. If a worker fails CIS status checks, does the umbrella reclassify them to PAYE? — Justification: Ensures remediation. Red flag: failed checks but still paid under CIS.

Select answer

Upload evidence for HMRC

Reclassification logs, PAYE notices

Short reason if answered N/A

Comments / Notes (Optional)

009. Is there evidence the umbrella reviews all CIS risk factors (SDC, substitution, mutuality)? — Justification: Demonstrates decision-making. Red flag: blanket or unchecked CIS classification.

Select answer

Upload evidence for HMRC

Risk matrices, annotated reviews

Short reason if answered N/A

Comments / Notes (Optional)

010. Do CIS workers confirm a genuine right of substitution? — Justification: Validates contractor status. Red flag: substitution clause absent or blocked.

Select answer

Upload evidence for HMRC

Signed declarations, contract clause

Short reason if answered N/A

Comments / Notes (Optional)

011. Do workers confirm no mutuality of obligation exists? — Justification: Confirms no guarantee of ongoing work. Red flag: rolling or guaranteed assignments.

Select answer

Upload evidence for HMRC

Worker declarations, contracts

Short reason if answered N/A

Comments / Notes (Optional)

012. Do workers confirm they are not under supervision, direction, or control (SDC)? — Justification: Validates autonomy. Red flag: evidence of client/umbrella control.

Select answer

Upload evidence for HMRC

Questionnaires, role profiles

Short reason if answered N/A

Comments / Notes (Optional)

013. Do workers confirm they carry financial risk and are liable for defects/rework? — Justification: Establishes commercial risk. Red flag: no liability = employee-like.

Select answer

Upload evidence for HMRC

Contract clauses, signed declarations

Short reason if answered N/A

Comments / Notes (Optional)

014. Do workers confirm they have no entitlement to statutory employment rights (holiday pay, sick pay)? — Justification: Confirms non-employee status. Red flag: CIS workers granted statutory rights.

Select answer

Upload evidence for HMRC

Self-employment confirmations, contracts

Short reason if answered N/A

Comments / Notes (Optional)

015. Do workers confirm they are responsible for their own tax and NICs? — Justification: Reinforces CIS obligations. Red flag: umbrella assumes responsibility.

Select answer

Upload evidence for HMRC

Worker declaration, onboarding script

Short reason if answered N/A

Comments / Notes (Optional)

016. Do workers confirm they are (or will be) registered with HMRC for self-employment (UTR)? — Justification: Confirms tax legitimacy. Red flag: CIS workers paid gross with no UTR.

Select answer

Upload evidence for HMRC

UTR evidence, HMRC confirmation

Short reason if answered N/A

Comments / Notes (Optional)

017. Do workers confirm they were not previously employees of the same client? — Justification: Prevents disguised employment. Red flag: ex-employees re-engaged as CIS.

Select answer

Upload evidence for HMRC

New starter forms, declarations

Short reason if answered N/A

Comments / Notes (Optional)

018. Does the umbrella screen CIS roles for IR35-style risk factors (SDC, substitution, mutuality)? — Justification: Avoids borderline disguised employment. Red flag: no IR35 awareness for CIS roles.

Select answer

Upload evidence for HMRC

Risk checklists, questionnaires

Short reason if answered N/A

Comments / Notes (Optional)

019. Is there a documented schedule for monthly/quarterly CIS status rechecks on long-term assignments? — Justification: Captures changes over time. Red flag: static, one-off assessments.

Select answer

Upload evidence for HMRC

Status review logs, CRM recheck records

Short reason if answered N/A

Comments / Notes (Optional)

020. Has the umbrella sought professional/legal advice on borderline CIS roles where status is unclear? — Justification: Adds defensible due diligence. Red flag: grey areas left unaudited.

Select answer

Upload evidence for HMRC

Legal opinions, advisory letters

Short reason if answered N/A

Comments / Notes (Optional)

Section 7 – Assignment Suitability & Worker Monitoring

This section ensures all CIS assignments meet the HMRC CIS340 definition of “construction operations” and are monitored for ongoing compliance.

End-hirers are accountable if workers are misclassified or continue in CIS despite failing supervision/direction/control (SDC) checks.

Red flags include CIS used for non-construction roles, underpaid subcontractors, or lack of periodic re-checks.

Assignment Suitability & Worker Monitoring

001. Are Key Information Documents (KIDs) issued before each CIS assignment, setting out pay rates, deductions, and margins? — Justification: Ensures transparency. Red flag: no CIS-specific KIDs, incomplete or misleading pay details.

Select answer

Upload evidence for HMRC

Sample CIS KID, onboarding pack

Short reason if answered N/A

Comments / Notes (Optional)

002. Does the umbrella confirm that all CIS assignments qualify as “construction operations” under CIS340? — Justification: Aligns with HMRC scope. Red flag: CIS used for non-construction roles.

Select answer

Upload evidence for HMRC

Assignment classification evidence, CIS340 mapping

Short reason if answered N/A

Comments / Notes (Optional)

003. Are any CIS workers paid below £14/hour? — Justification: Identifies vulnerable/misclassified workers. Red flag: consistently low pay suggests disguised PAYE or exploitation.

Select answer

Upload evidence for HMRC

Payroll reports, pay audit trails

Short reason if answered N/A

Comments / Notes (Optional)

004. Is the proportion of high-risk workers (low-paid, borderline CIS) under 5% of the total CIS workforce? — Justification: Confirms CIS workforce integrity. Red flag: high percentage of borderline cases = systemic risk.

Select answer

Upload evidence for HMRC

Workforce risk matrix, classification summary

Short reason if answered N/A

Comments / Notes (Optional)

005. Does the umbrella re-contact CIS workers monthly to confirm working practices haven’t changed? — Justification: Maintains up-to-date compliance. Red flag: long assignments with no follow-up = SDC drift.

Select answer

Upload evidence for HMRC

Communication logs, call/email records

Short reason if answered N/A

Comments / Notes (Optional)

006. Is worker status formally re-reviewed at least every 6 months? — Justification: Captures material changes. Red flag: no periodic rechecks = stale compliance.

Select answer

Upload evidence for HMRC

Review logs, recheck schedules

Short reason if answered N/A

Comments / Notes (Optional)

007. Are SDC/status compliance policies shared with all agencies in the chain? — Justification: Ensures aligned supply chain practices. Red flag: agencies unaware of CIS restrictions.

Select answer

Upload evidence for HMRC

Policy documents, agency communications

Short reason if answered N/A

Comments / Notes (Optional)

008. Do agencies confirm that CIS workers are not placed in prohibited roles or under SDC? — Justification: Confirms agencies enforce CIS limits. Red flag: CIS workers directed/controlled by clients.

Select answer

Upload evidence for HMRC

Signed attestations, agency declarations

Short reason if answered N/A

Comments / Notes (Optional)

009. Does the umbrella confirm to workers that failing SDC tests means they must switch to PAYE? — Justification: Promotes transparency. Red flag: failed SDC cases left under CIS = hidden PAYE liability.

Select answer

Upload evidence for HMRC

Onboarding scripts, worker notices

Short reason if answered N/A

Comments / Notes (Optional)

Section 8 – Contract Terms (CIS)

This section ensures umbrella CIS contracts clearly establish self-employment and exclude employment-style rights.

HMRC expects contracts to reflect actual working practices.

Red flags include missing substitution clauses, entitlement to holiday pay, or contracts that resemble PAYE terms.

Contract Terms (CIS)

001. Are all subcontractors/intermediaries in CIS mapped and verified for UTR status? — Justification: Confirms only registered CIS entities are engaged. Red flag: hidden intermediaries or no UTR.

Select answer

Upload evidence for HMRC

Subcontractor list, UTR checks, due diligence reports

Short reason if answered N/A

Comments / Notes (Optional)

002. Do CIS contracts include a genuine right of substitution? — Justification: Confirms self-employment flexibility. Red flag: no substitution allowed = employment.

Select answer

Upload evidence for HMRC

Contracts with substitution clause

Short reason if answered N/A

Comments / Notes (Optional)

003. Do contracts exclude mutuality of obligation? — Justification: Prevents ongoing obligation to provide/accept work. Red flag: mutuality present = disguised employment.

Select answer

Upload evidence for HMRC

Worker agreement, terms of engagement

Short reason if answered N/A

Comments / Notes (Optional)

004. Do contracts exclude supervision, direction, or control clauses? — Justification: Confirms subcontractor autonomy. Red flag: SDC clauses included.

Select answer

Upload evidence for HMRC

Contracts, exclusion wording

Short reason if answered N/A

Comments / Notes (Optional)

005. Do contracts confirm the worker carries liability for defects/rework? — Justification: Establishes commercial risk. Red flag: no liability clause = employment-like.

Select answer

Upload evidence for HMRC

Defect liability clause

Short reason if answered N/A

Comments / Notes (Optional)

006. Do contracts include a clause denying entitlement to employment rights (e.g. sick pay, holiday)? — Justification: Clarifies non-employee status. Red flag: contract grants statutory rights.

Select answer

Upload evidence for HMRC

Non-entitlement clause

Short reason if answered N/A

Comments / Notes (Optional)

007. Do contracts confirm the worker is responsible for their own tax and NICs? — Justification: Reinforces self-employment obligations. Red flag: umbrella assumes tax duties = PAYE risk.

Select answer

Upload evidence for HMRC

Contract clauses, self-certification

Short reason if answered N/A

Comments / Notes (Optional)

008. Is UTR registration or self-employment confirmation included in contracts? — Justification: Confirms tax compliance. Red flag: no UTR clause = bogus CIS.

Select answer

Upload evidence for HMRC

UTR evidence, contract

Short reason if answered N/A

Comments / Notes (Optional)

009. Is it confirmed the worker was not recently employed by the same client? — Justification: Prevents “recycled employees” via CIS. Red flag: ex-employees re-engaged under CIS.

Select answer

Upload evidence for HMRC

Onboarding forms, declarations

Short reason if answered N/A

Comments / Notes (Optional)

010. Do contracts prohibit “pay-when-paid” clauses? — Justification: Protects subcontractors from delayed pay. Red flag: pay-when-paid clauses undermine worker protection.

Select answer

Upload evidence for HMRC

Contract wording

Short reason if answered N/A

Comments / Notes (Optional)

011. Are updated contracts or project variations issued when requested? — Justification: Demonstrates transparency and compliance. Red flag: no updates despite scope changes.

Select answer

Upload evidence for HMRC

Version history, amendment logs

Short reason if answered N/A

Comments / Notes (Optional)

012. Is there a documented escalation process for complaints (e.g., ACAS-style early resolution, referral to agency/end-hirer)? — Justification: Ensures fair worker treatment & legal compliance. Red flag: no escalation beyond umbrella.

Select answer

Upload evidence for HMRC

Escalation policy, complaints log

Short reason if answered N/A

Comments / Notes (Optional)

Section 9 – Payments, Returns & Insurances

This section ensures CIS umbrellas deduct and remit CIS tax correctly, file CIS returns on time, and maintain insurance to cover risks.

HMRC expects accurate deduction, timely filing, and transparent remittance.

Red flags include late or missing returns, deductions not passed to HMRC, missing insurance cover, or disguised remuneration routed through CIS.

Payments, Returns & Insurances

001. Does the umbrella issue itemised remittance advice with every CIS payment? — Justification: Ensures workers see deductions clearly. Red flag: no itemised statements → hidden deductions.

Select answer

Upload evidence for HMRC

Payslips, remittance statements

Short reason if answered N/A

Comments / Notes (Optional)

002. Is the umbrella’s margin disclosed to workers before assignments start? — Justification: Confirms fee transparency. Red flag: hidden or fluctuating margin.

Select answer

Upload evidence for HMRC

KID, margin sheet

Short reason if answered N/A

Comments / Notes (Optional)

003. Is CIS tax calculated and deducted accurately from gross pay? — Justification: Confirms HMRC compliance. Red flag: over/under-deductions.

Select answer

Upload evidence for HMRC

Payroll records, deduction logs

Short reason if answered N/A

Comments / Notes (Optional)

004. Are deductions reconciled monthly against HMRC CIS submissions? — Justification: Prevents mismatched filings. Red flag: payslips don’t match HMRC returns.

Select answer

Upload evidence for HMRC

CIS reconciliation logs, HMRC portal exports

Short reason if answered N/A

Comments / Notes (Optional)

005. Has the umbrella submitted any CIS returns late in the past 12 months? — Justification: Tests timeliness. Red flag: late returns = HMRC penalties.

Select answer

Upload evidence for HMRC

Filing history, HMRC portal report

Short reason if answered N/A

Comments / Notes (Optional)

006. Has CIS tax ever been paid late? — Justification: Tests financial controls. Red flag: delayed remittance = financial mismanagement.

Select answer

Upload evidence for HMRC

Payment logs, bank records

Short reason if answered N/A

Comments / Notes (Optional)

007. Is a PAYE fallback process available if workers fail CIS status tests? — Justification: Ensures continuity of pay. Red flag: failed CIS cases left unpaid or still under CIS.

Select answer

Upload evidence for HMRC

PAYE fallback process docs

Short reason if answered N/A

Comments / Notes (Optional)

008. Does the umbrella retain subcontractor verification evidence (gross/net status)? — Justification: Confirms deduction accuracy. Red flag: no HMRC verification.

Select answer

Upload evidence for HMRC

HMRC verification logs

Short reason if answered N/A

Comments / Notes (Optional)

009. Are CIS returns filed accurately and on time each period? — Justification: Confirms robust compliance. Red flag: error-prone or missing returns.

Select answer

Upload evidence for HMRC

CIS portal output, HMRC receipts

Short reason if answered N/A

Comments / Notes (Optional)

010. Are there any current HMRC penalties or correspondence regarding CIS compliance? — Justification: Detects live compliance issues. Red flag: active HMRC sanctions.

Select answer

Upload evidence for HMRC

Penalty notices, HMRC letters

Short reason if answered N/A

Comments / Notes (Optional)

011. Are there any active disputes with HMRC regarding CIS tax treatment? — Justification: Identifies unresolved risk. Red flag: ongoing disputes = liability exposure.

Select answer

Upload evidence for HMRC

Legal correspondence, internal memos

Short reason if answered N/A

Comments / Notes (Optional)

012. Does the umbrella hold valid Professional Indemnity (PI) insurance? — Justification: Protects against negligence. Red flag: no PI insurance.

Select answer

Upload evidence for HMRC

Insurance certificate

Short reason if answered N/A

Comments / Notes (Optional)

013. Is Employers’ Liability (EL) insurance in place (contingent claims)? — Justification: Covers grey areas if CIS reclassified. Red flag: no EL cover.

Select answer

Upload evidence for HMRC

EL insurance certificate

Short reason if answered N/A

Comments / Notes (Optional)

014. Is Public Liability (PL) insurance in place? — Justification: Protects against injury/property claims. Red flag: no PL cover.

Select answer

Upload evidence for HMRC

PL insurance schedule

Short reason if answered N/A

Comments / Notes (Optional)

015. Is credit insurance in place to mitigate client insolvency risk (if applicable)? — Justification: Ensures financial continuity. Red flag: no cover in high-risk supply chains.

Select answer

Upload evidence for HMRC

Credit insurance certificate, broker statement

Short reason if answered N/A

Comments / Notes (Optional)

016. Are audit trails and contracts stored securely with access controls? — Justification: Confirms integrity of records. Red flag: insecure storage = audit failure.

Select answer

Upload evidence for HMRC

IT security policy, system screenshots

Short reason if answered N/A

Comments / Notes (Optional)

017. Are digital records versioned and auditable for HMRC inspection? — Justification: Confirms audit readiness. Red flag: no version history.

Select answer

Upload evidence for HMRC

System audit exports, version logs

Short reason if answered N/A

Comments / Notes (Optional)

Section 10 – Tax Risk (IR35, Disguised Remuneration, DRC VAT)

This section ensures CIS umbrellas are not facilitating disguised remuneration, VAT misuse, or phoenix fraud.

HMRC applies the Kittel principle (denying VAT claims if fraud was “known or should have been known”), and the 2026 JSL regime means end-hirers can be liable for downstream misconduct.

Red flags include invalid VAT numbers, phoenix activity, disguised PAYE through CIS, or MUC-linked invoices.

Tax Risk (IR35, Disguised Remuneration, DRC VAT)

001. Is the umbrella’s VAT registration validated with HMRC/VIES and active? — Justification: Confirms VAT legitimacy. Red flag: dormant/invalid VAT used.

Select answer

Upload evidence for HMRC

HMRC VAT checker, VIES screenshot

Short reason if answered N/A

Comments / Notes (Optional)

002. Have VAT returns or remittance evidence been reviewed? — Justification: Confirms VAT is paid not just invoiced. Red flag: VAT collected but not remitted.

Select answer

Upload evidence for HMRC

VAT100, HMRC payment receipts

Short reason if answered N/A

Comments / Notes (Optional)

003. Do umbrella invoices meet VAT compliance standards (correct entity, rate, breakdown)? — Justification: Ensures lawful reclaim of VAT. Red flag: incorrect or fake invoices.

Select answer

Upload evidence for HMRC

2–3 sample invoices

Short reason if answered N/A

Comments / Notes (Optional)

004. Do invoices reconcile with payments and CIS submissions? — Justification: Prevents double invoicing or under-reporting. Red flag: mismatch between invoices and CIS data.

Select answer

Upload evidence for HMRC

Payment ledger vs CIS/RTI

Short reason if answered N/A

Comments / Notes (Optional)

005. Has the umbrella been screened for VAT deregistration, phoenixing, or insolvency? — Justification: Identifies high-risk entities. Red flag: phoenix company replaces failed entity.

Select answer

Upload evidence for HMRC

CH monitoring, audit reports

Short reason if answered N/A

Comments / Notes (Optional)

006. Are Domestic Reverse Charge (DRC) VAT rules applied correctly for construction? — Justification: Confirms VAT Notice 735 compliance. Red flag: DRC omitted/misapplied.

Select answer

Upload evidence for HMRC

Invoice samples, internal VAT policy

Short reason if answered N/A

Comments / Notes (Optional)

007. Is the umbrella aware of its DRC obligations and trained staff accordingly? — Justification: Prevents shared VAT liability. Red flag: staff unaware of DRC.

Select answer

Upload evidence for HMRC

Training records, contracts

Short reason if answered N/A

Comments / Notes (Optional)

008. Are VAT claims excluded from invoices linked to Mini Umbrella Companies (MUCs)? — Justification: Prevents MUC fraud. Red flag: VAT reclaimed from MUC chains.

Select answer

Upload evidence for HMRC

MUC due diligence logs

Short reason if answered N/A

Comments / Notes (Optional)

009. Are controls in place to detect disguised remuneration (e.g. loans, expenses, hybrid PAYE/CIS)? — Justification: Protects against HMRC challenge. Red flag: CIS used to disguise PAYE income.

Select answer

Upload evidence for HMRC

SDS reviews, contract model audits

Short reason if answered N/A

Comments / Notes (Optional)

010. Does the umbrella assess IR35-style risks (SDC, substitution, mutuality) for borderline CIS roles? — Justification: Prevents disguised employment under CIS. Red flag: IR35 risks ignored.

Select answer

Upload evidence for HMRC

Risk checklists, questionnaires

Short reason if answered N/A

Comments / Notes (Optional)

011. Is Kittel risk (“knew or should have known” of VAT fraud) assessed and documented? — Justification: Prevents denied VAT reclaims. Red flag: no Kittel log = higher liability.

Select answer

Upload evidence for HMRC

Kittel logs, risk assessments

Short reason if answered N/A

Comments / Notes (Optional)

012. Are all payments made into UK business bank accounts in the umbrella’s registered name? — Justification: Ensures funds are not diverted. Red flag: offshore or mismatched accounts.

Select answer

Upload evidence for HMRC

Payment trail, bank verification

Short reason if answered N/A

Comments / Notes (Optional)

013. Does the umbrella maintain a due diligence log tracking VAT/tax risk reviews? — Justification: Demonstrates CFA 2017 & JSL compliance. Red flag: no audit trail.

Select answer

Upload evidence for HMRC

Verification logs, onboarding checklist

Short reason if answered N/A

Comments / Notes (Optional)

Section 11 – Criminal Finances Act 2017 (CFA) Compliance

This section checks whether the umbrella has robust measures to prevent the facilitation of tax evasion, as required under Section 45 of the Criminal Finances Act 2017.

It validates risk assessments, anti-facilitation controls, escalation routes, and whistleblowing mechanisms.

These measures protect end-hirers from joint liability if umbrellas or their subcontractors enable tax evasion.

Criminal Finances Act 2017 (CFA) Compliance

001. Has the umbrella conducted a documented CFA 2017 risk assessment (updated ≤12m)? — Justification: Confirms compliance. Red flag: no current assessment.

Select answer

Upload evidence for HMRC

Risk assessment

Short reason if answered N/A

Comments / Notes (Optional)

002. Is there a board-approved anti-facilitation policy communicated to staff and subcontractors? — Justification: Sets tone-from-the-top. Red flag: policy draft/unpublished.

Select answer

Upload evidence for HMRC

Policy + comms record

Short reason if answered N/A

Comments / Notes (Optional)

003. Are staff in sales/onboarding/payroll trained annually on CFA red flags and escalation? — Justification: High-risk teams covered. Red flag: no training logs.

Select answer

Upload evidence for HMRC

LMS/export, attendance

Short reason if answered N/A

Comments / Notes (Optional)

004. Are subcontractor contracts flowed-down with CFA/anti-evasion clauses and audit rights? — Justification: Extends prevention across chain. Red flag: silent contracts.

Select answer

Upload evidence for HMRC

Sample contracts/SLA

Short reason if answered N/A

Comments / Notes (Optional)

005. Is there a confidential whistleblowing route and an investigations log for suspected facilitation? — Justification: Detects/responds quickly. Red flag: no log/no outcomes.

Select answer

Upload evidence for HMRC

Hotline policy, case log

Short reason if answered N/A

Comments / Notes (Optional)

Section 12 – Identity, RTW & Core GDPR (CIS)

This section confirms that the umbrella performs compliant Right to Work (RTW) checks, secures worker identity data, and manages GDPR obligations lawfully.

It also integrates Modern Slavery Act safeguards and checks that workers are employed directly by the umbrella (not hidden entities).

Under the JSL regime (2026), end-hirers remain jointly responsible for worker protection and lawful engagement — so auditable evidence is critical.

Identity, RTW & Core GDPR (CIS)

001. Has the umbrella completed an Article 30 GDPR Record of Processing Activities (RoPA) for CIS worker data? — Justification: Confirms GDPR accountability. Red flag: no RoPA or last update >12m.

Select answer

Upload evidence for HMRC

RoPA doc

Short reason if answered N/A

Comments / Notes (Optional)

002. Is the umbrella registered with the ICO and does the entry match the trading entity? — Justification: Confirms legal basis to process data. Red flag: no/expired ICO entry.

Select answer

Upload evidence for HMRC

ICO registration certificate/URL capture

Short reason if answered N/A

Comments / Notes (Optional)

003. Are access controls, MFA and audit logs enabled on payroll/CIS systems? — Justification: Prevents unauthorised data/payment changes. Red flag: no MFA/no logs.

Select answer

Upload evidence for HMRC

Screenshots, policy, recent log export

Short reason if answered N/A

Comments / Notes (Optional)

004. Is there a DSAR/breach response procedure with a 72-hour notification workflow? — Justification: Meets UK GDPR incident duties. Red flag: ad-hoc or email-only process.

Select answer

Upload evidence for HMRC

Policy, playbook, last test record

Short reason if answered N/A

Comments / Notes (Optional)

005. Are retention schedules applied (with deletion logs) for CIS worker files (ID, RTW, contracts, remittances)? — Justification: Article 5 data minimisation. Red flag: indefinite retention/no deletion proof.

Select answer

Upload evidence for HMRC

Retention policy, deletion logs

Short reason if answered N/A

Comments / Notes (Optional)

Section 13 – Business Continuity, Cybersecurity & Exit Planning

Ensures umbrellas can maintain payroll/data integrity, withstand disruptions, and transfer records securely if they cease trading.

Business Continuity, Cybersecurity & Exit Planning

001. Is there a documented Business Continuity Plan covering CIS payroll, with a test in the last 12 months? — Justification: Ensures pay continuity. Red flag: untested plan.

Select answer

Upload evidence for HMRC

BCP + test report

Short reason if answered N/A

Comments / Notes (Optional)

002. Are CIS payroll databases backed up daily with successful restore tests? — Justification: Protects data integrity. Red flag: backups without restore tests.

Select answer

Upload evidence for HMRC

Backup + restore logs

Short reason if answered N/A

Comments / Notes (Optional)

003. Is there a documented exit/transition plan to safely transfer CIS operations/data? — Justification: Lowers exit risk. Red flag: no data extraction/hand-over steps.

Select answer

Upload evidence for HMRC

Exit plan

Short reason if answered N/A

Comments / Notes (Optional)

004. Are privileged changes (bank files, pay runs) dual-approved with change logs? — Justification: Prevents fraud/error. Red flag: single-operator changes.

Select answer

Upload evidence for HMRC

Change/approval logs

Short reason if answered N/A

Comments / Notes (Optional)

Section 14 – Modern Slavery Risk Management (CIS)

This section tests whether the umbrella identifies and mitigates risks of labour exploitation, trafficking, or coercion in its CIS operations. HMRC, the GLAA, and the Modern Slavery Act 2015 expect proactive due diligence.

Red flags include missing policies, no RTW checks, recruitment fee charging, or lack of escalation channels.

Modern Slavery Risk Management (CIS)

001. Does the umbrella have a Modern Slavery Policy applying to its supply chain (including subcontractors & outsourced payroll)? — Justification: Confirms governance baseline. Red flag: no policy in place.

Select answer

Upload evidence for HMRC

Modern Slavery Policy, subcontractor codes of conduct

Short reason if answered N/A

Comments / Notes (Optional)

002. Has the umbrella conducted a Modern Slavery risk assessment in the past 12 months? — Justification: Demonstrates proactive identification of risks. Red flag: outdated or absent risk assessment.

Select answer

Upload evidence for HMRC

Risk logs, heatmaps, supplier assessments

Short reason if answered N/A

Comments / Notes (Optional)

003. Is Modern Slavery awareness training provided to onboarding, payroll & compliance staff? — Justification: Ensures frontline detection of exploitation. Red flag: no training logs.

Select answer

Upload evidence for HMRC

LMS records, signed training certificates

Short reason if answered N/A

Comments / Notes (Optional)

004. Are Right to Work (RTW) checks completed & retained for every CIS worker? — Justification: Prevents illegal working/trafficking. Red flag: missing RTW documents.

Select answer

Upload evidence for HMRC

RTW records, ID scans, audit logs

Short reason if answered N/A

Comments / Notes (Optional)

005. Has the umbrella confirmed it does not charge recruitment fees or impose unlawful deductions (e.g., admin fees, clawbacks)? — Justification: Prevents debt bondage & forced labour. Red flag: evidence of unlawful deductions.

Select answer

Upload evidence for HMRC

Payslips, contracts, worker declarations

Short reason if answered N/A

Comments / Notes (Optional)

006. Does the umbrella provide an anonymous whistleblowing mechanism for workers? — Justification: Enables safe escalation. Red flag: no hotline/anonymous reporting channel.

Select answer

Upload evidence for HMRC

Whistleblowing policy, hotline logs

Short reason if answered N/A

Comments / Notes (Optional)

007. Has the umbrella taken any action in the past 12 months in response to worker welfare or exploitation concerns? — Justification: Demonstrates responsiveness. Red flag: complaints ignored/uninvestigated.

Select answer

Upload evidence for HMRC

Case reports, investigation outcomes

Short reason if answered N/A

Comments / Notes (Optional)

008. Has the umbrella shared a Modern Slavery compliance statement/assurance declaration with the end-hirer in the past 12 months? — Justification: Confirms accountability across the chain. Red flag: no shared assurance.

Select answer

Upload evidence for HMRC

Signed assurance, board-approved statement

Short reason if answered N/A

Comments / Notes (Optional)

009. Do umbrella contracts include Modern Slavery clauses giving the end-hirer audit/escalation rights? — Justification: Embeds enforceable accountability. Red flag: contracts silent on Modern Slavery.

Select answer

Upload evidence for HMRC

Contract extracts, PSL terms

Short reason if answered N/A

Comments / Notes (Optional)

010. Does the umbrella monitor for exploitation indicators (e.g., excessive turnover, withheld wages, tied housing)? — Justification: Detects coercion trends. Red flag: no monitoring, sudden turnover spikes ignored.

Select answer

Upload evidence for HMRC

Worker feedback, turnover logs, retention analysis

Short reason if answered N/A

Comments / Notes (Optional)

Section 15 – Expenses, Lodge & CITB (sector-specific)

This section ensures the umbrella handles sector-specific obligations (CITB levy and lodge payments) and does not misuse expenses to disguise pay.

HMRC and CITB audits focus on levy compliance, temporary workplace tests, and genuine expense evidence.

Red flags include levy evasion, over-claimed lodging, or home-to-work travel disguised as business expenses.

Expenses, Lodge & CITB (sector-specific)

001. Is the umbrella registered with the CITB Levy scheme (where applicable)? — Justification: Confirms statutory levy obligations. Red flag: no CITB registration despite being in-scope.

Select answer

Upload evidence for HMRC

CITB registration letter

Short reason if answered N/A

Comments / Notes (Optional)

002. Does the umbrella retain CIS worker & payroll records suitable for CITB audits? — Justification: Demonstrates levy base tracking. Red flag: incomplete or missing records.

Select answer

Upload evidence for HMRC

Payroll reports, subcontractor registers

Short reason if answered N/A

Comments / Notes (Optional)

003. Has the umbrella undergone a CITB audit/spot check in the past 3 years? — Justification: Confirms oversight engagement. Red flag: adverse audit findings undisclosed.

Select answer

Upload evidence for HMRC

CITB audit letter, correspondence

Short reason if answered N/A

Comments / Notes (Optional)

004. Are policies in place to prevent levy misclassification of roles? — Justification: Ensures levy categorisation accuracy. Red flag: no internal guidance.

Select answer

Upload evidence for HMRC

Internal policy, levy eligibility checklist

Short reason if answered N/A

Comments / Notes (Optional)

005. Are lodge payments made only under HMRC exemptions/WRA provisions? — Justification: Confirms compliance with tax rules. Red flag: blanket lodge payments without eligibility check.

Select answer

Upload evidence for HMRC

Worker declarations, exemption policies

Short reason if answered N/A

Comments / Notes (Optional)

006. Are signed lodge allowance forms held for all eligible workers? — Justification: Provides audit trail. Red flag: missing signed forms.

Select answer

Upload evidence for HMRC

Signed forms, lodge audit logs

Short reason if answered N/A

Comments / Notes (Optional)

007. Does the umbrella confirm lodge payments are only made where the “temporary workplace” test is met? — Justification: Prevents misuse of travel & subsistence relief. Red flag: payments made for permanent sites.

Select answer

Upload evidence for HMRC

Job role mapping, site movement records

Short reason if answered N/A

Comments / Notes (Optional)

008. Are only genuine business expenses reimbursed (not home-to-work travel)? — Justification: Prevents disguised remuneration. Red flag: travel-to-site claimed as business expense.

Select answer

Upload evidence for HMRC

Expense policy, sample claims

Short reason if answered N/A

Comments / Notes (Optional)

009. Are receipts & supporting docs retained for all expense claims? — Justification: Confirms transparency and auditability. Red flag: no receipts or generic expense claims.

Select answer

Upload evidence for HMRC

Receipt logs, scanned docs

Short reason if answered N/A

Comments / Notes (Optional)

010. Are expenses subject to periodic audits or spot checks? — Justification: Prevents fraud/abuse. Red flag: no internal audit trail.

Select answer

Upload evidence for HMRC

Expense audit logs, QA check reports

Short reason if answered N/A

Comments / Notes (Optional)

Section 16 – Employment Intermediary Reporting Requirements (EIRR) & Mini Umbrella Company (MUC) Risk

This section ensures umbrellas comply with quarterly HMRC EIRR submissions and are not involved in Mini Umbrella Company (MUC) fraud.

EIRR gives HMRC visibility over worker supply chains, while MUC abuse (PAYE fragmentation, multiple schemes, or Employment Allowance misuse) is a high-risk area.

Red flags include missing EIRRs, multiple unexplained PAYE schemes, or HMRC warnings about MUC activity.

Employment Intermediary Reporting Requirements and Mini Umbrella Company Risk

001. If operating PAYE in parallel, does the umbrella submit quarterly EIRRs for all non-direct PAYE workers? — Justification: Confirms HMRC reporting compliance. Red flag: no or late EIRR submissions.

Select answer

Upload evidence for HMRC

EIRR logs, HMRC acknowledgements

Short reason if answered N/A

Comments / Notes (Optional)

002. If operating PAYE in parallel, can the umbrella provide a copy of its latest EIRR return or extract? — Justification: Demonstrates governance and transparency. Red flag: refusal to provide evidence.

Select answer

Upload evidence for HMRC

Latest EIRR return, board approval

Short reason if answered N/A

Comments / Notes (Optional)

003. If operating PAYE in parallel, are UTRs and NINOs verified before EIRR submission? — Justification: Prevents false/duplicate worker IDs. Red flag: unverifiable or invalid IDs submitted.

Select answer

Upload evidence for HMRC

Contract clauses, SLA extracts, system screenshots

Short reason if answered N/A

Comments / Notes (Optional)

004. If operating PAYE in parallel, has the umbrella screened PAYE schemes for signs of MUC risk? — Justification: Detects PAYE fragmentation. Red flag: multiple unexplained PAYE schemes.

Select answer

Upload evidence for HMRC

Complaints logs, worker comms, system reports

Short reason if answered N/A

Comments / Notes (Optional)

005. If multiple PAYE schemes exist, is the rationale documented and evidenced? — Justification: Ensures PAYE splitting isn’t artificial. Red flag: no justification for multiple schemes.

Select answer

Upload evidence for HMRC

KID versions, margin logs

Short reason if answered N/A

Comments / Notes (Optional)

006. Has the umbrella consolidated PAYE schemes where possible? — Justification: Prevents artificial splitting & EA abuse. Red flag: persistent small schemes across group.

Select answer

Upload evidence for HMRC

Payroll consolidation logs

Short reason if answered N/A

Comments / Notes (Optional)

007. Has the umbrella ever received HMRC warnings or investigations relating to MUC activity? — Justification: Confirms independent verification of integrity. Red flag: history of HMRC sanctions.

Select answer

Upload evidence for HMRC

HMRC correspondence, audit notes

Short reason if answered N/A

Comments / Notes (Optional)

008. Does the umbrella use a single onboarding/assessment process across all PAYE schemes? — Justification: Ensures consistency & fair worker treatment. Red flag: differing onboarding across schemes.

Select answer

Upload evidence for HMRC

Onboarding docs, escalation policy

Short reason if answered N/A

Comments / Notes (Optional)

Section 17 – Hybrid & Purported Umbrella Risk

This section checks whether the umbrella operates CIS and PAYE models transparently and avoids creating “purported umbrella” arrangements under draft 2026 Joint & Several Liability (JSL) rules.

HMRC warns that if it is reasonable to assume PAYE applies, debt can be transferred to the end-hirer.

Red flags include CIS workers under SDC, employment-style benefits, misleading terminology, or hybrid models without legal sign-off.

Hybrid & Purported Umbrella Risk

001. Does the umbrella provide both PAYE and CIS models for similar roles or workers? — Justification: Identifies hybrid risk. Red flag: CIS and PAYE offered side-by-side with no rationale.

Select answer

Upload evidence for HMRC

Service scope, contracts

Short reason if answered N/A

Comments / Notes (Optional)

002. Are any CIS workers performing roles under Supervision, Direction, or Control (SDC)? — Justification: Confirms genuine self-employment. Red flag: CIS used where SDC applies.

Select answer

Upload evidence for HMRC

Role assessments, status checks

Short reason if answered N/A

Comments / Notes (Optional)

003. Has the umbrella confirmed which roles are processed under PAYE vs CIS, with justification? — Justification: Prevents disguised employment. Red flag: no documented rationale.

Select answer

Upload evidence for HMRC

Status determinations, contractor agreements

Short reason if answered N/A

Comments / Notes (Optional)

004. Are CIS workers receiving employment-style benefits (handbooks, grievance rights, paid leave)? — Justification: Prevents “purported umbrella” classification. Red flag: CIS workers given employee-style entitlements.

Select answer

Upload evidence for HMRC

Onboarding docs, HR policies

Short reason if answered N/A

Comments / Notes (Optional)

005. Is self-employment messaging neutral and free from employment-style terminology? — Justification: Prevents misleading assumptions. Red flag: CIS workers told they are “employees.”

Select answer

Upload evidence for HMRC

Scripts, comms reviews

Short reason if answered N/A

Comments / Notes (Optional)

006. Are “umbrella” or “employer” labels avoided in CIS-facing communications? — Justification: Prevents misinterpretation under JSL. Red flag: marketing CIS as “employment.”

Select answer

Upload evidence for HMRC

Website extracts, QA logs

Short reason if answered N/A

Comments / Notes (Optional)

007. Has the umbrella explained to workers the risks of being viewed as a “purported umbrella” under draft 2026 rules? — Justification: Ensures informed choice. Red flag: workers unaware of JSL exposure.

Select answer

Upload evidence for HMRC

Worker comms, deduction notes

Short reason if answered N/A

Comments / Notes (Optional)

008. Are CIS deduction statements issued correctly in line with HMRC CIS rules? — Justification: Confirms statutory compliance. Red flag: payslips issued like PAYE.

Select answer

Upload evidence for HMRC

CIS deduction statements

Short reason if answered N/A

Comments / Notes (Optional)

009. Are payslips/remittances reviewed to confirm no PAYE tax/NI is deducted under CIS? — Justification: Detects disguised PAYE. Red flag: CIS remittances showing PAYE deductions.

Select answer

Upload evidence for HMRC

Sample payslips, audit logs

Short reason if answered N/A

Comments / Notes (Optional)

010. Has legal or tax advice been obtained on hybrid or borderline CIS models? — Justification: Confirms defensible due diligence. Red flag: no external validation in grey areas.

Select answer

Upload evidence for HMRC

Legal opinions, advisory letters

Short reason if answered N/A

Comments / Notes (Optional)

011. Have agencies/end-hirers issued written statements clarifying worker engagement status? — Justification: Reinforces supply chain alignment. Red flag: status unclear across parties.

Select answer

Upload evidence for HMRC

Agency/client attestations

Short reason if answered N/A

Comments / Notes (Optional)

012. Have intermediary contracts/insurance/systems been reviewed to confirm alignment with CIS (not PAYE)? — Justification: Prevents misclassification & liability transfer. Red flag: hybrid systems not audited.

Select answer

Upload evidence for HMRC

Contracts, insurance certs

Short reason if answered N/A

Comments / Notes (Optional)

Section 18 – Financial Stability & Resilience

End-hirers need assurance that CIS umbrellas are financially stable, able to pay workers on time, and resilient to shocks.

HMRC and the FCA flag insolvency/phoenix risk as key indicators of fraud.

Red flags include late filing of accounts, repeated losses, reliance on subcontractor credit, or lapsed insurance cover.

Financial Stability & Resilience

001. Does the umbrella file statutory accounts on time with Companies House? — Justification: Confirms compliance & stability. Red flag: overdue or missing filings.

Select answer

Upload evidence for HMRC

CH filing history, last annual accounts

Short reason if answered N/A

Comments / Notes (Optional)

002. Has the umbrella provided recent management accounts or audited accounts? — Justification: Demonstrates trading solvency. Red flag: persistent losses or negative equity.

Select answer

Upload evidence for HMRC

Management accounts (last 6 months), audited accounts

Short reason if answered N/A

Comments / Notes (Optional)

003. Does the umbrella hold valid Professional Indemnity (PI) insurance?(even if CIS) — Justification: Protects against negligence claims. Red flag: expired or missing PI cover.

Select answer

Upload evidence for HMRC

Insurance certificate

Short reason if answered N/A

Comments / Notes (Optional)

004. Is Employers’ Liability (EL) insurance in place ? — Justification: Covers grey areas if CIS reclassified. Red flag: no EL despite CIS challenge risk.

Select answer

Upload evidence for HMRC

EL certificate

Short reason if answered N/A

Comments / Notes (Optional)

005. Is Public Liability (PL) insurance maintained? — Justification: Protects against injury/property claims. Red flag: lapsed or no PL.

Select answer

Upload evidence for HMRC

PL schedule

Short reason if answered N/A

Comments / Notes (Optional)

006. Is credit insurance in place to protect against client insolvency (if relevant)? — Justification: Ensures financial resilience. Red flag: no cover despite high-risk clients.

Select answer

Upload evidence for HMRC

Credit insurance certificate, broker statement

Short reason if answered N/A

Comments / Notes (Optional)

007. Has the umbrella been subject to insolvency proceedings, CCJs, or winding-up petitions in the past 5 years? — Justification: Detects financial fragility. Red flag: undisclosed or repeated legal actions.

Select answer

Upload evidence for HMRC

Insolvency register, CCJ search, court filings

Short reason if answered N/A

Comments / Notes (Optional)

008. Does the umbrella operate segregated or ring-fenced accounts for CIS tax deductions? — Justification: Protects funds intended for HMRC. Red flag: deductions pooled in trading accounts.

Select answer

Upload evidence for HMRC

Bank account s

Short reason if answered N/A

Comments / Notes (Optional)

Section 19 – End-hirer Governance, Attestations & Escalation

This section tests whether the end-hirer has a formal due diligence framework and enforces dynamic oversight of CIS umbrellas.

HMRC and the draft 2026 JSL rules expect evidence-led assurance (not declarations alone), contractual audit rights, quarterly attestations, and clear escalation/remediation if risks are identified.

Red flags include no written policy, no audit rights in contracts, reliance solely on supplier declarations, or lack of escalation logs.

End-hirer Governance, Attestations & Escalation

001. Do you have a formal written policy for supply chain due diligence on umbrella providers? — Justification: Establishes governance baseline. Red flag: no policy = no defensible framework.

Select answer

Upload evidence for HMRC

Due diligence policy, board approval

Short reason if answered N/A

Comments / Notes (Optional)

002. Does your contract with the umbrella include audit, attestation, and termination rights for non-compliance? — Justification: Embeds control in legal agreements. Red flag: contracts silent on audit rights.

Select answer

Upload evidence for HMRC

Contract clauses, SLA extracts

Short reason if answered N/A

Comments / Notes (Optional)

003. Do you receive quarterly compliance attestations from the umbrella (CIS accuracy, insurance, HMRC compliance)? — Justification: Provides continuous assurance. Red flag: one-off self-certification only.

Select answer

Upload evidence for HMRC

Quarterly compliance pack, attestation logs

Short reason if answered N/A

Comments / Notes (Optional)

004. Have you reviewed supporting evidence (e.g., HMRC filings, insurance), not just supplier declarations? — Justification: Prevents “tick-box” oversight. Red flag: reliance solely on declarations.

Select answer

Upload evidence for HMRC

Evidence packs, HMRC receipts

Short reason if answered N/A

Comments / Notes (Optional)

005. Are changes to umbrella deductions, fees, or margin versions tracked and disclosed? — Justification: Ensures transparency. Red flag: undisclosed or fluctuating margins.

Select answer

Upload evidence for HMRC

Version logs, worker comms

Short reason if answered N/A

Comments / Notes (Optional)

006. Has the umbrella confirmed it uses a GDPR-compliant platform for worker data (ICO registered)? — Justification: Protects personal data. Red flag: no ICO registration.

Select answer

Upload evidence for HMRC

ICO certificate, system screenshots

Short reason if answered N/A

Comments / Notes (Optional)

007. Does the umbrella provide evidence of a worker complaints & grievance procedure? — Justification: Confirms worker voice & protections. Red flag: no grievance process.

Select answer

Upload evidence for HMRC

Worker handbook, grievance logs

Short reason if answered N/A

Comments / Notes (Optional)

008. If non-compliance is identified, do you have a process for escalation, remediation, or disengagement? — Justification: Ensures supply chain integrity. Red flag: no escalation or disengagement route.

Select answer

Upload evidence for HMRC

Escalation policy, disengagement logs

Short reason if answered N/A

Comments / Notes (Optional)

009. Are subcontractors and extended service chain relationships disclosed to you and audited? — Justification: Ensures end-to-end visibility. Red flag: hidden subcontractors.

Select answer

Upload evidence for HMRC

Subcontractor lists, due diligence reports

Short reason if answered N/A

Comments / Notes (Optional)

010. Are internal audits or spot checks carried out on umbrella performance and compliance? — Justification: Provides assurance of ongoing integrity. Red flag: no audit trail.

Select answer

Upload evidence for HMRC

Audit reports, internal review logs

Short reason if answered N/A

Comments / Notes (Optional)

Section 20 – Final Declaration and Signoff

Captures accountability and sign-off from the end-hirer, confirming that the audit covering both Umbrella CIS engagements has been completed, reviewed, and authorised by a suitably responsible individual.

This declaration signifies the end-hirer’s commitment to transparency, lawful engagement, tax compliance, and ethical labour supply practices.

Final Declaration and End-Hirer Signoff

I, the undersigned, hereby confirm the following on behalf of the end-hirer that the information provided in this self-audit of our umbrella and CIS labour supply chain is, to the best of my knowledge, accurate, complete, and a fair reflection of our internal due diligence, risk controls, and operational compliance.

I confirm that:

1) Supporting documentation referenced in this audit can be made available upon legitimate request.

2) We have taken reasonable steps to ensure that umbrella and CIS providers within our supply chain operate in line with UK employment law, HMRC tax regulations, and supply chain transparency obligations.

3) This declaration signifies our commitment to:

i) Preventing disguised remuneration, tax evasion, and labour exploitation

ii)Upholding the rights and entitlements of all workers in our supply chain

iii)Meeting obligations under the Criminal Finances Act 2017, Modern Slavery Act 2015, and other relevant legislation

iv) Continuously improving our supply chain governance