Why supplier due diligence is becoming the continuous control public sector buyers can defend.

May 27, 2026

A near-£1bn NHS construction contract in Wales has reopened supplier-integrity questions for every UK public sector buyer.

Supplier due diligence is becoming a continuous control for UK public sector buyers, end-hirers and recruitment agencies in 2026, rather than a point-in-time check at the start of a contract.

Recent reporting in Nation.Cymru on 26 May 2026 has put a spotlight on transparency around a major NHS construction-procurement decision in Wales, where supplier-integrity questions have come back round on a near-£1bn award long after the contract was placed.

The wider question, for public sector boards, end-hirers and recruitment agencies elsewhere in the UK, is whether their own supplier due diligence record could be produced on the day a regulator, an internal audit team or a procurement inquiry asks for it. The mechanism that decides the answer is the difference between supplier reassurance at award and evidence-led supplier due diligence held continuously through the life of the contract.

Why supplier due diligence is shifting from a procurement formality to a board control

Two shifts are pulling supplier due diligence onto the board-level agenda. The first is the new joint and several liability rules for umbrella arrangements, introduced by Finance Act 2026, which inserts Chapter 11 into Part 2 ITEPA 2003, with effect for payments made on or after 6 April 2026.

This is the umbrella-market JSL regime, distinct from older PAYE debt transfer powers, and it may move unpaid PAYE inside an umbrella supply chain upstream to the recruitment agency and the end-hirer where the umbrella has failed to operate the rules correctly.

The second shift is the broader public-procurement environment, where transparency expectations and post-award scrutiny make a once-at-award reassurance harder to defend than it used to be.

For board directors at NHS bodies, central government departments, local authorities and the recruitment agencies that supply them, the practical question moves from “did we approve this supplier” to “can we evidence the condition of the chain while risk was being created”. That is a different control altogether.

What HMRC’s published guidance treats as the standard

HMRC’s guidance for buyers of labour, often referenced as GfC12, is titled Advice on applying supply chain due diligence principles to assure your labour supply chains. OPRaaS takes the verb assure in that title as the operative word: the standard is continuous integrity assurance, not point-in-time performance of a check.

HMRC’s published position is not framed as a perform-versus-assure dichotomy; that distinction is OPRaaS’s analytical reading, drawn from the guidance’s title and structure.

According to HMRC’s own impact assessment, tens of thousands of recruitment agencies and several hundred umbrella companies are expected to change behaviour as the umbrella-market JSL regime beds in. That’s the supplier population that end-hirers and public sector buyers are continuing to engage and, the population that supplier due diligence has to keep visible at every tier.

Asking is not assurance. Evidencing is.

The CAR principles, applied continuously across every contract tier

The CAR principles, Check, Act and Review, are the wider supply chain due diligence framework HMRC sets out in its GfC12 guidance. Module 4 of the OPRaaS LSCA Self-Certification Course applies them as the operating model for supplier due diligence inside the OPRaaS methodology.

Check

Check, in HMRC’s framing, asks the buyer to identify and understand the supplier’s risks across legal obligations (PAYE, VAT, CIS, right-to-work, NMW and NLW, AWR, off-payroll), financial stability, tax compliance including evidence that deductions are actually remitted to HMRC, and social responsibility against exploitation and modern slavery.

Act

Act asks the buyer to run comprehensive due diligence on the supplier, take prompt action where risks are found, mitigate or remove non-compliant suppliers, and hold the accountability with the contracting organisation regardless of any third-party service that supports the work.

Review

Review asks the buyer to keep the process going. Continuous monitoring, periodic updates as regulation moves, and follow-up actions from audits or incidents into the operating model.

The discipline runs the contract, not the gate.

Supplier due diligence, applied continuously across every contract tier, is the difference between a procurement record a board can defend and a procurement record an audit committee inherits.

Where the practice still falls short in many UK organisations

Public sector and end-hirer procurement runs on a stack of contractual reassurances and third-party accreditations. Constructionline and ISO 9001 in the construction tier. FCSA membership for umbrella suppliers. Sector-body self-certifications, supplier statements of compliance, supplier indemnities. Each is useful at the gate. None on its own is supplier due diligence in the sense HMRC’s published guidance asks for.

The gap is not absence of effort. It is dispersion.

The evidence sits across a procurement-folder questionnaire, a portal of identity documents, payslip samples taken only on complaint and audit notes in email trails. That set keeps the workforce moving. It comes up against its limits the moment a regulator, an internal audit team or a procurement inquiry asks for one dated record explaining how the chain was controlled.

A buyer that cannot show what was checked, when, by whom and with what evidence carries the bill where the upstream supplier fails.

How the OPRaaS Virtual Compliance Director platform supports the discipline

OPRaaS, On-Pay-Roll-as-a-Service, is a systemised governance and workforce management partner for organisations that rely on temporary, contractor and contingent labour. Through the OPRaaS Virtual Compliance Director (OPRaaS VCD) platform, senior governance leadership is embedded into the business without the cost of a full-time director, building audit-ready controls across JSL, IR35, CIS, GLAA, modern slavery and HMRC labour supply chain expectations.

The methodology serves end-hirers, recruitment agencies, umbrella companies, managed service providers and public sector buyers.

Two operational examples make the platform concrete. Supplier records on the OPRaaS VCD platform are monitored against Companies House and Creditsafe for director, ownership and credit-risk changes, with material changes written into the platform’s evidence record and routed to the named Senior Responsible Owner the next working day.

Umbrella Right-to-Work, identity, bank-detail and National Insurance checks are captured at onboarding and re-run on every material change and pay run, with exceptions held in the same record.

The OPRaaS VCD platform can print that record on demand as an audit and evidence summary PDF, which is what the buyer hands over when an inquiry follows.

OPRaaS is approved on the UK Government Commercial Agency (formerly Crown Commercial Service) frameworks including RM6310 Audit and Assurance Services (Lots 2 and 4), RM6219 Learning and Training Services DPS, and RM6237 Learning and Training Services DPS.

What the audit committee question looks like for end-hirers, agencies and public sector buyers

For board directors and Senior Responsible Owners across the OPRaaS audience, the practical question for the next audit committee is not whether the suppliers were approved at award, but whether the supplier due diligence record could be produced on the day a regulator or internal audit team asks for it. Three CAR-aligned questions are well placed for that conversation:

The Check question. For our top labour-supply and labour-heavy suppliers, what is the dated evidence that the legal, financial, tax and social-responsibility risks have been identified and understood?
The Act question. Where risks were found, what specific mitigation or removal steps did we take, and is the audit trail held with the contracting organisation rather than buried in a third-party report?
The Review question. Which monitoring and follow-up steps are continuous through the contract life, and which were point-in-time at award and have not been re-tested since?

Sitting underneath the three questions, the supporting artefact is one dated, structured evidence file that holds the checks, the actions, the reviews, the flags and the escalations together. The OPRaaS VCD platform prints that file on demand as an audit and evidence summary PDF, so the assurance position passes upstream with the liability when JSL or a procurement inquiry reaches the buyer.

The Supplier Due Diligence topic in Module 4 of the OPRaaS LSCA Self-Certification Course sets out the operating version of this discipline, applying HMRC’s CAR principles to supplier due diligence in labour supply chains. The wider OPRaaS LSCA framework, covered here, links that supplier-level work to the compliance-as-an-asset position the OPRaaS VCD platform’s on-demand evidence file is designed to surface.

Compliance is your asset. Evidenced daily.

As employers prioritise risk and governance skills, OPRaaS provides a director-level, compliance capability alternative to hiring.

May 21, 2026

Sizewell C, Value for Money and the Public-Sector Labour Supply Chain

May 20, 2026

Acronym	Full Term	Definition
CFA 2017	Criminal Finances Act 2017	UK legislation introducing Corporate Criminal Offence (sections 45/46): failure to prevent the facilitation of tax evasion. Requires businesses to implement 'reasonable prevention procedures' (RPP). The only defence is having adequate RPP or showing it was not reasonable to expect such procedures.
MSA 2015	Modern Slavery Act 2015	UK legislation mandating supply chain transparency and worker safeguarding. Section 54 requires commercial organisations with ≥£36m turnover to publish annual modern slavery statements (board-approved, signed by director, published on website with prominent homepage link).
IR35	Off-Payroll Working Rules	Tax legislation determining whether a contractor should be treated as employed or self-employed for tax purposes. Since April 2021, medium and large private sector clients must determine contractor status and deduct employment taxes if inside IR35. Requires Status Determination Statement (SDS).
JSL	Joint & Several Liability	2026 legislation imposing strict liability on agencies and end-hirers for umbrella company tax debts, even where due diligence checks have been undertaken. Makes supply chain participants jointly responsible for unpaid PAYE taxes.
AWR	Agency Workers Regulations 2010	UK regulations giving agency workers the right to the same basic working and employment conditions as permanent employees after 12 weeks in a qualifying assignment (12-week parity rule).
Good Work Plan	Good Work Plan 2020	UK employment law reforms requiring written 'section 1 statement' of employment particulars to be given to employees and workers on or before day 1 of engagement (effective 6 April 2020). Sets out key terms but is not itself the contract.
Construction Act	Housing Grants, Construction and Regeneration Act 1996	UK legislation governing payment practices in construction contracts. Section 113 renders "pay when paid" clauses ineffective (except where upstream payer is insolvent). Requires clear due dates, final dates for payment, and compliant payment/pay less notices.
Pensions Act 2008	Pensions Act 2008	UK legislation establishing workplace pension auto-enrolment requirements. Employers must automatically enrol eligible workers into qualifying pension schemes and make minimum contributions.

Acronym	Full Term	Definition
HMRC	HM Revenue & Customs	UK government department responsible for tax collection, payment of tax credits and benefits, and enforcement of tax law. Operates PAYE, CIS, RTI systems and conducts compliance audits. Business Tax Account provides reconciliation data.
GLAA	Gangmasters and Labour Abuse Authority	UK government body regulating labour providers in certain sectors (agriculture, horticulture, shellfish gathering, food processing/packaging) and investigating worker exploitation. Operates licensing regime and has criminal investigation powers. Hotline: 0800 432 0804 (03000 718234 out of hours).
ICO	Information Commissioner's Office	UK independent authority upholding information rights. Enforces UK GDPR and Data Protection Act 2018. Personal data breaches must be reported to ICO within 72 hours where there's risk to individuals' rights. Provides guidance on lawful bases, DSARs, and data-sharing.
CITB	Construction Industry Training Board	Industry body that collects levy from construction employers (payroll ≥£80k in PAYE in last tax year, or ≥£80k net CIS payments) and provides training grants. CITB levy compliance is audited in construction-focused compliance audits.

Acronym	Full Term	Definition
PAYE	Pay As You Earn	HMRC's system for collecting Income Tax and National Insurance Contributions from employees' wages. Employers deduct tax before paying employees, then remit to HMRC. Operates under Real Time Information (RTI) reporting requirements.
CIS	Construction Industry Scheme	Tax deduction scheme for payments to subcontractors in construction industry. Contractors must verify subcontractors with HMRC before first payment and make deductions (20% for verified, 30% for unverified) on labour element only (excluding VAT and allowable materials). CIS300 returns due by 19th following tax month.
GPS	Gross Payment Status	CIS status allowing subcontractors to be paid without deductions. Must apply to HMRC and meet compliance tests (business test, turnover test, compliance test). Contractors must verify GPS and keep evidence; continue to file CIS300 but make no deduction.
CIS300	CIS Monthly Return	HMRC return submitted by contractors detailing total payments made to each subcontractor and CIS tax deductions applied. Must be filed by the 19th following the tax month (6th–5th). Should reconcile to subcontractor statements and bank payments.
CIS340	CIS340 Guidance	HMRC's official guidance document defining what constitutes 'construction operations' for CIS purposes. Only work qualifying under CIS340 can legitimately be paid through the Construction Industry Scheme. Includes site preparation, construction, alteration, repairs, demolition.
RTI	Real Time Information	HMRC system requiring employers to report PAYE information at or before each pay run. Consists of Full Payment Submission (FPS) for regular pay data and Employer Payment Summary (EPS) for adjustments/recoveries. Must reconcile to payslips and Business Tax Account.
FPS	Full Payment Submission	RTI submission reporting gross taxable pay, Income Tax, and NICs for each employee on each payday. FPS values must match payslips. Should not be used to mask under-deductions.
EPS	Employer Payment Summary	RTI submission used only for adjustments, such as recoveries, statutory payments, employment allowance claims, or apprenticeship levy. Should not be used to mask PAYE under-deductions.
Bacs	Bankers' Automated Clearing Services	UK electronic payment system used for direct debits and credits, including salary payments. Net pay on payslip must match Bacs transfer to worker's bank account. Never use "BACS" (incorrect).
UTR	Unique Taxpayer Reference	10-digit number issued by HMRC to identify individuals and businesses for tax purposes. Required for CIS verification and self-assessment tax returns. Note: UTR alone isn't proof of CIS verification; contractor must verify with HMRC before first payment.
NIC / NICs	National Insurance Contributions	UK social security tax paid by employees (via PAYE), employers (as on-costs), and the self-employed (Class 2/4 via self-assessment). Funds state benefits including state pension, statutory sick pay, and maternity allowance. CIS deductions are payments on account of Income Tax and Class 4 NICs.
NMW	National Minimum Wage	Legal minimum hourly rate employers must pay workers in the UK. Rates vary by age band. Post-deduction pay (after deductions for employer's own use/benefit) must not fall below NMW. Records must be kept for 6 years.
NLW	National Living Wage	Higher rate of National Minimum Wage for workers aged 21 and over. Often referred to together as "NMW/NLW". Different from voluntary Real Living Wage calculated by Living Wage Foundation.
AE	Auto-Enrolment (Pensions)	Workplace pension scheme where employers must automatically enrol eligible workers (aged 22+ to state pension age, earning ≥£10k annually) into a qualifying pension. Minimum contributions, opt-out rights, and re-enrolment (every 3 years) required.
P45	P45 (Leaving Employment)	HMRC form given to employees when they leave employment, showing pay and tax details for the year to date. New employer uses P45 to operate correct tax code. Emergency codes (e.g., 1257L W1/M1) apply without P45/P6.

Acronym	Full Term	Definition
DRC	Domestic Reverse Charge (VAT)	VAT mechanism for construction services where the customer accounts for VAT instead of the supplier. Applies to most construction services under CIS340. Designed to combat missing trader fraud in construction supply chains.
Kittel	Kittel Principle	EU/UK legal principle that a taxpayer who knew or should have known their transaction was connected to VAT fraud may be denied the right to deduct input VAT. Creates due diligence obligations for supply chain participants.
DR	Disguised Remuneration	Tax avoidance arrangements designed to pay individuals while avoiding income tax and NICs, often involving loans, offshore entities, or trusts. HMRC actively targets such schemes. Loan charge applies to outstanding loans.

Acronym	Full Term	Definition
SDC	Supervision, Direction or Control	Key factor in determining employment status under agency rules (ITEPA 2003 s44). If a worker is under supervision, direction or control by any person (client, agency, end-hirer) over how they work, PAYE must be operated. SDC alone is not the general CIS status test—apply usual status tests (control, substitution, mutuality).
MOO	Mutuality of Obligation	Employment status indicator examining whether the employer is obliged to provide work and the worker is obliged to accept it. Absence of MOO suggests self-employment; presence suggests employment.
SDS	Status Determination Statement	Document required under IR35 reforms (April 2021) where medium/large clients must provide written reasons for their determination of a contractor's employment status for tax purposes. Must be given before contract starts or worker begins work.
CEST	Check Employment Status for Tax	HMRC's online tool for determining whether a worker should be classified as employed or self-employed for tax purposes. Results are binding on HMRC if information provided is accurate and not relating to highly complex arrangements.
PSC	Personal Service Company	Limited company through which a contractor provides their services. Often used by contractors working outside IR35, but subject to IR35 rules if the underlying relationship is one of employment. Requires SDS from medium/large clients.
KID	Key Information Document	Plain-English factsheet (not a contract) that agencies must give to workers before they agree to an assignment (Conduct of Employment Agencies and Employment Businesses Regulations 2003). Includes worked pay illustration, deductions, who pays the worker, benefits. Must be updated within 5 working days of any change.
ITEPA 2003	Income Tax (Earnings and Pensions) Act 2003	UK tax legislation governing employment income. Section 44 contains agency rules requiring PAYE where worker is under SDC. Section 61N–61R cover off-payroll working (IR35) for public sector and (from 2021) medium/large private sector.
DBS	Disclosure and Barring Service	UK government service providing criminal record checks for employment purposes (particularly roles working with children or vulnerable adults). Processing DBS data requires DPA 2018 Schedule 1 condition and appropriate policy document.