Linkedin-in
(Guest)

LSCA End-Hirer's Audit Dashboard

Start, complete, revisit, analyse, store, print or send your essential Agency LSCA Audits by choosing from the menu below.

End-Hirer Umbrella PAYE Audit

Important Information

This checklist helps end-hirers audit umbrella companies operating PAYE models in their labour supply chain.

It supports compliance with current legislation and prepares for the upcoming Joint and Several Liability (JSL) regime effective April 2026.

It addresses key risk areas, including:

  • Umbrella legitimacy, director conduct, and tax registrations
  • PAYE accuracy, margin transparency, and statutory employment rights
  • Mini umbrella company (MUC) detection and payroll fragmentation
  • Alignment with the Criminal Finances Act 2017, Modern Slavery Act 2015, and GDPR
  • Worker onboarding, grievance handling, and data protection

End-hirers must demonstrate that:

  • Umbrella due diligence is documented and risk-based
  • Legal obligations are enforced through contract
  • PAYE and employment law compliance is evidenced and auditable

🚩Red Flags (e.g. disguised remuneration, excessive deductions) are identified and addressed

Note: Unsupported responses will not satisfy HMRC or commercial audits.

This tool embeds accountability and assurance across your umbrella supply chain — now essential under the evolving compliance landscape.

Evidence Expectations

In an HMRC audit, superficial responses will not meet compliance standards.

By using the form, you acknowledge acceptance of OPRaaS LTD’s data handling policies and terms and conditions of use.

info@opraas.co.uk

User and Company Details

Please enter the company details for the entity you are auditing.  If you are performing a Self-Assessment, please insert your own company details here.

Section 1 – Corporate Identity, Directors & Group Structure

This section ensures the umbrella company is a legally constituted, active business with transparent trading identity, tax registrations, and accountable directors.

Verifying incorporation, PAYE/VAT details, ownership, and director integrity enables the end-hirer to screen for shell companies, phoenix operations, or fraudulent structures — essential to HMRC due diligence expectations under the Criminal Finances Act 2017, Modern Slavery Act 2015, and the 2026 JSL regime

Corporate Identity, Directors & Group Structure

001. Is the company registered with Companies House and are details up-to-date? Justification: Confirms foundation and legal status. Red flag: dormant/shell entities, inconsistent filings.

Select answer

Upload evidence for HMRC

Companies House snapshot (status, directors, SIC code)

Short reason if answered N/A

Comments / Notes (Optional)

002. Is professional indemnity, employer’s liability, and public liability insurance in place? Justification: Validates readiness and protects workers/clients. Red flag: expired or missing cover.

Select answer

Upload evidence for HMRC

Insurance certificates (EL, PL, PI); insurance schedule

Short reason if answered N/A

Comments / Notes (Optional)

003. Is membership valid and up-to-date? Justification: Confirms ongoing independent review. Red flag: expired/withdrawn memberships.

Select answer

Upload evidence for HMRC

Renewal notice; website verification

Short reason if answered N/A

Comments / Notes (Optional)

004. Does the umbrella have ≥2 years’ trading history and an active contractor base? Justification: Demonstrates maturity and payroll continuity. Red flag: newcos with no trading history.

Select answer

Upload evidence for HMRC

CH filings; client reference logs; contractor volumes

Short reason if answered N/A

Comments / Notes (Optional)

005. Has the umbrella disclosed whether it subcontracts CIS or payroll functions? Justification: Confirms governance scope and delegation. Red flag: hidden/undisclosed outsourcing.

Select answer

Upload evidence for HMRC

Subcontractor agreements; scope of services

Short reason if answered N/A

Comments / Notes (Optional)

006. Have you confirmed the umbrella’s Ultimate Beneficial Owners (UBOs) and cross-checked against the CH PSC register? Justification: Detects hidden/offshore ownership. Red flag: mismatch with PSC register.

Select answer

Upload evidence for HMRC

PSC register extract; UBO declaration

Short reason if answered N/A

Comments / Notes (Optional)

007. Are trading names used consistently across contracts, payslips, invoices, and correspondence? Justification: Prevents confusion and hidden multiple entities. Red flag: mismatched names across docs.

Select answer

Upload evidence for HMRC

Samples of contracts, payslips, onboarding emails

Short reason if answered N/A

Comments / Notes (Optional)

008. Have subcontractors confirmed they do not use mini-umbrella structures (MUCs)? Justification: Detects payroll fragmentation fraud. Red flag: subcontractors using multiple PAYE schemes.

Select answer

Upload evidence for HMRC

Written subcontractor declarations; audit reports

Short reason if answered N/A

Comments / Notes (Optional)

009. Do you operate ongoing monitoring (e.g. adverse media, insolvency alerts, HMRC Tax Loss/Veto letters)? Justification: Ensures due diligence is dynamic. Red flag: no monitoring log or ignored alerts.

Select answer

Upload evidence for HMRC

Monitoring log; subscription service report

Short reason if answered N/A

Comments / Notes (Optional)

010. Is the Certificate of Incorporation available? Justification: Verifies company authenticity. Red flag: no certificate or discrepancies with CH.

Select answer

Upload evidence for HMRC

Certificate of Incorporation (PDF or original)

Short reason if answered N/A

Comments / Notes (Optional)

011. Are payroll and compliance functions separate from sales/commercial teams? Justification: Reduces bias and conflict of interest. Red flag: sales overriding compliance.

Select answer

Upload evidence for HMRC

Org chart; job descriptions

Short reason if answered N/A

Comments / Notes (Optional)

012. Has the umbrella ever received an HMRC Tax Loss or Veto Letter, and if so, how was this addressed? Justification: Direct indicator of VAT fraud risk. Red flag: ignored or unresolved veto letters.

Select answer

Upload evidence for HMRC

HMRC correspondence; mitigation log

Short reason if answered N/A

Comments / Notes (Optional)

013. Have annual accounts and company tax filings been submitted on time? Justification: Demonstrates financial compliance; reduces phoenix risk. Red flag: late filings or dissolved entities.

Select answer

Upload evidence for HMRC

CH accounts; HMRC filing confirmations

Short reason if answered N/A

Comments / Notes (Optional)

014. Are compliance overrides logged and independently reviewed (e.g., by governance lead/NED)? Justification: Tracks breaches and reinforces governance. Red flag: overrides with no audit trail.

Select answer

Upload evidence for HMRC

Override register; board minutes

Short reason if answered N/A

Comments / Notes (Optional)

015. Does the umbrella provide an annual self-certification of corporate legitimacy? Justification: Creates recurring assurance and audit trail. Red flag: failure to self-certify.

Select answer

Upload evidence for HMRC

Signed annual declaration; compliance pack

Short reason if answered N/A

Comments / Notes (Optional)

016. Have all directors been disclosed and verified for ID, address, and active involvement? Justification: Ensures accountability for decision-makers. Red flag: undisclosed or inactive directors.

Select answer

Upload evidence for HMRC

CH listing; internal records; redacted ID

Short reason if answered N/A

Comments / Notes (Optional)

017. Is the umbrella a member of a recognised compliance body (e.g., FCSA, Professional Passport, SafeRec, VeriPay)? Justification: Indicates voluntary adherence to standards. Red flag: no external scrutiny.

Select answer

Upload evidence for HMRC

Membership certificate; audit summary

Short reason if answered N/A

Comments / Notes (Optional)

018. Have directors been screened for disqualification, insolvency, or misconduct history? Justification: Prevents governance risks. Red flag: disqualified directors or prior misconduct.

Select answer

Upload evidence for HMRC

CH disqualification check; insolvency declarations; screening logs

Short reason if answered N/A

Comments / Notes (Optional)

019. Have any directors held roles in other non-compliant or liquidated umbrella companies? Justification: Detects phoenix/repeat-offender behaviour. Red flag: repeat insolvencies in umbrella sector.

Select answer

Upload evidence for HMRC

Cross-referenced directorship matrix

Short reason if answered N/A

Comments / Notes (Optional)

020. Are any directors or shareholders involved in other active payroll/intermediary businesses? Justification: Identifies cross-ownership or phoenix risks. Red flag: overlapping payroll/control structures.

Select answer

Upload evidence for HMRC

CH cross-checks; UBO declarations; interest logs

Short reason if answered N/A

Comments / Notes (Optional)

021. Are any directors linked to open HMRC or FCA investigations across associated entities? Justification: Helps detect fraud or regulatory evasion. Red flag: open investigations or adverse findings.

Select answer

Upload evidence for HMRC

Due diligence log; legal disclosures

Short reason if answered N/A

Comments / Notes (Optional)

022. Have directors declared no late personal tax filings or improper benefit claims? Justification: Confirms personal tax integrity. Red flag: HMRC warnings, unpaid liabilities.

Select answer

Upload evidence for HMRC

Director self-certifications; HMRC correspondence

Short reason if answered N/A

Comments / Notes (Optional)

Section 2 – Tax Registrations & Supply-Chain Mapping

This section ensures the umbrella company has active and accurate tax registrations (VAT, PAYE, UTR), declares all group entities, and discloses any subcontractors in the pay chain.

It provides the end-hirer with a single, transparent view of who employs and pays workers, preventing fraud, disguised remuneration, and weak links in the supply chain. HMRC expects due diligence to extend beyond immediate suppliers to the whole chain, with documented evidence of PAYE, NIC, and VAT remittance

Tax Registrations & Supply-Chain Mapping

001. Is the umbrella actively VAT-registered, and do details match Companies House? Justification: Confirms VAT legitimacy. Red flag: VAT not registered, mismatched CH details, or frequent VAT deregistration.

Select answer

Upload evidence for HMRC

VAT certificate; VIES check; CH record match

Short reason if answered N/A

Comments / Notes (Optional)

002. Are workers paid directly into UK personal bank accounts (not joint, pooled, or offshore)? Justification: Protects pay integrity. Red flag: pooled accounts or offshore routing.

Select answer

Upload evidence for HMRC

BACs logs; payroll reports

Short reason if answered N/A

Comments / Notes (Optional)

003. Is the PAYE scheme registered and active? Justification: Core PAYE compliance. Red flag: dormant PAYE schemes or payroll run under third-party numbers.

Select answer

Upload evidence for HMRC

HMRC PAYE ref. letter; Government Gateway screenshot

Short reason if answered N/A

Comments / Notes (Optional)

004. Are offshore entities excluded from involvement in worker payment processes? Justification: Ensures UK compliance. Red flag: payments routed via offshore service companies.

Select answer

Upload evidence for HMRC

Ownership structure map; supplier declarations

Short reason if answered N/A

Comments / Notes (Optional)

005. Does the umbrella hold a valid Unique Taxpayer Reference (UTR), and has it been verified? Justification: Confirms HMRC registration. Red flag: no UTR or multiple unexplained UTRs.

Select answer

Upload evidence for HMRC

HMRC UTR confirmation; CH filings

Short reason if answered N/A

Comments / Notes (Optional)

006. Are ring-fenced or client accounts used to protect funds for worker pay and liabilities? Justification: Confirms segregation of funds. Red flag: commingled accounts with no worker protections.

Select answer

Upload evidence for HMRC

Bank account setup evidence; audit confirmation

Short reason if answered N/A

Comments / Notes (Optional)

007. Have all group entities that employ or pay workers been declared? Justification: Ensures visibility across group companies. Red flag: undeclared or offshore group entities.

Select answer

Upload evidence for HMRC

Group structure chart; CH extracts

Short reason if answered N/A

Comments / Notes (Optional)

008. Are audit trails in place to verify PAYE, NIC, and deductions in line with CFA 2017? Justification: Demonstrates tax compliance. Red flag: missing payroll audit logs or RTI mismatches.

Select answer

Upload evidence for HMRC

Payroll audit logs; HMRC RTI submissions

Short reason if answered N/A

Comments / Notes (Optional)

009. Does the umbrella use a UK-based business bank account exclusively? Justification: Prevents diversion of funds. Red flag: offshore or third-party bank accounts.

Select answer

Upload evidence for HMRC

Bank letter/screenshot; CH entry match

Short reason if answered N/A

Comments / Notes (Optional)

010. Has the umbrella had accounts frozen or been investigated by HMRC/FCA in the past 5 years? Justification: Identifies risk history. Red flag: repeated regulatory interventions or frozen accounts.

Select answer

Upload evidence for HMRC

HMRC/FCA correspondence; internal incident log

Short reason if answered N/A

Comments / Notes (Optional)

011. Do you subcontract any payroll, onboarding, or compliance functions to third parties? Justification: Identifies outsourcing risk. Red flag: hidden subcontractors or non-UK entities.

Select answer

Upload evidence for HMRC

Subcontractor list; service agreements

Short reason if answered N/A

Comments / Notes (Optional)

012. If yes, are these subcontractors named, disclosed, and audited? Justification: Ensures transparency. Red flag: no disclosure or failure to audit subs.

Select answer

Upload evidence for HMRC

Subcontractor DD reports; audit logs

Short reason if answered N/A

Comments / Notes (Optional)

013. Are subcontractors contractually bound to HMRC compliance standards? Justification: Extends compliance downstream. Red flag: vague or missing compliance clauses.

Select answer

Upload evidence for HMRC

Contract clauses; signed agreements

Short reason if answered N/A

Comments / Notes (Optional)

014. Are all outsourced suppliers under contract and subject to regular compliance reviews? Justification: Validates oversight. Red flag: contracts without review cycles.

Select answer

Upload evidence for HMRC

Supplier contracts; compliance review logs

Short reason if answered N/A

Comments / Notes (Optional)

015. Are subcontractor/service chain relationships disclosed to clients and workers? Justification: Promotes transparency. Red flag: hidden tiers in the supply chain.

Select answer

Upload evidence for HMRC

Onboarding packs; agency agreements

Short reason if answered N/A

Comments / Notes (Optional)

016. Are up-to-date contracts and SLAs in place for all outsourced providers? Justification: Confirms supplier engagement. Red flag: expired contracts or unsigned SLAs.

Select answer

Upload evidence for HMRC

SLA log; executed agreements

Short reason if answered N/A

Comments / Notes (Optional)

017. Are internal audits or spot checks performed on outsourced payment processing? Justification: Demonstrates proactive controls. Red flag: no evidence of audit checks.

Select answer

Upload evidence for HMRC

Audit logs; QA check reports

Short reason if answered N/A

Comments / Notes (Optional)

Section  3 – Banking, Money Flows & Outsourcing

Tests financial transparency, use of own UK accounts, and disclosure of outsourced CIS/payroll services.

HMRC warns that phoenixing, hidden intermediaries, or third-party bank accounts are red flags for fraud.

Banking, Money Flows & Outsourcing

001. Are all payments made into a UK business bank account in the umbrella’s legal entity name? Justification: Confirms legitimacy. Red flag: third-party or offshore accounts.

Select answer

Upload evidence for HMRC

Bank statement, bank verification letter

Short reason if answered N/A

Comments / Notes (Optional)

002. Do invoice bank details match the legal entity at Companies House? Justification: Prevents fraud layering. Red flag: mismatch.

Select answer

Upload evidence for HMRC

Invoice samples, CH record

Short reason if answered N/A

Comments / Notes (Optional)

003. Has the umbrella disclosed any subcontracted CIS/payroll services? Justification: Identifies scope creep. Red flag: hidden outsourcers.

Select answer

Upload evidence for HMRC

Subcontractor agreements

Short reason if answered N/A

Comments / Notes (Optional)

004. If subcontractors are used, has the umbrella completed due diligence (UTR, VAT, PSC, MUC checks)? Justification: Prevents hidden labour fraud. Red flag: no checks.

Select answer

Upload evidence for HMRC

DD reports, verification logs

Short reason if answered N/A

Comments / Notes (Optional)

005. Are payroll/compliance functions separate from sales/commercial teams? Justification: Avoids bias in worker onboarding. Red flag: sales overriding compliance.

Select answer

Upload evidence for HMRC

Org chart

Short reason if answered N/A

Comments / Notes (Optional)

006. Are any compliance overrides logged & independently reviewed? Justification: Ensures governance. Red flag: overrides with no audit trail.

Select answer

Upload evidence for HMRC

Override register, governance minutes

Short reason if answered N/A

Comments / Notes (Optional)

Section 4 – Payroll & Financial Assurance (Worker Pay, PAYE, RTI Integrity)

This section ensures fairness, transparency, and compliance in all worker pay-related areas — including pensions, salary sacrifice schemes, holiday pay, Agency Workers Regulations (AWR), and expenses.

It confirms that Employer NIC savings are not disguised as deductions, workers are not pushed below NMW thresholds, and statutory entitlements (holiday pay, pensions, expenses) are correctly applied and explained.

This protects workers, ensures supply chain integrity, and prevents disguised remuneration or wage skimming.

Payroll & Financial Assurance (Worker Pay, PAYE, RTI Integrity)

001. Has the umbrella had accounts frozen or been investigated by HMRC/FCA in the past 5 years? Justification: Identifies financial/regulatory risk. Red flag: repeated freezes or sanctions.

Select answer

Upload evidence for HMRC

HMRC/FCA correspondence; incident logs

Short reason if answered N/A

Comments / Notes (Optional)

002. Does the umbrella apply PAYE tax and NIC on all earnings in line with HMRC requirements? Justification: Confirms PAYE compliance. Red flag: untaxed earnings or misclassification.

Select answer

Upload evidence for HMRC

Sample payslips; payroll journals

Short reason if answered N/A

Comments / Notes (Optional)

003. Is Employer’s NIC correctly calculated and not deducted from workers? Justification: Ensures cost fairness. Red flag: NIC passed to workers.

Select answer

Upload evidence for HMRC

Payroll summary showing NIC charged to employer

Short reason if answered N/A

Comments / Notes (Optional)

004. Are bonuses, expenses and other earnings correctly subject to PAYE and NIC where applicable? Justification: Captures full taxable earnings. Red flag: expenses disguised as pay.

Select answer

Upload evidence for HMRC

Bonus policy; expense records; payroll logs

Short reason if answered N/A

Comments / Notes (Optional)

005. Are Real Time Information (RTI) submissions accurate and submitted on time each pay period? Justification: Confirms statutory compliance. Red flag: late/missing RTI or discrepancies.

Select answer

Upload evidence for HMRC

FPS/EPS reports; HMRC receipts

Short reason if answered N/A

Comments / Notes (Optional)

006. Are regular payroll audits conducted to check RTI and tax reporting accuracy? Justification: Ensures early error detection. Red flag: no audits or recurring mismatches.

Select answer

Upload evidence for HMRC

Audit schedules; payroll audit reports

Short reason if answered N/A

Comments / Notes (Optional)

007. Are reconciliation statements collected from workers to validate assignment rates match RTI submissions? Justification: Confirms pay consistency. Red flag: evidence of pay skimming or mismatches.

Select answer

Upload evidence for HMRC

Worker reconciliation sheets

Short reason if answered N/A

Comments / Notes (Optional)

008. Has the umbrella been subject to any HMRC investigations or NIC challenges in the past? Justification: Identifies enforcement history. Red flag: repeated NIC disputes.

Select answer

Upload evidence for HMRC

HMRC correspondence; settlement letters

Short reason if answered N/A

Comments / Notes (Optional)

009. Do you subcontract any payroll, onboarding, or compliance functions to third parties? Justification: Identifies outsourcing risk. Red flag: undisclosed third-party processors.

Select answer

Upload evidence for HMRC

Supplier contracts; SLAs; onboarding disclosures

Short reason if answered N/A

Comments / Notes (Optional)

010. If yes, are these subcontractors named, disclosed, and audited? Justification: Ensures transparency. Red flag: no disclosure or failure to audit.

Select answer

Upload evidence for HMRC

Subcontractor DD reports; audit logs

Short reason if answered N/A

Comments / Notes (Optional)

011. Are subcontractors contractually bound to HMRC compliance standards? Justification: Extends compliance. Red flag: vague contracts or absent compliance clauses.

Select answer

Upload evidence for HMRC

Contract clauses; signed agreements

Short reason if answered N/A

Comments / Notes (Optional)

012. Are all outsourced suppliers under contract and subject to regular compliance reviews? Justification: Validates oversight. Red flag: expired contracts or no reviews.

Select answer

Upload evidence for HMRC

Contracts; SLA snapshots

Short reason if answered N/A

Comments / Notes (Optional)

013. Are subcontractor/service chain relationships disclosed to clients and workers? Justification: Promotes transparency. Red flag: hidden tiers in chain.

Select answer

Upload evidence for HMRC

Onboarding packs; agency agreements

Short reason if answered N/A

Comments / Notes (Optional)

014. Are up-to-date contracts and SLAs in place for all outsourced providers? Justification: Confirms supplier engagement. Red flag: missing/unsigned SLAs.

Select answer

Upload evidence for HMRC

SLA log; supplier management records

Short reason if answered N/A

Comments / Notes (Optional)

015. Are internal audits or spot checks performed on outsourced payment processing? Justification: Demonstrates proactive oversight. Red flag: no evidence of internal QA.

Select answer

Upload evidence for HMRC

Audit logs; QA check records

Short reason if answered N/A

Comments / Notes (Optional)

016. Does the umbrella use a UK-based business bank account exclusively? Justification: Confirms UK financial control. Red flag: offshore or third-party bank accounts.

Select answer

Upload evidence for HMRC

Bank letter; bank statements

Short reason if answered N/A

Comments / Notes (Optional)

017. Are workers paid directly into UK personal bank accounts (not joint, offshore, or pooled accounts)? Justification: Ensures pay integrity. Red flag: pooled accounts or offshore routing.

Select answer

Upload evidence for HMRC

BACs logs; payroll reports

Short reason if answered N/A

Comments / Notes (Optional)

018. Are offshore entities excluded from involvement in worker payment processes? Justification: Confirms tax transparency. Red flag: routing payments via offshore intermediaries.

Select answer

Upload evidence for HMRC

Ownership structure map; processor declarations

Short reason if answered N/A

Comments / Notes (Optional)

019. Are ring-fenced or client accounts used to protect funds for worker pay and liabilities? Justification: Demonstrates segregation of funds. Red flag: commingled funds or no protection for wages.

Select answer

Upload evidence for HMRC

Bank setup confirmation; audit notes

Short reason if answered N/A

Comments / Notes (Optional)

Section  5 – Worker Pay & Protections

This section ensures fairness, transparency, and compliance in all worker pay-related areas — including pensions, salary sacrifice schemes, holiday pay, Agency Workers Regulations (AWR), and expenses. It confirms that Employer NIC savings are not disguised as deductions, workers are not pushed below NMW thresholds, and statutory entitlements (holiday pay, pensions, expenses) are correctly applied and explained.

This protects workers, ensures supply chain integrity, and prevents disguised remuneration or wage skimming.

Worker Pay & Protections

001. Are any salary sacrifice or benefit schemes used by the umbrella (e.g., pensions, loans, childcare vouchers)? Justification: Identifies deductions requiring transparency. Red flag: hidden or unclear benefit deductions.

Select answer

Upload evidence for HMRC

Scheme overview; employee comms

Short reason if answered N/A

Comments / Notes (Optional)

002. Are outdated Regulation 10 contracts avoided post-April 2020? Justification: Confirms updated legal compliance. Red flag: continued use of Reg. 10 opt-outs.

Select answer

Upload evidence for HMRC

Archived templates; updated policy

Short reason if answered N/A

Comments / Notes (Optional)

003. Is there evidence that salary sacrifice schemes do not reduce pay below NMW thresholds? Justification: Protects statutory NMW compliance. Red flag: post-sacrifice pay < NMW.

Select answer

Upload evidence for HMRC

Payslip modelling; compliance logs

Short reason if answered N/A

Comments / Notes (Optional)

004. Are only genuine business expenses reimbursed (e.g., not home-to-work travel)? Justification: Prevents disguised remuneration. Red flag: non-allowable expenses reimbursed.

Select answer

Upload evidence for HMRC

Expense policy; claim forms

Short reason if answered N/A

Comments / Notes (Optional)

005. Is the financial impact of salary sacrifice clearly explained to workers before enrolment? Justification: Prevents misrepresentation. Red flag: no signed consent or illustrations.

Select answer

Upload evidence for HMRC

Financial illustrations; opt-in consent forms

Short reason if answered N/A

Comments / Notes (Optional)

006. Are receipts and supporting documents retained for all expense claims? Justification: Ensures audit trail. Red flag: expenses reimbursed without receipts.

Select answer

Upload evidence for HMRC

Receipt logs; scanned docs

Short reason if answered N/A

Comments / Notes (Optional)

007. Are Employer NIC savings retained or passed on to the worker? Justification: Ensures fairness in employer contributions. Red flag: NIC savings retained with no disclosure.

Select answer

Upload evidence for HMRC

Policy docs; payroll logs

Short reason if answered N/A

Comments / Notes (Optional)

008. Is the expenses policy compliant with ITEPA 339A/289A? Justification: Confirms HMRC compliance. Red flag: outdated/non-ITEPA aligned policy.

Select answer

Upload evidence for HMRC

Policy cross-ref with HMRC guidance

Short reason if answered N/A

Comments / Notes (Optional)

009. If NIC savings are retained or passed back, is this clearly disclosed to the worker? Justification: Confirms transparency of employer cost benefit. Red flag: payslips don’t itemise NIC benefit.

Select answer

Upload evidence for HMRC

Payslip notes; summary comms

Short reason if answered N/A

Comments / Notes (Optional)

010. Are expenses audited or subject to spot checks? Justification: Prevents abuse. Red flag: no expense sampling or audit.

Select answer

Upload evidence for HMRC

Expense audit logs; QA checks

Short reason if answered N/A

Comments / Notes (Optional)

011. Does the umbrella operate compliant auto-enrolment pension arrangements, with opt-outs recorded? Justification: Confirms statutory pension compliance. Red flag: no audit trail of opt-ins/opt-outs.

Select answer

Upload evidence for HMRC

Pension provider records; enrolment logs

Short reason if answered N/A

Comments / Notes (Optional)

012. Are Key Information Documents (KIDs) issued before each assignment? Justification: Ensures pay transparency. Red flag: missing KIDs at onboarding.

Select answer

Upload evidence for HMRC

Sample KID; onboarding template

Short reason if answered N/A

Comments / Notes (Optional)

013. Are payslips itemised to show all deductions, holiday pay, and pension contributions? Justification: Provides cost clarity. Red flag: payslips with rolled-up or hidden deductions.

Select answer

Upload evidence for HMRC

Payslip samples; payroll reports

Short reason if answered N/A

Comments / Notes (Optional)

014. Are Conduct Regs opt-out procedures documented and evidenced for each worker? Justification: Confirms correct legal engagement. Red flag: blanket opt-outs without consent.

Select answer

Upload evidence for HMRC

Signed disclosures; onboarding scripts

Short reason if answered N/A

Comments / Notes (Optional)

015. Do payslips show holiday pay or accrual clearly and correctly? Justification: Ensures WTR compliance. Red flag: holiday shown as “included in rate” or mislabelled.

Select answer

Upload evidence for HMRC

Holiday policy; payslip samples

Short reason if answered N/A

Comments / Notes (Optional)

016. Is unused holiday fully paid out upon termination? Justification: Protects entitlements. Red flag: workers leaving without holiday pay settlement.

Select answer

Upload evidence for HMRC

Final payslip; holiday reconciliation

Short reason if answered N/A

Comments / Notes (Optional)

017. Are holiday pay calculations aligned with 52-week average earnings (post-April 2020)? Justification: Ensures accuracy. Red flag: flat-rate % calculations only.

Select answer

Upload evidence for HMRC

Payroll calculations; policy docs

Short reason if answered N/A

Comments / Notes (Optional)

018. Does the umbrella have insurance in place to cover holiday pay or AWR liabilities? Justification: Provides liability protection. Red flag: no cover or exclusions.

Select answer

Upload evidence for HMRC

Insurance schedule; indemnity clauses

Short reason if answered N/A

Comments / Notes (Optional)

019. Is there a formal offboarding process for workers, including final pay, P45, and holiday reconciliation? Justification: Ensures closure transparency. Red flag: no audit trail of terminations.

Select answer

Upload evidence for HMRC

Exit checklist; P45; payslip with accruals

Short reason if answered N/A

Comments / Notes (Optional)

020. Does the umbrella track and document 12-week AWR parity timelines? Justification: Demonstrates compliance. Red flag: no evidence of AWR parity monitoring.

Select answer

Upload evidence for HMRC

AWR tracker; parity logs

Short reason if answered N/A

Comments / Notes (Optional)

021. Are comparator rates reviewed with the agency or end-client? Justification: Ensures pay parity. Red flag: no comparator evidence.

Select answer

Upload evidence for HMRC

Comparator evidence; client emails

Short reason if answered N/A

Comments / Notes (Optional)

Section 6 – Identity, Right-to-Work & Core GDPR

This section confirms that the umbrella performs compliant Right to Work (RTW) checks, secures worker identity data, and manages GDPR obligations lawfully.

It also integrates Modern Slavery Act safeguards and checks that workers are employed directly by the umbrella (not hidden entities).

Under the JSL regime (2026), end-hirers remain jointly responsible for worker protection and lawful engagement — so auditable evidence is critical.

Identity, Right-to-Work & Core GDPR

001. Are documented procedures in place for SARs, erasure, consent, and access rights? Justification: Ensures compliance with GDPR subject rights. Red flag: no SAR or consent logs.

Select answer

Upload evidence for HMRC

SAR logs; consent policies

Short reason if answered N/A

Comments / Notes (Optional)

002. Does the umbrella maintain a GDPR Article 30 RoPA and map all third-party processors? Justification: Confirms transparent processor relationships and data accountability. Red flag: incomplete RoPA.

Select answer

Upload evidence for HMRC

RoPA register; DPA contracts

Short reason if answered N/A

Comments / Notes (Optional)

003. Have all third-party processors (e.g. payroll, pension, benefits) been mapped? Justification: Ensures processor transparency. Red flag: unmapped processors.

Select answer

Upload evidence for HMRC

Processor inventory

Short reason if answered N/A

Comments / Notes (Optional)

004. Are Data Processing Agreements (DPAs) in place and current? Justification: Confirms lawful processing. Red flag: expired or unsigned DPAs.

Select answer

Upload evidence for HMRC

Signed DPAs

Short reason if answered N/A

Comments / Notes (Optional)

005. Is the umbrella ICO-registered as a data processor/controller? Justification: ICO compliance. Red flag: no ICO registration.

Select answer

Upload evidence for HMRC

ICO certificate

Short reason if answered N/A

Comments / Notes (Optional)

006. Has the umbrella been investigated by the ICO or suffered a data breach in the past 5 years? Justification: Tests data security history and incident response. Red flag: unresolved or repeated breaches.

Select answer

Upload evidence for HMRC

ICO records; breach response logs

Short reason if answered N/A

Comments / Notes (Optional)

007. Are RTW and onboarding teams trained to identify Modern Slavery risk indicators (e.g., debt bondage, coercion, restricted movement)? Justification: Ensures frontline staff can detect and escalate Modern Slavery risks. Red flag: no training or escalation logs.

Select answer

Upload evidence for HMRC

LMS logs; training records; incident reports

Short reason if answered N/A

Comments / Notes (Optional)

008. Does the umbrella complete and document RTW checks before assignment? Justification: Confirms statutory Home Office compliance. Red flag: missing or incomplete RTW forms.

Select answer

Upload evidence for HMRC

RTW policy; completed RTW forms

Short reason if answered N/A

Comments / Notes (Optional)

009. Do onboarding checks confirm the worker is employed directly by the umbrella (not a subsidiary or related entity)? Justification: Ensures correct employment chain and avoids attribution errors under JSL. Red flag: hidden subsidiaries.

Select answer

Upload evidence for HMRC

Onboarding pack; assignment letters; employment verification logs

Short reason if answered N/A

Comments / Notes (Optional)

010. Is photographic ID and proof of address consistently collected and retained? Justification: Provides secure identity audit trail. Red flag: gaps in ID records.

Select answer

Upload evidence for HMRC

Scanned ID; audit logs

Short reason if answered N/A

Comments / Notes (Optional)

011. Are digital RTW methods (e.g., IDVT or share code) used appropriately? Justification: Confirms modern compliance and authenticity. Red flag: reliance on unverifiable digital checks.

Select answer

Upload evidence for HMRC

Screenshots; RTW digital system logs

Short reason if answered N/A

Comments / Notes (Optional)

012. Are RTW checks stored securely and retained for at least 2 years post-assignment? Justification: Meets statutory retention requirements. Red flag: non-compliant storage or early deletion.

Select answer

Upload evidence for HMRC

RTW retention policy; document archive

Short reason if answered N/A

Comments / Notes (Optional)

013. Has the umbrella ever received Home Office warnings or audit notices? Justification: Identifies regulatory risk exposure. Red flag: repeated warnings or unresolved issues.

Select answer

Upload evidence for HMRC

Home Office letters; audit outcomes

Short reason if answered N/A

Comments / Notes (Optional)

014. Is there a GDPR policy in place outlining use of employee personal data? Justification: Confirms data rights and transparency. Red flag: no documented GDPR policy.

Select answer

Upload evidence for HMRC

GDPR/privacy policy

Short reason if answered N/A

Comments / Notes (Optional)

Section  7 – Worker Rights & Earnings Transparency

This section verifies umbrella compliance with statutory employment rights, including Working Time Regulations (WTR), Agency Workers Regulations (AWR), and statutory holiday pay.

It ensures workers receive accurate entitlements, that pay transparency is maintained, and that outdated or unfair contracting practices are avoided.

By covering onboarding (KIDs, Conduct Regs), in-life protections (holiday pay, AWR), and exit processes (offboarding, reconciliations), this section strengthens end-hirer accountability and mitigates joint employment risk.

Worker Rights & Earnings Transparency

001. Is unused holiday pay fully paid out upon termination? Justification: Safeguards worker earnings. Red flag: holiday pay withheld or offset.

Select answer

Upload evidence for HMRC

Final payslip; reconciliation policy

Short reason if answered N/A

Comments / Notes (Optional)

002. Does the umbrella track and document 12-week AWR parity timelines? Justification: Demonstrates AWR compliance. Red flag: no parity tracker in place.

Select answer

Upload evidence for HMRC

AWR tracker; parity confirmations

Short reason if answered N/A

Comments / Notes (Optional)

003. Are comparator rates regularly reviewed with agencies or end-clients to confirm parity? Justification: Confirms equal treatment and pay fairness. Red flag: no comparator evidence held.

Select answer

Upload evidence for HMRC

Comparator evidence; client emails

Short reason if answered N/A

Comments / Notes (Optional)

004. Are workers updated when their AWR rights change (e.g., after 12 weeks)? Justification: Ensures transparency and parity awareness. Red flag: no worker comms or signed updates.

Select answer

Upload evidence for HMRC

Worker comms; signed acknowledgements

Short reason if answered N/A

Comments / Notes (Optional)

005. Are outdated Regulation 10 contracts avoided post-April 2020? Justification: Confirms adherence to updated legal requirements. Red flag: continued use of Reg 10 “Swedish Derogation” contracts.

Select answer

Upload evidence for HMRC

Archived templates; updated policy

Short reason if answered N/A

Comments / Notes (Optional)

006. Are zero-hours or unfair exclusivity clauses avoided in worker contracts? Justification: Prevents exploitative practices. Red flag: exclusivity or “zero-rights” clauses.

Select answer

Upload evidence for HMRC

Contract samples; legal reviews

Short reason if answered N/A

Comments / Notes (Optional)

007. Does the umbrella hold insurance to cover statutory liabilities such as holiday pay or AWR? Justification: Provides liability protection for both workers and end-hirers. Red flag: no liability insurance for pay protection.

Select answer

Upload evidence for HMRC

Insurance schedule; indemnity clauses

Short reason if answered N/A

Comments / Notes (Optional)

008. Are Key Information Documents (KIDs) issued before each assignment? Justification: Confirms upfront fee and pay transparency. Red flag: no KID issued or outdated templates used.

Select answer

Upload evidence for HMRC

Sample KID; onboarding template

Short reason if answered N/A

Comments / Notes (Optional)

009. Is there a documented offboarding process including final pay, holiday reconciliation, and P45 issuance? Justification: Ensures transparent closure of employment. Red flag: workers leaving without P45 or holiday reconciliation.

Select answer

Upload evidence for HMRC

Exit checklist; payslip with final accruals; P45 log

Short reason if answered N/A

Comments / Notes (Optional)

010. Are Conduct Regs opt-out procedures documented and evidenced for each worker? Justification: Ensures correct legal engagement basis and prevents worker coercion. Red flag: blanket opt-outs without worker evidence.

Select answer

Upload evidence for HMRC

Opt-out confirmations; signed disclosures; onboarding scripts

Short reason if answered N/A

Comments / Notes (Optional)

011. Are final deductions (if any) explained clearly to workers during offboarding? Justification: Prevents hidden or unlawful deductions. Red flag: unexplained deductions in last payslip.

Select answer

Upload evidence for HMRC

Worker comms; final payslip notes

Short reason if answered N/A

Comments / Notes (Optional)

012. Are workers provided with a written summary of their statutory rights (holiday, AWR, pension, WTR)? Justification: Ensures workers are fully informed of their entitlements. Red flag: no rights summary or worker handbook.

Select answer

Upload evidence for HMRC

Worker handbook; onboarding pack

Short reason if answered N/A

Comments / Notes (Optional)

013. Are payslips itemised to show all deductions, holiday pay, and pension contributions clearly? Justification: Prevents hidden deductions; ensures cost clarity. Red flag: lump-sum deductions without breakdown.

Select answer

Upload evidence for HMRC

Payslip samples; payroll reports

Short reason if answered N/A

Comments / Notes (Optional)

014. Do payslips show holiday pay accrual transparently and in line with WTR rules? Justification: Confirms WTR compliance. Red flag: holiday pay missing, unclear, or bundled into rate.

Select answer

Upload evidence for HMRC

Holiday policy; payslip sample

Short reason if answered N/A

Comments / Notes (Optional)

015. Are holiday pay calculations based on the statutory 52-week average earnings? Justification: Protects worker entitlements and prevents underpayment. Red flag: flat % calculations post-April 2020.

Select answer

Upload evidence for HMRC

Payroll models; policy docs

Short reason if answered N/A

Comments / Notes (Optional)

Section 8 – Dispute, Complaint Handling & Record-Keeping

This section ensures the umbrella company has robust procedures to log, investigate, and resolve complaints fairly and transparently.

It also checks whether records are properly maintained and fed into continuous improvement.

Strong grievance and dispute-handling processes reduce worker dissatisfaction, prevent escalation to tribunal or reputational damage, and demonstrate that the end-hirer has effective oversight under CFA 2017, JSL (2026), and ACAS guidance.

Dispute, Complaint Handling & Record-Keeping

001. Are complaints independently reviewed (e.g., by compliance/NED) where bias may exist? Justification: Provides impartial oversight. Red flag: internal reviews only by payroll/sales with conflict of interest.

Select answer

Upload evidence for HMRC

Governance minutes; independent review notes

Short reason if answered N/A

Comments / Notes (Optional)

002. Is whistleblowing integrated with the complaint-handling process for escalation of serious issues (e.g., fraud, exploitation)? Justification: Protects workers and supports CFA/MSA compliance. Red flag: whistleblowing handled outside grievance process or not accessible.

Select answer

Upload evidence for HMRC

Whistleblowing policy; hotline records

Short reason if answered N/A

Comments / Notes (Optional)

003. Are root-cause reviews conducted, and are corrective actions tracked? Justification: Embeds lessons learned into operations. Red flag: repeat complaints with no remediation.

Select answer

Upload evidence for HMRC

RCA templates; action logs

Short reason if answered N/A

Comments / Notes (Optional)

004. Is feedback looped back into policy/training to prevent recurrence of common issues? Justification: Ensures continuous improvement. Red flag: no link between complaints and training updates.

Select answer

Upload evidence for HMRC

Training updates; policy revisions

Short reason if answered N/A

Comments / Notes (Optional)

005. Have any tribunal or ACAS claims been made in the past 3 years, and what were the outcomes? Justification: Provides visibility of litigation risk and reputational exposure. Red flag: frequent claims or large settlements.

Select answer

Upload evidence for HMRC

Tribunal summaries; settlement records

Short reason if answered N/A

Comments / Notes (Optional)

006. Are settlement agreements reviewed to ensure non-recurrence of issues? Justification: Tests whether risk is being mitigated post-dispute. Red flag: repeat breaches despite settlements.

Select answer

Upload evidence for HMRC

Settlement reviews; board reports

Short reason if answered N/A

Comments / Notes (Optional)

007. Are records retained in accordance with GDPR retention policies? Justification: Demonstrates compliance with data governance requirements. Red flag: absence of retention/deletion schedule.

Select answer

Upload evidence for HMRC

Retention policy; deletion schedule

Short reason if answered N/A

Comments / Notes (Optional)

008. Does the umbrella collect worker feedback (e.g., surveys, focus groups) on pay/service quality? Justification: Gives workers a voice; detects risks early. Red flag: no evidence of worker feedback being gathered.

Select answer

Upload evidence for HMRC

Survey reports; action outcomes

Short reason if answered N/A

Comments / Notes (Optional)

009. Are complaint trends and worker feedback shared with the agency/end-hirer? Justification: Provides transparency and strengthens client oversight. Red flag: agencies not informed of issues.

Select answer

Upload evidence for HMRC

Reports to clients; MI dashboards

Short reason if answered N/A

Comments / Notes (Optional)

010. Does the umbrella log all worker or agency complaints systematically? Justification: Confirms structured service quality monitoring. Red flag: no central log or only ad-hoc tracking.

Select answer

Upload evidence for HMRC

CRM export; complaints register

Short reason if answered N/A

Comments / Notes (Optional)

011. Is there a record confirming workers were not steered toward “high take-home” umbrellas (indicative of tax avoidance inducement)? Justification: Prevents onboarding abuse and aligns with HMRC red-flag detection. Red flag: evidence of inducement or non-compliant referrals.

Select answer

Upload evidence for HMRC

Worker declarations; onboarding comms; escalation logs

Short reason if answered N/A

Comments / Notes (Optional)

012. Are complaints categorised by type (pay, holiday, deductions, treatment, conduct) and monitored for patterns? Justification: Improves risk detection and reporting. Red flag: no categorisation; recurring issues ignored.

Select answer

Upload evidence for HMRC

Categorised complaint logs; analytics dashboard

Short reason if answered N/A

Comments / Notes (Optional)

013. Are escalation routes and SLAs documented for complaint resolution? Justification: Ensures timely response and accountability. Red flag: no SLA matrix; unresolved complaints.

Select answer

Upload evidence for HMRC

SOPs; SLA matrix; escalation flowcharts

Short reason if answered N/A

Comments / Notes (Optional)

014. Does the umbrella offer ACAS-style early resolution or mediation processes? Justification: Prevents unnecessary litigation; demonstrates fair culture. Red flag: no mediation routes, reliance only on legal action.

Select answer

Upload evidence for HMRC

ACAS-style logs; grievance procedure

Short reason if answered N/A

Comments / Notes (Optional)

Section 9 – Tax Risk (IR35, Disguised Remuneration, DRC VAT)

This section ensures umbrellas are not engaged in VAT fraud, disguised remuneration, or payroll manipulation that could expose end-hirers to liability under the Kittel principle, Criminal Finances Act 2017, or the upcoming Joint & Several Liability (JSL) regime (2026).

End-hirers must go beyond umbrella assurances to actively test VAT compliance, tax remittance, and hybrid PAYE/CIS risks.

Tax Risk (IR35, Disguised Remuneration, DRC VAT)

001. Do you assess Kittel risk (i.e., whether fraud was “known or should have been known”)? Justification: Protects VAT reclaim rights even without intent. Red flag: no documented Kittel risk logs or assessments.

Select answer

Upload evidence for HMRC

Kittel logs; training records

Short reason if answered N/A

Comments / Notes (Optional)

002. Have you reviewed the umbrella VAT returns and obtained evidence of VAT remittance to HMRC? Justification: Confirms VAT declared is actually paid, not just registered. Red flag: no remittance evidence.

Select answer

Upload evidence for HMRC

VAT100 returns; HMRC remittance evidence

Short reason if answered N/A

Comments / Notes (Optional)

003. Has the umbrella disclosed any use of hybrid PAYE/CIS or “purported umbrella” models? Justification: Identifies hidden status risks under s.61Z1 (2026). Red flag: non-disclosure or evidence of hidden hybrid use.

Select answer

Upload evidence for HMRC

Written disclosures; compliance reports

Short reason if answered N/A

Comments / Notes (Optional)

004. Do umbrella invoices reconcile with VAT returns, payments, and RTI submissions? Justification: Detects duplicate/fake invoices, under-reporting, or payroll skimming. Red flag: mismatches between invoices, RTI, and payments.

Select answer

Upload evidence for HMRC

Payment ledgers; VAT returns; RTI cross-checks

Short reason if answered N/A

Comments / Notes (Optional)

005. Are IR35/SDC assessments conducted for assignments where misclassification risk exists? Justification: Confirms correct tax treatment. Red flag: blanket self-employment or missing assessments.

Select answer

Upload evidence for HMRC

SDC/IR35 assessment logs; client status determinations

Short reason if answered N/A

Comments / Notes (Optional)

006. Have you assessed the umbrella for VAT deregistration, phoenixing, or insolvency risks in the last 12 months? Justification: Identifies high-risk entities likely to collapse or re-form to avoid liabilities. Red flag: insolvency history or phoenix activity.

Select answer

Upload evidence for HMRC

Disclosure statements; insolvency watchlist checks

Short reason if answered N/A

Comments / Notes (Optional)

007. Is there independent verification of tax treatment by accountants/legal advisors? Justification: Strengthens defensibility under CFA/JSL. Red flag: reliance only on internal declarations.

Select answer

Upload evidence for HMRC

External audit letters; legal opinions

Short reason if answered N/A

Comments / Notes (Optional)

008. Is there a documented VAT/tax due diligence log including Kittel risk assessments? Justification: Demonstrates proactive fraud monitoring and defensibility under CFA 2017 & JSL 2026. Red flag: no Kittel assessments or outdated logs.

Select answer

Upload evidence for HMRC

Due diligence logs; Kittel assessments; board minutes

Short reason if answered N/A

Comments / Notes (Optional)

009. Do you maintain a due diligence log for umbrella VAT, PAYE, and tax status checks? Justification: Demonstrates CFA 2017 and JSL compliance. Red flag: no logs or incomplete due diligence.

Select answer

Upload evidence for HMRC

Onboarding checklists; verification logs

Short reason if answered N/A

Comments / Notes (Optional)

010. Are reverse charge (DRC) rules correctly applied where relevant (e.g., CIS/construction)? Justification: Ensures VAT Notice 735 compliance. Red flag: VAT incorrectly charged instead of reverse charge.

Select answer

Upload evidence for HMRC

DRC notes on invoices; internal DRC policy

Short reason if answered N/A

Comments / Notes (Optional)

011. Are tax risk reviews refreshed annually (or sooner if red flags arise)? Justification: Confirms continuous oversight. Red flag: reviews not refreshed annually or after risk events.

Select answer

Upload evidence for HMRC

Risk register; audit schedules

Short reason if answered N/A

Comments / Notes (Optional)

012. Is the umbrella aware of and compliant with its DRC obligations? Justification: Minimises shared liability under CIS. Red flag: no training or contractual provisions on DRC.

Select answer

Upload evidence for HMRC

Contracts; training records

Short reason if answered N/A

Comments / Notes (Optional)

013. Are directors and compliance staff trained annually on tax fraud risks and JSL obligations? Justification: Builds awareness and mitigates negligence. Red flag: no refresher training records.

Select answer

Upload evidence for HMRC

Training logs; attendance records

Short reason if answered N/A

Comments / Notes (Optional)

014. Do you exclude VAT claims from suspected mini umbrella company (MUC) invoices? Justification: MUCs are often linked to tax fraud. Red flag: VAT reclaims processed from suspicious MUC suppliers.

Select answer

Upload evidence for HMRC

Labour chain maps; UTR checks

Short reason if answered N/A

Comments / Notes (Optional)

015. Are you monitoring for disguised remuneration or hybrid PAYE/CIS invoicing? Justification: Prevents use of invoices to mask employment status. Red flag: hybrid models used without disclosure.

Select answer

Upload evidence for HMRC

SDS/SDC assessments; contract models

Short reason if answered N/A

Comments / Notes (Optional)

Section  10 – Expenses, Subsistence & Reimbursement

This section confirms that umbrella reimbursement processes align with ITEPA 2003 and HMRC guidance.

It ensures expenses are genuine, evidenced, and not used to disguise remuneration. It also validates that workers are clearly informed of what is (and isn’t) reimbursable.

This is critical for end-hirers to defend against HMRC challenges under the Criminal Finances Act 2017, the Kittel principle, and upcoming JSL (2026) obligations.

Expenses, Subsistence & Reimbursement

001. Are subsistence payments (e.g., meals, accommodation) only reimbursed where travel rules apply? Justification: Prevents misuse of tax relief. Red flag: blanket subsistence allowances without eligibility checks.

Select answer

Upload evidence for HMRC

Sample claims; HMRC guidance cross-check

Short reason if answered N/A

Comments / Notes (Optional)

002. Are expense claims cross-checked against payroll to confirm no duplication with salary sacrifice or allowances? Justification: Prevents disguised remuneration. Red flag: double claiming via payroll and expenses.

Select answer

Upload evidence for HMRC

Payroll vs expense reconciliation

Short reason if answered N/A

Comments / Notes (Optional)

003. Do workers receive written guidance explaining expense eligibility before their first claim? Justification: Protects workers from reliance on verbal promises. Red flag: verbal-only instructions.

Select answer

Upload evidence for HMRC

Onboarding pack; worker handbook

Short reason if answered N/A

Comments / Notes (Optional)

004. Are material updates to expense rules (e.g., legislative change) communicated promptly to workers? Justification: Ensures continuous transparency. Red flag: policy changes not cascaded to workers.

Select answer

Upload evidence for HMRC

Update comms; worker acknowledgements

Short reason if answered N/A

Comments / Notes (Optional)

005. Does the umbrella only reimburse expenses that are genuinely incurred and business-related? Justification: Confirms anti-abuse controls. Red flag: expenses claimed without business purpose.

Select answer

Upload evidence for HMRC

Expense policy; claim forms

Short reason if answered N/A

Comments / Notes (Optional)

006. Is the expense policy clearly aligned with ITEPA 339A/289A and cross-referenced against HMRC guidance? Justification: Demonstrates legal compliance. Red flag: policy missing or outdated against HMRC rules.

Select answer

Upload evidence for HMRC

Policy cross-reference; HMRC manual extracts

Short reason if answered N/A

Comments / Notes (Optional)

007. Are workers explicitly told which expenses are eligible, which are not, and why? Justification: Provides transparency and prevents mis-selling. Red flag: no written guidance at onboarding.

Select answer

Upload evidence for HMRC

Worker guidance packs; induction materials

Short reason if answered N/A

Comments / Notes (Optional)

008. Are receipts and supporting documentation retained for all expense claims? Justification: Confirms a verifiable audit trail. Red flag: missing receipts or unverified claims.

Select answer

Upload evidence for HMRC

Receipt logs; scanned copies

Short reason if answered N/A

Comments / Notes (Optional)

009. Are electronic expense submissions subject to authenticity checks (e.g., digital receipts vs scanned fraud risks)? Justification: Prevents document manipulation. Red flag: acceptance of non-verifiable uploads.

Select answer

Upload evidence for HMRC

Expense software logs; QA checks

Short reason if answered N/A

Comments / Notes (Optional)

010. Are expense claims stored and retrievable for at least 6 years in line with HMRC record-keeping rules? Justification: Confirms statutory retention. Red flag: archive gaps or loss of historical claims.

Select answer

Upload evidence for HMRC

Archive access logs; policy statements

Short reason if answered N/A

Comments / Notes (Optional)

011. Are expenses regularly audited or subject to random spot checks? Justification: Demonstrates proactive compliance. Red flag: no audit trail or absence of sampling.

Select answer

Upload evidence for HMRC

Expense audit logs; internal QA reports

Short reason if answered N/A

Comments / Notes (Optional)

012. Is there independent oversight of high-risk categories (e.g., mileage, subsistence, travel)? Justification: Provides added assurance in high-risk areas. Red flag: mileage and travel unchecked against HMRC benchmarks.

Select answer

Upload evidence for HMRC

QA reports; board oversight minutes

Short reason if answered N/A

Comments / Notes (Optional)

013. Are repeat offenders (incorrect claims) flagged and retrained or disciplined? Justification: Embeds continuous improvement. Red flag: repeat expense abuse not escalated.

Select answer

Upload evidence for HMRC

Training logs; HR records

Short reason if answered N/A

Comments / Notes (Optional)

014. Is home-to-work travel never reimbursed tax-free under PAYE? Justification: Ensures compliance with HMRC restrictions. Red flag: travel-to-work claims processed as tax-free.

Select answer

Upload evidence for HMRC

Payslips; compliance notes

Short reason if answered N/A

Comments / Notes (Optional)

Section 11 – Criminal Finances Act 2017 (CFA) Compliance

This section checks whether the umbrella has robust measures to prevent the facilitation of tax evasion, as required under Section 45 of the Criminal Finances Act 2017. It validates risk assessments, anti-facilitation controls, escalation routes, and whistleblowing mechanisms.

These measures protect end-hirers from joint liability if umbrellas or their subcontractors enable tax evasion.

Criminal Finances Act 2017 (CFA) Compliance

001. Has a CFA 2017 risk assessment been carried out and documented? Justification: Confirms statutory compliance and awareness of obligations. Red flag: no documented risk assessment.

Select answer

Upload evidence for HMRC

CFA risk assessment report

Short reason if answered N/A

Comments / Notes (Optional)

002. Is the risk assessment reviewed at least annually, or when risks/legislation change? Justification: Ensures assessment remains valid and current. Red flag: assessment older than 12 months.

Select answer

Upload evidence for HMRC

Latest assessment copy; board minutes

Short reason if answered N/A

Comments / Notes (Optional)

003. Do you conduct scenario planning or simulations for future compliance risks (e.g., audits, fraud exposure, legislative changes)? Justification: Demonstrates proactive governance and resilience. Red flag: no forward planning or testing.

Select answer

Upload evidence for HMRC

Risk register; policy simulation outcomes

Short reason if answered N/A

Comments / Notes (Optional)

004. Is there a published anti-facilitation of tax evasion policy accessible to all staff? Justification: Provides clear organisational stance and deterrence. Red flag: policy not visible to staff.

Select answer

Upload evidence for HMRC

Policy documents; intranet post

Short reason if answered N/A

Comments / Notes (Optional)

005. Does the policy explicitly prohibit facilitation of tax evasion by staff or subcontractors? Justification: Reinforces zero-tolerance stance. Red flag: subcontractor obligations not included.

Select answer

Upload evidence for HMRC

Staff handbook; policy statement

Short reason if answered N/A

Comments / Notes (Optional)

006. Are subcontracted call centres or onboarding teams assessed for misrepresentation, coercion, or aggressive sales tactics? Justification: Detects non-compliant behaviour linked to disguised remuneration. Red flag: no QA on subcontracted teams.

Select answer

Upload evidence for HMRC

Call scripts; call audit logs; subcontractor QA logs

Short reason if answered N/A

Comments / Notes (Optional)

007. Have staff, including directors and senior managers, been trained on CFA obligations and evasion prevention? Justification: Builds organisation-wide risk awareness. Red flag: no director-level training.

Select answer

Upload evidence for HMRC

Training logs; LMS completions; signed declarations

Short reason if answered N/A

Comments / Notes (Optional)

008. Are refresher training and updates delivered when legislation or risks evolve? Justification: Ensures knowledge stays current. Red flag: training not refreshed for >12 months.

Select answer

Upload evidence for HMRC

Training schedules; updated materials

Short reason if answered N/A

Comments / Notes (Optional)

009. Is there a named CFA compliance officer or escalation contact? Justification: Provides governance oversight and accountability. Red flag: no designated officer.

Select answer

Upload evidence for HMRC

Escalation chart; role description

Short reason if answered N/A

Comments / Notes (Optional)

010. Is there a process for disclosing breaches, near misses, or suspicions of facilitation of tax evasion? Justification: Confirms transparency and remediation culture. Red flag: breach log empty or non-existent.

Select answer

Upload evidence for HMRC

RCA logs; incident reports; HMRC correspondence

Short reason if answered N/A

Comments / Notes (Optional)

011. Have any CFA breaches or near misses been disclosed in the last 3 years? Justification: Validates openness and remediation of risks. Red flag: no disclosures despite known issues sector-wide.

Select answer

Upload evidence for HMRC

Disclosure register; corrective action logs

Short reason if answered N/A

Comments / Notes (Optional)

012. Is there a whistleblowing process to report suspected facilitation of evasion confidentially? Justification: Provides safe reporting channel. Red flag: workers unaware of reporting route.

Select answer

Upload evidence for HMRC

Whistleblowing policy; hotline info

Short reason if answered N/A

Comments / Notes (Optional)

013. Is whistleblowing reporting tested (e.g., mock calls, internal audit reviews) to ensure functionality? Justification: Confirms effectiveness of protections. Red flag: no evidence of testing.

Select answer

Upload evidence for HMRC

Test logs; audit outcomes

Short reason if answered N/A

Comments / Notes (Optional)

014. Are CFA compliance measures independently reviewed (e.g., by auditors, legal advisors, or governance committees)? Justification: Adds external assurance and defensibility. Red flag: no third-party oversight.

Select answer

Upload evidence for HMRC

External audit letters; board committee minutes

Short reason if answered N/A

Comments / Notes (Optional)

015. Does the umbrella’s CFA framework extend to subcontractors and supply chain partners, with evidence of communication and compliance monitoring? Justification: Ensures CFA obligations flow down the chain — a core HMRC expectation. Red flag: no subcontractor CFA clauses or monitoring.

Select answer

Upload evidence for HMRC

Subcontractor agreements; CFA clauses; supplier audit logs

Short reason if answered N/A

Comments / Notes (Optional)

Section 12 – Modern Slavery Risk Management

This section ensures the umbrella is actively identifying, managing, and mitigating the risk of labour exploitation, trafficking, or coercion within its supply chain — including via umbrella and subcontractor operations.

Under the Modern Slavery Act 2015 and the 2026 JSL regime, end-hirers must demonstrate that reasonable steps were taken to prevent worker abuse and criminal facilitation of exploitation.

Modern Slavery Risk Management

001. Does the umbrella have a Modern Slavery Policy that applies across its supply chain, including subcontractors and outsourced payroll providers? Justification: Confirms baseline framework to prevent exploitation and ensure supply chain integrity. Red flag: policy does not extend to subcontractors or outsourcers.

Select answer

Upload evidence for HMRC

Policy document; subcontractor codes of conduct

Short reason if answered N/A

Comments / Notes (Optional)

002. Has a Modern Slavery risk assessment been conducted within the past 12 months? Justification: Demonstrates proactive identification of risks. Red flag: outdated or no assessment.

Select answer

Upload evidence for HMRC

Risk logs; heatmaps; supplier assessments

Short reason if answered N/A

Comments / Notes (Optional)

003. Has the umbrella published and shared a Modern Slavery compliance statement or assurance declaration with the end-hirer? Justification: Ensures statutory compliance and accountability. Red flag: no published annual statement.

Select answer

Upload evidence for HMRC

Annual statement; board-approved assurance; PSL extracts

Short reason if answered N/A

Comments / Notes (Optional)

004. Do umbrella contracts include Modern Slavery clauses, giving the end-hirer audit/termination rights if risks are identified? Justification: Embeds enforceable protections. Red flag: no audit/termination rights included.

Select answer

Upload evidence for HMRC

Contract extracts; PSL terms; escalation clauses

Short reason if answered N/A

Comments / Notes (Optional)

005. Is Modern Slavery awareness training provided to onboarding, payroll, compliance, and director-level staff? Justification: Equips staff to identify red flags (e.g., debt bondage, coercion). Red flag: training not rolled out beyond junior staff.

Select answer

Upload evidence for HMRC

LMS logs; signed training records

Short reason if answered N/A

Comments / Notes (Optional)

006. Are staff trained to recognise indicators of exploitation, such as excessive turnover, debt dependency, tied housing, or withheld wages? Justification: Enhances proactive detection of hidden exploitation. Red flag: no evidence of indicator training.

Select answer

Upload evidence for HMRC

Training content; staff declarations

Short reason if answered N/A

Comments / Notes (Optional)

007. Has the umbrella confirmed it does not charge recruitment fees or impose unlawful deductions (e.g., admin fees, clawbacks)? Justification: Confirms compliance with fee-free recruitment standards. Red flag: deductions noted in payslips or contracts.

Select answer

Upload evidence for HMRC

Worker declarations; payslip checks

Short reason if answered N/A

Comments / Notes (Optional)

008. Does the umbrella complete and retain compliant Right to Work (RTW) checks for all workers it employs? Justification: Prevents trafficking, illegal working, and fraud. Red flag: RTW gaps or incomplete records.

Select answer

Upload evidence for HMRC

RTW records; scanned IDs; audit logs

Short reason if answered N/A

Comments / Notes (Optional)

009. Does the umbrella provide an anonymous whistleblowing mechanism for workers to report exploitation or mistreatment? Justification: Enables escalation and protective action. Red flag: hotline not publicised or untested.

Select answer

Upload evidence for HMRC

Whistleblowing policy; hotline logs; investigation summaries

Short reason if answered N/A

Comments / Notes (Optional)

010. Has the umbrella taken any action in the past 12 months in response to welfare or exploitation concerns? Justification: Demonstrates responsiveness. Red flag: no action logged despite sector-wide risks.

Select answer

Upload evidence for HMRC

Incident logs; remedial action reports

Short reason if answered N/A

Comments / Notes (Optional)

011. Does the umbrella monitor for exploitation indicators (e.g., turnover, housing dependency, withheld wages, passport retention)? Justification: Supports ongoing risk detection. Red flag: no active monitoring of turnover or debt dependency.

Select answer

Upload evidence for HMRC

Worker surveys; payslip sampling; site audit findings

Short reason if answered N/A

Comments / Notes (Optional)

012. Are supplier/subcontractor due diligence checks conducted specifically for Modern Slavery risks? Justification: Extends assurance beyond umbrella. Red flag: subcontractor checks exclude slavery risk.

Select answer

Upload evidence for HMRC

Subcontractor audits; due diligence reports

Short reason if answered N/A

Comments / Notes (Optional)

013. Are outcomes of Modern Slavery risk management (e.g., training coverage, incident responses, worker feedback) reported annually to the end-hirer? Justification: Provides visibility and strengthens accountability under JSL. Red flag: outcomes not shared with end-hirer.

Select answer

Upload evidence for HMRC

Annual assurance pack; KPI dashboard

Short reason if answered N/A

Comments / Notes (Optional)

014. Has the umbrella conducted a Modern Slavery risk assessment of its supply chain? Justification: Confirms ethical compliance obligations. Red flag: no mapping of subcontractors/overseas suppliers.

Select answer

Upload evidence for HMRC

Supply chain mapping; slavery risk logs

Short reason if answered N/A

Comments / Notes (Optional)

015. Is Modern Slavery awareness training provided to RTW/payroll staff? Justification: Ensures front-line risk identification. Red flag: RTW team not trained.

Select answer

Upload evidence for HMRC

LMS logs; training records

Short reason if answered N/A

Comments / Notes (Optional)

016. Are directors and senior staff trained on modern slavery risks and safeguarding protocols? Justification: Extends ethical oversight. Red flag: training limited to operational staff only.

Select answer

Upload evidence for HMRC

Training logs; board briefing slides

Short reason if answered N/A

Comments / Notes (Optional)

017. Are worker fatigue risks and competency declarations assessed during onboarding? Justification: Reduces operational risk and ensures safe assignment practices. Red flag: no fatigue/competency checks in onboarding pack.

Select answer

Upload evidence for HMRC

Induction records; fatigue management checklist; competency forms

Short reason if answered N/A

Comments / Notes (Optional)

Section 13 – Business Continuity, Cybersecurity & Exit Planning

Ensures umbrellas can maintain payroll/data integrity, withstand disruptions, and transfer records securely if they cease trading.

Business Continuity, Cybersecurity & Exit Planning

001. Does the umbrella have a documented Business Continuity Plan (BCP) covering CIS payroll disruption? Justification: Ensures continuity. Red flag: no CIS/payroll-specific BCP, or untested plan.

Select answer

Upload evidence for HMRC

BCP

Short reason if answered N/A

Comments / Notes (Optional)

002. Are CIS/payroll systems regularly backed up & tested for recovery? Justification: Prevents data loss. Red flag: backups not tested, or stored only locally.

Select answer

Upload evidence for HMRC

Backup/test logs

Short reason if answered N/A

Comments / Notes (Optional)

003. Are cybersecurity controls in place (encryption, firewalls, access restrictions)? Justification: Prevents breaches. Red flag: no penetration test, outdated antivirus/firewall.

Select answer

Upload evidence for HMRC

IT policy; penetration test

Short reason if answered N/A

Comments / Notes (Optional)

004. Is system access restricted by roles, with audit logs of changes? Justification: Protects data integrity. Red flag: shared logins, no role-based restrictions, or missing audit logs.

Select answer

Upload evidence for HMRC

Access logs

Short reason if answered N/A

Comments / Notes (Optional)

005. Does the umbrella have an exit plan for secure transfer of CIS records to end-hirer/HMRC? Justification: Prevents data loss on insolvency. Red flag: no formal exit plan or contractual clauses for record handover.

Select answer

Upload evidence for HMRC

Exit plan; contract clauses

Short reason if answered N/A

Comments / Notes (Optional)

Section  14 – Complaints & Worker Grievances (Strengthened)

Although governance sections already touch on this, HMRC expect clear evidence of worker voice.

This mirrors the Agency audit requirements.

Complaints & Worker Grievances (Strengthened)

001. Does the umbrella have a documented complaints/grievance procedure accessible to CIS workers? Justification: Ensures fairness. Red flag: no formal grievance process.

Select answer

Upload evidence for HMRC

Policy

Short reason if answered N/A

Comments / Notes (Optional)

002. Are workers informed of this process at onboarding? Justification: Confirms transparency. Red flag: workers unaware of complaint routes.

Select answer

Upload evidence for HMRC

Induction packs

Short reason if answered N/A

Comments / Notes (Optional)

003. Are complaints logged, investigated & resolved within set timeframes? Justification: Confirms accountability. Red flag: unresolved or repeated complaints.

Select answer

Upload evidence for HMRC

Complaints log

Short reason if answered N/A

Comments / Notes (Optional)

004. Is there an escalation route to the agency/end-hirer if unresolved? Justification: Provides worker protection. Red flag: no escalation beyond umbrella.

Select answer

Upload evidence for HMRC

Escalation policy

Short reason if answered N/A

Comments / Notes (Optional)

005. Are grievance records retained & auditable for review by agency/end-hirer? Justification: Confirms oversight. Red flag: missing or incomplete complaint records.

Select answer

Upload evidence for HMRC

Records

Short reason if answered N/A

Comments / Notes (Optional)

Section 15 – Insurance & Financial Resilience

End-hirers need assurance that CIS umbrellas are financially stable, able to pay workers on time, and resilient to shocks.

HMRC and the FCA flag insolvency/phoenix risk as key indicators of fraud.

🚩Red Flags

Red flags include late filing of accounts, repeated losses, reliance on subcontractor credit, or lapsed insurance cover.

Insurance & Financial Resilience

001. Is credit insurance in place to protect against client insolvency (if relevant)? Justification: Ensures financial resilience. Red flag: no cover despite high-risk clients.

Select answer

Upload evidence for HMRC

Credit insurance certificate, broker statement

Short reason if answered N/A

Comments / Notes (Optional)

002. Has the umbrella been subject to insolvency proceedings, CCJs, or winding-up petitions in the past 5 years? Justification: Detects financial fragility. Red flag: undisclosed or repeated legal actions.

Select answer

Upload evidence for HMRC

Insolvency register, CCJ search, court filings

Short reason if answered N/A

Comments / Notes (Optional)

003. Does the umbrella operate segregated or ring-fenced accounts for CIS tax deductions? Justification: Protects funds intended for HMRC. Red flag: deductions pooled in trading accounts.

Select answer

Upload evidence for HMRC

Bank account s

Short reason if answered N/A

Comments / Notes (Optional)

004. Does the umbrella file statutory accounts on time with Companies House? Justification: Confirms compliance & stability. Red flag: overdue or missing filings.

Select answer

Upload evidence for HMRC

CH filing history, last annual accounts

Short reason if answered N/A

Comments / Notes (Optional)

005. Has the umbrella provided recent management accounts or audited accounts? Justification: Demonstrates trading solvency. Red flag: persistent losses or negative equity.

Select answer

Upload evidence for HMRC

Management accounts (last 6 months), audited accounts

Short reason if answered N/A

Comments / Notes (Optional)

006. Does the umbrella hold valid Professional Indemnity (PI) insurance? Justification: Protects against negligence claims. Red flag: expired or missing PI cover.

Select answer

Upload evidence for HMRC

Insurance certificate

Short reason if answered N/A

Comments / Notes (Optional)

007. Is Employers’ Liability (EL) insurance in place ? Justification: Covers grey areas if CIS reclassified. Red flag: no EL despite CIS challenge risk.

Select answer

Upload evidence for HMRC

EL certificate

Short reason if answered N/A

Comments / Notes (Optional)

008. Is Public Liability (PL) insurance maintained? Justification: Protects against injury/property claims. Red flag: lapsed or no PL.

Select answer

Upload evidence for HMRC

PL schedule

Short reason if answered N/A

Comments / Notes (Optional)

Section 16 – Mini Umbrella Company (MUC) Fraud Controls

This section protects the supply chain from risks linked to mini umbrella company (MUC) fraud, which involves fragmented PAYE schemes, misuse of Employment Allowance, or VAT threshold manipulation.

Such practices expose end-hirers to reputational damage, HMRC enforcement, and JSL (2026) liabilities. Strong MUC controls demonstrate a clean labour supply chain and proactive fraud prevention.

Mini Umbrella Company (MUC) Fraud Controls

001. Has the umbrella screened its PAYE structures and group entities for potential MUC risks? Justification: Identifies fragmented PAYE setups. Red flag: multiple small PAYE schemes without rationale.

Select answer

Upload evidence for HMRC

Internal MUC risk log; PAYE registration list; group structure chart

Short reason if answered N/A

Comments / Notes (Optional)

002. Does the umbrella maintain an internal red-flag checklist for HMRC’s published MUC indicators (e.g., short-lived entities, sequential director changes, low turnover)? Justification: Ensures active monitoring. Red flag: no red-flag register maintained.

Select answer

Upload evidence for HMRC

Red flag checklist; monitoring reports

Short reason if answered N/A

Comments / Notes (Optional)

003. Are all PAYE schemes operated under the umbrella justified with documented rationale? Justification: Prevents artificial fragmentation. Red flag: unexplained multiple PAYE schemes.

Select answer

Upload evidence for HMRC

Payroll system map; governance papers

Short reason if answered N/A

Comments / Notes (Optional)

004. Are payrolls consolidated across group companies to prevent unnecessary scheme splitting? Justification: Ensures transparency. Red flag: fragmented payroll without consolidation.

Select answer

Upload evidence for HMRC

Payroll consolidation policies; HMRC correspondence

Short reason if answered N/A

Comments / Notes (Optional)

005. Are Employment Allowance and VAT thresholds monitored to prevent misuse or manipulation? Justification: Detects abuse of tax reliefs. Red flag: repeated use of EA/VAT allowances by linked entities.

Select answer

Upload evidence for HMRC

Payroll tax records; VAT filings; EA claims

Short reason if answered N/A

Comments / Notes (Optional)

006. Has the umbrella been subject to HMRC or agency audits regarding MUC risks, and were outcomes disclosed? Justification: Confirms openness. Red flag: undisclosed HMRC/agency warnings.

Select answer

Upload evidence for HMRC

HMRC audit letters; agency audit reports

Short reason if answered N/A

Comments / Notes (Optional)

007. Are MUC controls independently reviewed (e.g., by external accountants or compliance auditors)? Justification: Provides external assurance. Red flag: no independent review evidence.

Select answer

Upload evidence for HMRC

Third-party audit reports; compliance reviews

Short reason if answered N/A

Comments / Notes (Optional)

008. Do subcontractors engaged by the umbrella confirm they are not operating MUC structures? Justification: Prevents upstream fraud. Red flag: subcontractors unable/unwilling to confirm.

Select answer

Upload evidence for HMRC

Subcontractor declarations; due diligence logs

Short reason if answered N/A

Comments / Notes (Optional)

009. Are subcontractor PAYE registrations and VAT numbers validated to confirm no fragmentation risk? Justification: Extends assurance beyond umbrella. Red flag: subcontractor PAYE/VAT unverifiable.

Select answer

Upload evidence for HMRC

HMRC checks; Companies House extracts

Short reason if answered N/A

Comments / Notes (Optional)

Section 17 – Hybrid PAYE/CIS Model Risk Assessment

This section helps end-hirers identify if the umbrella is using hybrid PAYE/CIS or mixed-status models that could trigger misclassification, JSL exposure, or “purported umbrella” risks under s.61Z1 of the 2026 legislation.

It ensures that the payroll model matches both the end-hirer’s understanding and HMRC’s expectations, and that any deviation is disclosed, justified, and evidenced.

Hybrid PAYE/CIS Model Risk Assessment

001. Are hybrid model risks logged in the umbrella’s internal compliance/tax registers and reviewed at governance level? Justification: Detects unresolved risks. Red flag: hybrid risks not tracked or reviewed.

Select answer

Upload evidence for HMRC

Risk register; compliance logs; board minutes

Short reason if answered N/A

Comments / Notes (Optional)

002. Do you perform periodic re-verification (annual or risk-triggered) that hybrid arrangements remain compliant with PAYE/VAT rules? Justification: Moves assurance to continuous monitoring. Red flag: no periodic re-checks.

Select answer

Upload evidence for HMRC

Due diligence tracker with refresh dates; compliance review logs

Short reason if answered N/A

Comments / Notes (Optional)

003. Has the umbrella been challenged by HMRC, agencies, or clients over hybrid model use? Justification: Identifies disputes. Red flag: undisclosed HMRC/client challenges.

Select answer

Upload evidence for HMRC

HMRC correspondence; client audit findings

Short reason if answered N/A

Comments / Notes (Optional)

004. Are directors and compliance officers trained on hybrid model risks and s.61Z1 “purported umbrella” rules? Justification: Builds 2026 readiness. Red flag: no training for senior staff.

Select answer

Upload evidence for HMRC

Training logs; board briefings

Short reason if answered N/A

Comments / Notes (Optional)

005. Has the umbrella disclosed whether it operates both PAYE and CIS/self-employed models? Justification: Validates transparency. Red flag: undisclosed hybrid operations.

Select answer

Upload evidence for HMRC

Written confirmation; group structure chart; SDC assessment

Short reason if answered N/A

Comments / Notes (Optional)

006. Are all key financial illustrations (margin, tax, pay) retained and sampled for compliance accuracy? Justification: Ensures workers understand pay. Red flag: no pay illustrations or misleading examples.

Select answer

Upload evidence for HMRC

Sample illustrations; onboarding call summaries; QA audit logs

Short reason if answered N/A

Comments / Notes (Optional)

007. Are workers given clear contracts and pay illustrations for each model? Justification: Provides clarity. Red flag: contracts missing or inconsistent with pay models.

Select answer

Upload evidence for HMRC

Worker comms; signed contracts; legal opinion

Short reason if answered N/A

Comments / Notes (Optional)

008. Are there documented justifications for allocating workers to CIS vs PAYE? Justification: Detects disguised models. Red flag: arbitrary CIS allocations.

Select answer

Upload evidence for HMRC

Payroll logs; allocation policies; payslip comparisons

Short reason if answered N/A

Comments / Notes (Optional)

009. Are workers ever moved between PAYE and CIS mid-assignment or on similar tasks? Justification: Tests for artificial structures. Red flag: mid-assignment switches.

Select answer

Upload evidence for HMRC

Policy statements; audit trail

Short reason if answered N/A

Comments / Notes (Optional)

010. Are any CIS assignments linked to workers who also perform PAYE work for the same end-client? Justification: Detects disguised employment. Red flag: CIS + PAYE for same end-client.

Select answer

Upload evidence for HMRC

Onboarding forms; agency–client correspondence

Short reason if answered N/A

Comments / Notes (Optional)

011. Has the umbrella confirmed that hybrid models are not used to avoid employer NICs? Justification: Prevents “purported umbrella” risks. Red flag: hybrid models reducing NICs.

Select answer

Upload evidence for HMRC

Assignment logs; onboarding packs

Short reason if answered N/A

Comments / Notes (Optional)

012. Are hybrid model disclosures made to the agency/end-hirer before onboarding? Justification: Ensures informed consent. Red flag: no disclosure before engagement.

Select answer

Upload evidence for HMRC

Worker comms; agency agreements

Short reason if answered N/A

Comments / Notes (Optional)

013. Has the umbrella sought professional advice on the legality of hybrid arrangements? Justification: Demonstrates oversight. Red flag: no external legal/accounting opinion.

Select answer

Upload evidence for HMRC

Legal opinion; compliance committee minutes

Short reason if answered N/A

Comments / Notes (Optional)

Section 18 – 2026 Umbrella Legislation Readiness & Joint and Several Liability (JSL) End-Hirer Controls7 – Hybrid PAYE/CIS Model Risk Assessment

From April 2026, umbrella companies will fall under new UK regulation, and Joint & Several Liability (JSL) will hold end-hirers accountable for supply chain non-compliance — even where breaches occur downstream.

End-hirers can no longer rely on umbrella assurances alone: they must evidence active preparation, preventative controls, and audit rights.

This section ensures end-hirers are:

  • Assessing readiness for the 2026 reforms
  • Embedding preventative measures to detect fraud, disguised remuneration, or worker exploitation
  • Enforcing transparency and auditability across agencies and umbrellas
  • Demonstrating governance that mitigates strict liability exposure

2026 Umbrella Legislation Readiness & Joint and Several Liability (JSL) End-Hirer Controls

001. Has the umbrella implemented documented controls to prevent tax evasion or disguised remuneration? Justification: Confirms proactive governance. Red flag: no anti-evasion policy or SOPs.

Select answer

Upload evidence for HMRC

Anti-tax evasion policy; compliance SOPs; staff training logs

Short reason if answered N/A

Comments / Notes (Optional)

002. Has the umbrella undergone due diligence on its payroll model, PAYE registration, VAT status, and audit history — and can this be evidenced? Justification: Protects against hidden liabilities. Red flag: no due diligence pack.

Select answer

Upload evidence for HMRC

Due diligence reports; accreditation certificates; group structure diagrams

Short reason if answered N/A

Comments / Notes (Optional)

003. Can the umbrella confirm it does not operate or partner with mini umbrellas or artificially fragmented entities? Justification: Ensures supply chain integrity. Red flag: undisclosed MUC links.

Select answer

Upload evidence for HMRC

Supply chain maps; subcontractor declarations; onboarding logs

Short reason if answered N/A

Comments / Notes (Optional)

004. Has the umbrella mapped and disclosed all subcontracted or third-party entities involved in delivering PAYE services? Justification: Enables visibility. Red flag: incomplete subcontractor disclosures.

Select answer

Upload evidence for HMRC

Subcontractor agreements; due diligence logs

Short reason if answered N/A

Comments / Notes (Optional)

005. Does the umbrella have a whistleblowing or escalation procedure for payroll non-compliance or worker exploitation? Justification: Ensures early detection. Red flag: no safe reporting channel.

Select answer

Upload evidence for HMRC

Whistleblowing policy; hotline info; escalation logs

Short reason if answered N/A

Comments / Notes (Optional)

006. Does the umbrella allow end-hirer audits of payslips, payroll journals, RTI submissions, and margin deductions? Justification: Provides assurance. Red flag: refusal to permit audits.

Select answer

Upload evidence for HMRC

Executed contracts; audit access clauses; payroll audit reports

Short reason if answered N/A

Comments / Notes (Optional)

007. Are umbrella contracts legally binding and include obligations to comply with PAYE, NMW, pensions, and tax law? Justification: Embeds enforceable compliance. Red flag: vague or non-binding contracts.

Select answer

Upload evidence for HMRC

Agency/umbrella contracts; SLA extracts

Short reason if answered N/A

Comments / Notes (Optional)

008. Has the umbrella disclosed whether it outsources payroll or compliance functions — and are these third parties subject to equivalent due diligence? Justification: Extends JSL compliance. Red flag: outsourced providers not audited.

Select answer

Upload evidence for HMRC

Master service agreements; audit rights over subcontractors

Short reason if answered N/A

Comments / Notes (Optional)

009. Has the umbrella granted the end-hirer clear audit rights across payroll and compliance records? Justification: Ensures accountability. Red flag: audit rights excluded from contracts.

Select answer

Upload evidence for HMRC

Audit rights clauses; board-approved compliance policy

Short reason if answered N/A

Comments / Notes (Optional)

010. Has the umbrella reviewed its policies, training, and risk registers to prepare for the 2026 JSL regime? Justification: Demonstrates forward planning. Red flag: no JSL readiness plan.

Select answer

Upload evidence for HMRC

Updated compliance policies; training logs; JSL readiness plan

Short reason if answered N/A

Comments / Notes (Optional)

011. Are directors and senior managers trained on the JSL regime and their personal liability exposure? Justification: Embeds top-level accountability. Red flag: directors unaware of liability.

Select answer

Upload evidence for HMRC

Training records; board minutes; signed director declarations

Short reason if answered N/A

Comments / Notes (Optional)

Section 12 – Final Declaration and Signoff

Captures accountability and sign-off from the end-hirer, confirming that the audit covering both Umbrella PAYE engagements has been completed, reviewed, and authorised by a suitably responsible individual.

This declaration signifies the end-hirer’s commitment to transparency, lawful engagement, tax compliance, and ethical labour supply practices.

Final Declaration and Agency Signoff

I, the undersigned, hereby confirm the following on behalf of the end-hirer that the information provided in this self-audit of our umbrella and CIS labour supply chain is, to the best of my knowledge, accurate, complete, and a fair reflection of our internal due diligence, risk controls, and operational compliance.

I confirm that:

1) Supporting documentation referenced in this audit can be made available upon legitimate request.

2) We have taken reasonable steps to ensure that umbrella and CIS providers within our supply chain operate in line with UK employment law, HMRC tax regulations, and supply chain transparency obligations.

This declaration signifies our commitment to:

i) Preventing disguised remuneration, tax evasion, and labour exploitation

ii) Upholding the rights and entitlements of all workers in our supply chain

iii) Meeting obligations under the Criminal Finances Act 2017, Modern Slavery Act 2015, and other relevant legislation

iv) Continuously improving our supply chain governance