Compliance is your asset

The OPRaaS Virtual Compliance Director (VCD) platform moves end-hirers, agencies, umbrella companies and public-sector MSPs beyond static spreadsheets into an HMRC and client-ready systemised, continuous governance system.

~ 0 %

of SOW consultants are misclassified as staff augmentation

£ 0 k

threshold below which SOW spend is routinely ungoverned

IR35

End-hirers bear the tax liability for misclassified SOW engagements

new HMRC compliance officers active with AI-led enforcement

For End-Hirers For Agencies How OPRaaS Helps Our Process

End-Hirer Perspective

SOW is your fastest-growing compliance blind spot.

Statement-of-Work spend has overtaken temp staffing as the preferred route for flexible specialist talent. But most organisations manage it with the same rigour as a stationery order. The result: hidden employment relationships, IR35 exposure, and a supply chain regulators can unpick in minutes.

OPRaaS gives you the audit capability, classification tools, and governance framework to make every SOW engagement defensible.

UK Regulatory Exposure

Layered UK legal risk in every SOW engagement.

Unlike the US market, UK SOW misclassification creates simultaneous exposure across multiple legislative frameworks. Understanding each is the starting point for compliance.

IR35 / Off-Payroll

End-hirer is deemed employer. Tax liability for misclassified engagements falls on you, not the supplier.

Agency Worker Regulations

Controlled SOW workers may acquire AWR rights at 12 weeks: equal pay, working conditions, collective facilities.

Employment Status

Workers under your direction may gain worker or employee status: holiday pay, NMW, unfair dismissal.

TUPE

Structured as outsourcing? Bringing it back in-house or changing provider triggers automatic employment transfers.

Modern Slavery Act

SOW supply chains with layered staffing are a known high-risk area for due diligence obligations.

Joint & Several Liability

From April 2026, HMRC holds non-compliant parties in the labour supply chain strictly liable under ITEPA Ch.11.

Risk vs. Reward

Ungoverned SOW spend is both a risk and a cost problem.

Risks of Ungoverned SOW

IR35 tax liability falling on you as deemed employer
AWR equal pay claims from workers under your direction after 12 weeks
Employment status claims, backdated holiday pay and NMW
GDPR breaches from untracked SOW consultant data access
IP ownership disputes where work product rights are not contractually assigned
Incomplete off-boarding leaving live systems access post-engagement
Layered staffing: temps billed as SOW consultants at 20 to 70% rate premium
Modern Slavery Act supply chain liability

✓

Benefits of Governed SOW

Full visibility of SOW spend by supplier, category, and business unit
Defensible IR35 determinations for every engagement
Cost savings: identify over-payment where staff aug is priced as SOW
Stronger contractual position protecting IP and deliverables
Audit-ready documentation standing up to HMRC scrutiny
Clean off-boarding: access revoked same day, every time
QECR-rated supplier performance driving better outcomes
Competitive procurement: market-rate benchmarking on all engagements

Classification Essentials

Five UK-law tests that determine whether your SOW is genuine.

These are the tests HMRC, employment tribunals and courts apply. OPRaaS maps every engagement against all five.

Test	Key Question	SOW-Safe Answer	Staff Aug Indicator
Control	Who controls how, when and where work is done?	Supplier controls method; client specifies outcome only	End-hirer directs daily tasks, hours, location
Personal Service	Must the named individual perform the work?	Unrestricted supplier substitution right exists	Named individual selected by hiring manager
Mutuality	Is the end-hirer obliged to provide ongoing work?	Project-specific; no ongoing obligation	Rolling extensions with no natural break point
Financial Risk	Does the supplier bear risk if deliverables are not met?	SLAs, penalties and re-work at supplier cost	Payment regardless of output quality or completion
Integration	Is the supplier’s team integrated into your organisation?	Supplier has own PM, methodology and tools	Workers use client equipment, attend internal meetings as staff

⚠

The Layered Staffing Trap: The most common and most costly SOW misclassification occurs when an SOW supplier sub-contracts to a recruitment agency and deploys temporary workers as “consultants.” This creates simultaneous IR35, AWR, and employment status exposure. The OPRaaS audit specifically targets this pattern as a priority finding.

Ready to audit your SOW engagements?

OPRaaS delivers a structured, six-domain SOW audit producing a RAG-rated Compliance Scorecard, giving you a defensible, HMRC-ready picture of every engagement in your programme.

Request an SOW Audit Our Services →

Agency Perspective

SOW is your next commercial frontier. The compliance gap is real.

Margin pressure on traditional temp staffing is intensifying. SOW engagements offer mid-30% gross margins versus circa 20% for staffing, but only if the commercial structure, contractual architecture, and worker classification are built correctly from day one.

Getting it wrong creates IR35 and AWR liability for your end-hirer clients and exposes your workers. OPRaaS helps agencies build a genuinely compliant SOW capability, not a staffing business with a different label.

Commercial Opportunity

Why agencies are pivoting to SOW, and what makes it work.

↑

The SOW Commercial Opportunity

Mid-30% gross margins versus circa 20% for traditional temp staffing
Deeper, more strategic client relationships where you own the outcome
Differentiation from commoditised competitors in VMS-managed programmes
Recurring revenue through ongoing managed service models
Access to procurement budgets that bypass temp labour controls
Higher-value, harder-to-re-source engagements
Reduced exposure to VMS fee compression on time-based billing

Risks of Getting It Wrong

Creating IR35 liability for end-hirer clients, with reputational and commercial damage
AWR claims from workers your clients direct, with legal exposure falling upstream to you
Relabelling temp staff as “SOW consultants” that regulators see through immediately
Layered staffing: using temps as SOW subcontractors, the single biggest failure
SOW documents that read like job descriptions, failing every classification test
No genuine risk transfer: no deliverables, no SLAs, no defensible SOW
Loss of client trust when reclassification forces mid-engagement restructuring

Structural Non-Negotiables

Six things every agency must build before launching an SOW practice.

Separate Commercial Entities

Separate legal entities, contracts, MSA frameworks, and invoicing for SOW and staffing operations prevent co-mingling and protect both businesses from regulatory co-contamination.

Your Own Employed Bench

SOW consultants must be your direct employees or bona fide independent contractors, not temps sourced from your own or another agency’s pool. This is non-negotiable and the first thing any audit will check.

Dedicated Project Managers

A dedicated PM deployed from your business, not the client’s manager, is the single clearest indicator of genuine SOW. Invest in this role before you pursue your first engagement.

Proprietary IP & Methodology

Proprietary processes, tools, and methodologies you bring to the engagement demonstrate genuine expertise and significantly strengthen SOW classification under all five UK-law tests.

MSA / SOW Contract Architecture

A properly structured Master Services Agreement with SOW schedules, including acceptance criteria, change order process, IP assignment, and indemnification, is the legal bedrock of every compliant engagement.

Specialise, Don’t Generalise

SOW credibility comes from deep sectoral or functional expertise. Pursuing SOW across every discipline your temp desk serves will produce reclassification risk across all of them. Pick your lane first.

⚠

The single most common SOW compliance failure: Using agency temporary workers, from your own or a sub-contracted agency, as SOW “consultants.” This layered staffing arrangement is immediately identifiable by regulators and auditors, creates IR35 and AWR liability for your end-hirer, and destroys the commercial rationale for the SOW arrangement entirely.

Ready to build your SOW capability compliantly?

OPRaaS works with agencies at every stage, from initial commercial strategy through contract architecture, workforce classification, and client-facing audit support. Start with a compliant foundation.

Talk to OPRaaS Our Agency Services →

OPRaaS SOW Services

Expert SOW compliance support for both sides of the relationship.

OPRaaS brings the same rigour to SOW governance that we apply across the UK labour supply chain. Our services are practical, audit-ready, and built around the real commercial pressures your organisation faces.

For End-Hirers

SOW Programme Audit

Six-domain audit across your SOW population: Visibility, Classification, Contract Integrity, On/Off-boarding Controls, Layered Staffing Risk, and Financial Governance. Output: RAG-rated SOW Compliance Scorecard.

Misclassification Review

Engagement-level review applying CEST-aligned IR35 status tests, AWR analysis, and CCWP classification determinants. Identifies disguised staff augmentation and produces defensible reclassification recommendations.

Contract & Governance Review

12-element SOW document review, MSA architecture assessment, acceptance criteria analysis, change order protocol, and IP ownership verification, benchmarked against UK best practice.

SOW Policy Development

Development of SOW Classification Policy, Decision Tree, MSA and SOW templates, on/off-boarding checklists, and QECR Supplier Scorecard, the governance infrastructure for ongoing compliance.

Supplier Due Diligence

Workforce composition analysis, layered staffing detection, financial health checks, and rate benchmarking across your SOW supplier panel, with QECR assessments per provider.

Ongoing Assurance Retainer

Continuous SOW compliance monitoring: periodic classification reviews, contract renewal sign-off, change order audit, and annual programme maturity assessment.

For Agencies

SOW Commercial Strategy

Business case development, sector specialisation strategy, margin modelling, and competitive positioning for agencies planning an SOW capability, built on the commercial realities of the UK market.

Compliance Architecture Design

Structural separation framework, legal entity design, branded MSA and SOW template development, change order protocols, and IP/indemnification clause review: the contractual foundation for a compliant SOW business.

Workforce Classification Training

Bespoke training for BD, account management, and delivery teams covering IR35, AWR, the staff augmentation trap, and the four classification determinants: turning compliance knowledge into commercial discipline.

Client-Facing Audit Support

OPRaaS supports agencies in positioning SOW compliance as a client value-add, providing audit methodology and classification evidence that gives end-hirers confidence in your engagements.

SOW Programme Review

For established SOW providers: a structured review of existing engagements against classification, contract, and risk criteria, identifying vulnerabilities before regulators or clients do.

Tender & Presentation Support

Practical support presenting your SOW compliance credentials to prospective clients, helping you win SOW business on the strength of your governance capability, not just your rates.

How We Work

A structured engagement. No ambiguity.

Discovery & Scoping

We agree scope, access requirements, and the specific compliance questions you need answered. For audit engagements, we extract data from ERP, VMS, and HR systems to build your complete SOW population register with a 24-month look-back.

Deep Dive Assessment

Domain-by-domain audit applying the OPRaaS QECR framework, UK status tests, and contract review methodology. Stakeholder interviews across procurement, legal, HR, IT security, and engagement managers.

Findings & Recommendations

RAG-rated findings per domain, consolidated SOW Compliance Scorecard, and a prioritised remediation roadmap with clear ownership and timelines. Policy templates and governance documentation where required.

Implementation & Ongoing Assurance

OPRaaS supports implementation, not just recommendations. Retainer options available for ongoing monitoring, classification reviews, and annual programme maturity assessment.

Start your SOW compliance conversation today.

Whether you’re an end-hirer with an ungoverned SOW population or an agency building a compliant SOW practice, OPRaaS brings the expertise, methodology, and UK-specific knowledge to make it work.

Contact OPRaaS Explore LSCA Training

Acronym	Full Term	Definition
CFA 2017	Criminal Finances Act 2017	UK legislation introducing Corporate Criminal Offence (sections 45/46): failure to prevent the facilitation of tax evasion. Requires businesses to implement 'reasonable prevention procedures' (RPP). The only defence is having adequate RPP or showing it was not reasonable to expect such procedures.
MSA 2015	Modern Slavery Act 2015	UK legislation mandating supply chain transparency and worker safeguarding. Section 54 requires commercial organisations with ≥£36m turnover to publish annual modern slavery statements (board-approved, signed by director, published on website with prominent homepage link).
IR35	Off-Payroll Working Rules	Tax legislation determining whether a contractor should be treated as employed or self-employed for tax purposes. Since April 2021, medium and large private sector clients must determine contractor status and deduct employment taxes if inside IR35. Requires Status Determination Statement (SDS).
JSL	Joint & Several Liability	2026 legislation imposing strict liability on agencies and end-hirers for umbrella company tax debts, even where due diligence checks have been undertaken. Makes supply chain participants jointly responsible for unpaid PAYE taxes.
AWR	Agency Workers Regulations 2010	UK regulations giving agency workers the right to the same basic working and employment conditions as permanent employees after 12 weeks in a qualifying assignment (12-week parity rule).
Good Work Plan	Good Work Plan 2020	UK employment law reforms requiring written 'section 1 statement' of employment particulars to be given to employees and workers on or before day 1 of engagement (effective 6 April 2020). Sets out key terms but is not itself the contract.
Construction Act	Housing Grants, Construction and Regeneration Act 1996	UK legislation governing payment practices in construction contracts. Section 113 renders "pay when paid" clauses ineffective (except where upstream payer is insolvent). Requires clear due dates, final dates for payment, and compliant payment/pay less notices.
Pensions Act 2008	Pensions Act 2008	UK legislation establishing workplace pension auto-enrolment requirements. Employers must automatically enrol eligible workers into qualifying pension schemes and make minimum contributions.

Acronym	Full Term	Definition
HMRC	HM Revenue & Customs	UK government department responsible for tax collection, payment of tax credits and benefits, and enforcement of tax law. Operates PAYE, CIS, RTI systems and conducts compliance audits. Business Tax Account provides reconciliation data.
GLAA	Gangmasters and Labour Abuse Authority	UK government body regulating labour providers in certain sectors (agriculture, horticulture, shellfish gathering, food processing/packaging) and investigating worker exploitation. Operates licensing regime and has criminal investigation powers. Hotline: 0800 432 0804 (03000 718234 out of hours).
ICO	Information Commissioner's Office	UK independent authority upholding information rights. Enforces UK GDPR and Data Protection Act 2018. Personal data breaches must be reported to ICO within 72 hours where there's risk to individuals' rights. Provides guidance on lawful bases, DSARs, and data-sharing.
CITB	Construction Industry Training Board	Industry body that collects levy from construction employers (payroll ≥£80k in PAYE in last tax year, or ≥£80k net CIS payments) and provides training grants. CITB levy compliance is audited in construction-focused compliance audits.

Acronym	Full Term	Definition
PAYE	Pay As You Earn	HMRC's system for collecting Income Tax and National Insurance Contributions from employees' wages. Employers deduct tax before paying employees, then remit to HMRC. Operates under Real Time Information (RTI) reporting requirements.
CIS	Construction Industry Scheme	Tax deduction scheme for payments to subcontractors in construction industry. Contractors must verify subcontractors with HMRC before first payment and make deductions (20% for verified, 30% for unverified) on labour element only (excluding VAT and allowable materials). CIS300 returns due by 19th following tax month.
GPS	Gross Payment Status	CIS status allowing subcontractors to be paid without deductions. Must apply to HMRC and meet compliance tests (business test, turnover test, compliance test). Contractors must verify GPS and keep evidence; continue to file CIS300 but make no deduction.
CIS300	CIS Monthly Return	HMRC return submitted by contractors detailing total payments made to each subcontractor and CIS tax deductions applied. Must be filed by the 19th following the tax month (6th–5th). Should reconcile to subcontractor statements and bank payments.
CIS340	CIS340 Guidance	HMRC's official guidance document defining what constitutes 'construction operations' for CIS purposes. Only work qualifying under CIS340 can legitimately be paid through the Construction Industry Scheme. Includes site preparation, construction, alteration, repairs, demolition.
RTI	Real Time Information	HMRC system requiring employers to report PAYE information at or before each pay run. Consists of Full Payment Submission (FPS) for regular pay data and Employer Payment Summary (EPS) for adjustments/recoveries. Must reconcile to payslips and Business Tax Account.
FPS	Full Payment Submission	RTI submission reporting gross taxable pay, Income Tax, and NICs for each employee on each payday. FPS values must match payslips. Should not be used to mask under-deductions.
EPS	Employer Payment Summary	RTI submission used only for adjustments, such as recoveries, statutory payments, employment allowance claims, or apprenticeship levy. Should not be used to mask PAYE under-deductions.
Bacs	Bankers' Automated Clearing Services	UK electronic payment system used for direct debits and credits, including salary payments. Net pay on payslip must match Bacs transfer to worker's bank account. Never use "BACS" (incorrect).
UTR	Unique Taxpayer Reference	10-digit number issued by HMRC to identify individuals and businesses for tax purposes. Required for CIS verification and self-assessment tax returns. Note: UTR alone isn't proof of CIS verification; contractor must verify with HMRC before first payment.
NIC / NICs	National Insurance Contributions	UK social security tax paid by employees (via PAYE), employers (as on-costs), and the self-employed (Class 2/4 via self-assessment). Funds state benefits including state pension, statutory sick pay, and maternity allowance. CIS deductions are payments on account of Income Tax and Class 4 NICs.
NMW	National Minimum Wage	Legal minimum hourly rate employers must pay workers in the UK. Rates vary by age band. Post-deduction pay (after deductions for employer's own use/benefit) must not fall below NMW. Records must be kept for 6 years.
NLW	National Living Wage	Higher rate of National Minimum Wage for workers aged 21 and over. Often referred to together as "NMW/NLW". Different from voluntary Real Living Wage calculated by Living Wage Foundation.
AE	Auto-Enrolment (Pensions)	Workplace pension scheme where employers must automatically enrol eligible workers (aged 22+ to state pension age, earning ≥£10k annually) into a qualifying pension. Minimum contributions, opt-out rights, and re-enrolment (every 3 years) required.
P45	P45 (Leaving Employment)	HMRC form given to employees when they leave employment, showing pay and tax details for the year to date. New employer uses P45 to operate correct tax code. Emergency codes (e.g., 1257L W1/M1) apply without P45/P6.

Acronym	Full Term	Definition
DRC	Domestic Reverse Charge (VAT)	VAT mechanism for construction services where the customer accounts for VAT instead of the supplier. Applies to most construction services under CIS340. Designed to combat missing trader fraud in construction supply chains.
Kittel	Kittel Principle	EU/UK legal principle that a taxpayer who knew or should have known their transaction was connected to VAT fraud may be denied the right to deduct input VAT. Creates due diligence obligations for supply chain participants.
DR	Disguised Remuneration	Tax avoidance arrangements designed to pay individuals while avoiding income tax and NICs, often involving loans, offshore entities, or trusts. HMRC actively targets such schemes. Loan charge applies to outstanding loans.

Acronym	Full Term	Definition
SDC	Supervision, Direction or Control	Key factor in determining employment status under agency rules (ITEPA 2003 s44). If a worker is under supervision, direction or control by any person (client, agency, end-hirer) over how they work, PAYE must be operated. SDC alone is not the general CIS status test—apply usual status tests (control, substitution, mutuality).
MOO	Mutuality of Obligation	Employment status indicator examining whether the employer is obliged to provide work and the worker is obliged to accept it. Absence of MOO suggests self-employment; presence suggests employment.
SDS	Status Determination Statement	Document required under IR35 reforms (April 2021) where medium/large clients must provide written reasons for their determination of a contractor's employment status for tax purposes. Must be given before contract starts or worker begins work.
CEST	Check Employment Status for Tax	HMRC's online tool for determining whether a worker should be classified as employed or self-employed for tax purposes. Results are binding on HMRC if information provided is accurate and not relating to highly complex arrangements.
PSC	Personal Service Company	Limited company through which a contractor provides their services. Often used by contractors working outside IR35, but subject to IR35 rules if the underlying relationship is one of employment. Requires SDS from medium/large clients.
KID	Key Information Document	Plain-English factsheet (not a contract) that agencies must give to workers before they agree to an assignment (Conduct of Employment Agencies and Employment Businesses Regulations 2003). Includes worked pay illustration, deductions, who pays the worker, benefits. Must be updated within 5 working days of any change.
ITEPA 2003	Income Tax (Earnings and Pensions) Act 2003	UK tax legislation governing employment income. Section 44 contains agency rules requiring PAYE where worker is under SDC. Section 61N–61R cover off-payroll working (IR35) for public sector and (from 2021) medium/large private sector.
DBS	Disclosure and Barring Service	UK government service providing criminal record checks for employment purposes (particularly roles working with children or vulnerable adults). Processing DBS data requires DPA 2018 Schedule 1 condition and appropriate policy document.

Acronym	Full Term	Definition
UK GDPR	UK General Data Protection Regulation	UK data protection law (retained EU law post-Brexit) governing processing of personal data. Requires lawful basis (Art 6), data minimisation, security, transparency (Arts 13-14), and respect for data subject rights. Works alongside Data Protection Act 2018.
DPA 2018	Data Protection Act 2018	UK legislation supplementing UK GDPR. Schedule 1 sets conditions for processing special category data (health, biometric, union membership) and criminal offence data (e.g., DBS checks). Provides exemptions (crime prevention, tax collection, legal professional privilege).
DSAR	Data Subject Access Request	Individual's right under Art 15 UK GDPR to obtain copy of their personal data. Must respond within one month (extendable by 2 months for complex requests). Usually no fee. Must verify identity proportionately.
DPO	Data Protection Officer	Required role for public authorities or organisations conducting large-scale systematic monitoring or processing special category data (Art 37). Oversees data protection compliance, advises on DPIAs, and acts as contact point for ICO and data subjects.
LIA	Legitimate Interests Assessment	Assessment required when relying on legitimate interests (Art 6(1)(f)) as lawful basis. Three-part test: identify legitimate interest → demonstrate necessity → balancing test (interests vs individual rights). Appropriate for audit/assurance; avoid consent for audits.
DPIA	Data Protection Impact Assessment	Required assessment where processing is likely to result in high risk to individuals (Art 35). Must complete for large-scale, systematic monitoring or extensive special category data processing. Documents risks, mitigation measures, and necessity/proportionality.
RoPA	Records of Processing Activities	GDPR requirement (Art 30) documenting all personal data processing activities. Must include purposes, lawful bases, data categories, recipients, retention periods, security measures, and international transfers. Must be available to ICO on request.
IDTA	International Data Transfer Agreement	UK mechanism for lawfully transferring personal data outside the UK (replacing EU Standard Contractual Clauses post-Brexit). Required unless recipient country has adequacy decision or other derogation applies. Alternative: UK Addendum to EU SCCs.
SCCs	Standard Contractual Clauses	EU Commission-approved contract templates for international data transfers. For UK data exports, use UK Addendum to EU SCCs or UK IDTA.
Art 28 DPA	Article 28 Data Processing Agreement	Mandatory contract between controller and processor (Art 28 UK GDPR). Must cover: subject matter, duration, data types, processing instructions, confidentiality, security, sub-processors, data subject rights assistance, breach notification, data deletion/return, audit rights.
Art 26	Article 26 (Joint Controllers)	UK GDPR provision for parties who jointly determine purposes and means of processing. Requires arrangement setting out respective responsibilities, data subject rights, and contact points. Different from controller-processor (Art 28) or controller-controller data-sharing.
Controller	Data Controller	Organisation that determines the purposes and means of processing personal data. Bears primary GDPR obligations. Agencies, umbrellas, and end-hirers usually act as independent controllers for their own audit/compliance purposes.

Acronym	Full Term	Definition
Instance	Audit Form Instance	Individual audit submission. Users can create unlimited instances, each stored as WordPress custom post type with responses in wp_opraas_audit_responses table. Assigned to logged-in user via post_author field.
Completion	Completion Score	Frontend metric showing percentage of questions answered (any answer counts). Includes ALL sections: Section 1 checkbox, Section 2 (8 fields), Declaration (7 fields), and all audit questions. N/A responses count as answered.
Compliance	Compliance Score	Backend metric measuring quality of compliance. Scoring: Yes=5 points, No=0 points, N/A=0 points (excluded from maximum), Don't Know=1 point. EXCLUDES Sections 1, 2, and Declaration entirely. ≥80% = Compliant, 60-79% = Partially Compliant, <60% = Non-Compliant.
Evidence	Evidence Files	Supporting documents uploaded to substantiate audit responses. Stored in AWS S3 via WP Offload Media plugin, with Evidence Table providing S3-aware ZIP downloads that temporarily download from cloud before adding to archives.
Red Flags	Red Flags	Warning indicators in audit questions identifying practices that may indicate non-compliance, fraud risk (phoenixism, MUCs, disguised remuneration), or regulatory breaches requiring immediate attention and remediation.