News · Labour Supply Chain Assurance · OPRaaS Platform
Supplier self-certification is still the sensible opening move for any organisation buying temporary labour, and HMRC’s Guidelines for Compliance GfC12, last updated on 26 March 2026, sets out why it cannot be the closing one. The guidance asks buyers to verify the information they gather, particularly where another party supplied it, and to keep records of the steps behind each supply chain decision.
The mechanism behind that advice is not complicated. A declaration captures what a supplier believes about itself on the day somebody signs it, whereas a labour chain moves every pay run as workers join, rates change, subcontractors appear and ownership shifts. Nothing in a signed questionnaire updates itself between one annual review and the next.
What supplier self-certification actually gives an end-hirer buying temporary labour
Supplier self-certification earns its place. It gives end-hirers a structured question set, a named person inside the supplier who has to answer it, and a dated baseline to work from. Procurement teams get answers that compare across a preferred supplier list, and board directors get a starting position rather than a shrug.
What it cannot give is confirmation. A supplier answering its own questionnaire is describing its own controls, and those answers may be accurate, optimistic, or simply out of date by the time they arrive. However carefully the form is written, the party filling it in is the party being assessed.
Where a supplier declaration stops and verifiable evidence begins
A declaration records what a supplier believes. Evidence records what the labour chain actually did.
Payroll makes that distinction concrete. A payslip shows a deduction; it does not show that the deduction ever reached HMRC. Module 4 of the OPRaaS LSCA Self-Certification Course puts the point plainly, asking buyers to obtain evidence that deductions are genuinely remitted rather than merely displayed.
What follows from it has teeth. Section 24 of the Finance Act 2026 inserted Chapter 11 into Part 2 ITEPA 2003, and for payments made on or after 6 April 2026 it extends joint and several liability for unpaid PAYE and National Insurance along the labour chain to the umbrella, the top intermediary and, in defined circumstances, the end-hirer.
This is the umbrella-market joint and several liability regime, distinct from older PAYE debt transfer powers, and a supplier’s own assurance carries no weight under it.
Check, Act and Review, the discipline HMRC expects behind labour supply chain due diligence
HMRC’s published position in GfC12 describes a cycle rather than a single event. That cycle runs from due diligence at the start of a relationship, through risk assessment and risk management, to monitoring and review while the contract is live. Module 4 of the OPRaaS LSCA Self-Certification Course teaches the same discipline through the Check, Act and Review framing that HMRC applies to supplier due diligence.
The OPRaaS reading of that guidance is straightforward. Assurance is a habit, not a file note. Labour supply chain assurance works when the checks repeat on a cycle the buyer controls, and when every repetition leaves a dated record behind it.
What recruitment agencies and umbrella companies gain from being audited rather than asked
Suppliers often hear the word audit as suspicion, which has it the wrong way round. For recruitment agencies and umbrella companies, an independent audit is the only route by which a genuinely good compliance record becomes something a client can act on. On paper, a declaration from a diligent supplier and a declaration from a careless one are indistinguishable.
Verified suppliers compete on evidence. That advantage counts double where a preferred supplier list is being rebuilt, or where a client has started asking the same hard questions of every tier rather than only the first.
Five checks that turn supplier self-certification into an evidence record
Supplier self-certification becomes evidence at the moment somebody independent tests the answers and records the result. Five checks do the heavy lifting.
- Right to work, re-run rather than filed. Status is captured at onboarding and checked again on every pay run, so an expiring permission surfaces in days instead of at the next annual review.
- Payslips reconciled to RTI. Samples are traced from the deduction shown to the worker through to the amount actually remitted, which is where misclassified National Insurance and pension treatment tends to show up.
- Supplier stability watched continuously. Companies House director and ownership changes are monitored alongside Creditsafe credit-risk changes, because a phoenix pattern rarely announces itself in a questionnaire.
- Hours claimed tested against hours worked. Working time and rest records are sampled against shift data, so excessive hours, missing rest breaks and duplicate worker records are visible while the contract is running.
- Exceptions written down. Every finding is logged with the decision taken, the remediation action and the dated outcome, which is the part an inspector, a client or an insurer will ask to see.
Why public sector buyers and multi-academy trusts need the record, not the reassurance
Public sector buyers answer to a different audience. Where public money funds temporary labour, the question at audit is rarely whether the buyer asked its suppliers, but whether it can produce what it did with the answers. Multi-academy trusts sit squarely in that position, buying supply staff at volume through agencies while carrying their own governance obligations.
OPRaaS is an approved supplier on UK Government Commercial Agency (formerly Crown Commercial Service) frameworks, including RM6310 Audit and Assurance Services Lots 2 and 4, RM6219 Learning and Training Services DPS, and RM6237 Learning and Training Services DPS.
The OPRaaS Virtual Compliance Director (OPRaaS VCD) puts senior governance leadership inside end-hirers, recruitment agencies, umbrella companies, MSPs and public sector buyers engaging temps, freelancers, contractors, interims and consultants. The OPRaaS labour supply chain assurance training and audit platform holds the self-certification forms, the audit forms tuned to each party in the chain, and the evidence file the OPRaaS VCD builds from them.
Supplier self-certification asks the question, and the audit is what answers it
Nobody should stop asking suppliers to certify themselves. The form sets the standard, names the obligation and tells a supplier exactly what the relationship requires, and it does that job well. What no form can do is confirm its own answers.
Module 3 of the OPRaaS LSCA Self-Certification Course sets out the operational version of this, covering how often preferred supplier list checks run, who owns them, what each check reviews and what happens when a member fails one. That is the point at which supplier self-certification stops being paperwork and starts producing a record worth keeping.
Compliance is your asset. Evidenced daily.
Read next
“Why labour supply chain due diligence now has to be continuous, not periodic.”
Drawing on HMRC’s Guidelines for Compliance GfC12, “Help with labour supply chain assurance, recommended approach to assurance“, last updated on 26 March 2026; section 24 of the Finance Act 2026 inserting Chapter 11 of Part 2 of ITEPA 2003, in force for payments made on or after 6 April 2026; and the OPRaaS LSCA Self-Certification Course, Modules 3 and 4.
Talk to OPRaaS about your supply chain.
Use the contact form in the sidebar to the right of this article, or email info@opraas.co.uk.
This article is editorial commentary by OPRaaS Limited (On-Pay-Roll-as-a-Service), drawing on published research and government guidance. It is general information, not legal, tax, employment or compliance advice. Obligations vary by organisation and engagement. Speak to a qualified professional before acting on any specific position.