Right to Work Audit Checklist: How to Review Your Business After the 1 October 2026 Changes

Expanded right to work rules now cover more working arrangements, making a review essential for businesses using flexible labour. Since 1 October 2026, the checking regime extends beyond employees to certain worker’s contracts, individual sub-contractors and online matching services. Starting civil penalties are £45,000 per illegal worker for a first breach and £60,000 for a repeat breach within three years, although reductions may apply. This checklist covers arrangements and records, while SCC Chartered Accountants can help you understand the potential financial impact.

What has changed

Section 48 of the Border Security, Asylum and Immigration Act 2025 took effect on 1 October 2026 under the Commencement No. 4 Regulations 2026. It expands the right to work scheme to specified working arrangements. The Home Office’s employer’s guide was updated that day to explain the checks and potential liability.

The extension is not retrospective. New direct-liability rules concern engagements starting on or after 1 October 2026; separate transitional provisions affect supply chains. Existing employees remain covered. Businesses should therefore review both new engagements and historic employment records, without assuming all earlier contractors are automatically covered.

Who is now in scope

The table shows the main arrangements. Responsibility depends on the relationship, not merely a self-employed label.

Does my business need to check contractors?

Not necessarily. Genuine independent businesses providing services to clients, including those operating through personal service companies, are generally outside the new direct-checking categories. A worker undertaking personal services for someone who is not their genuine business customer may be within scope. Sub-contracting and supply chains need separate consideration. Seek immigration-law advice where responsibilities are unclear.

The right to work audit checklist

1. Map every way people work for you

List employees, agency-supplied staff, independent contractors, consultants and people using matching platforms. Identify the direct contracting party, engagement start date, onward service commitments and any substitution clauses. Note who actually supplies the labour. These arrangements often fall outside HR.

2. Test records against the statutory excuse

For each person requiring checks, confirm that an approved method was used before work started. For manual checks, inspect acceptable original documents in person or over a live video link while holding the originals, then copy and date the evidence. For eVisa holders, use the Home Office online service. Digital identity checks using a provider must meet the applicable registered-provider requirements. Retain evidence of the result.

3. Check retention periods

Keep right to work evidence securely during engagement and for two years afterwards, then destroy it. Confirm the check date is recorded and access is restricted. Records stored across personal inboxes can easily be lost. Better digital administration helps, and our guide to switching to cloud accounting discusses structured records more broadly.

4. Diarise follow-up checks

Some workers have time-limited permission, so repeat checks must be completed before the statutory excuse expires. Maintain an expiry tracker and check it regularly. Where an individual has an outstanding qualifying immigration application, the Employer Checking Service may provide a Positive Verification Notice. Do not assume an expired document itself establishes continued permission.

5. Review contracts and supply chains

Extended liability may apply to certain subcontracting chains, online matching arrangements and cases permitting substitution. The direct employer usually conducts checks; other parties may also face liability. Prescribed written statements and effective substitution or identity controls may be needed to establish a defence. Review arrangements before services begin, not after concerns arise. Construction businesses should pay close attention, alongside pressures described in our article on construction cost inflation and contractor margins.

6. Check who performs each check

A trained manager or suitable service provider may carry out checks for you, but outsourcing an administrative task does not automatically eliminate your legal responsibility. Record who checks each worker, verify that the prescribed process is followed and periodically sample retained evidence. In complex supply chains, establish each organisation’s distinct obligations.

7. Escalate anything suspicious

If records are missing, inconsistent or potentially forged, stop and seek specialist advice before taking decisions about the worker. Apply checks consistently and avoid discrimination based on nationality or appearance. Where financial records or conduct also require investigation, forensic accountants can help establish what occurred.

Why the financial risk matters

Civil penalties are assessed per illegal worker. The starting amounts are £45,000 for a first breach and £60,000 for a repeat breach within three years; mitigating factors can reduce the final sum. Knowingly engaging an illegal worker, or having reasonable cause to believe they lack permission, can also lead to criminal prosecution. Directors should consider wider governance responsibilities, including the issues discussed in our guide to director duties during insolvency.

Treat credible exposure as a liability. Use a 13-week cash flow forecast to test affordability and monthly management accounts to track staff and contractor spending. If a penalty would endanger continued trading, consult our insolvency practitioners promptly. In suitable cases, a company voluntary arrangement may be considered alongside other options.

Employers on both sides of the border

The UK right to work regime applies in England, Scotland, Wales and Northern Ireland. Employment and immigration-permit requirements in the Republic of Ireland are separate, so businesses operating in both jurisdictions should maintain distinct procedures. Our cross-border accounting and tax team supports businesses with financial reporting on both sides. Our guide to setting up a company in both the UK and Ireland explains wider structural questions. The Home Office’s online right to work tool can also help employers find the relevant checking route.

FAQs

What is a right to work audit?

It is an internal review of who your organisation engages, whether the applicable checks were properly completed before work, whether supporting records are available and when further checks are needed. Supply-chain responsibilities should also be considered.

How long must I keep right to work records?

Keep evidence securely for the employment or relevant engagement and two years afterwards, then destroy it securely in line with applicable guidance.

Do the new rules apply to existing contractors?

The newly extended provisions are not retrospective for arrangements already established before 1 October 2026. Later engagements or changed contractual arrangements may require assessment. Existing employees remain covered by the previous right to work rules.

What is the penalty for failing to check?

Where illegal working creates civil liability, the starting penalty is £45,000 per worker for a first breach and £60,000 for a repeat breach within three years. Mitigation may reduce the amount. Criminal penalties may also apply in knowing cases.

Talk to SCC about your audit

If you need to assess potential financial exposure, organise records or update forecasts, contact SCC Chartered Accountants. For individual immigration issues and contractual responsibilities, obtain specialist legal advice alongside our financial review.