A labour supply chain audit is the exercise of establishing, with evidence rather than assumption, every entity that touches a worker between your client's site and the worker's bank account. Since April 2026 it has stopped being good practice and become the control that determines whether you inherit somebody else's PAYE liability, and from October 2026 whether you inherit their immigration exposure too.
Most agencies have never done one properly. The ones that have are usually surprised by what they find.
Why the Audit Became Unavoidable
Three changes landed inside twelve months, and they share an assumption: the organisation controlling the chain can see into it.
- 6 April 2026. New Chapter 11 ITEPA 2003 rules move responsibility for PAYE on umbrella company workers to the agency closest to the end client, or to the client where no UK agency exists.
- 7 April 2026. The Fair Work Agency was established with powers to inspect employers, require documents, issue penalties and prosecute.
- 1 October 2026. Section 48 of the Border Security, Asylum and Immigration Act 2025 extends right to work obligations to workers under a worker's contract and individual sub-contractors, with liability running up contractual chains.
An agency that cannot map its chain is exposed on three fronts simultaneously, and cannot demonstrate diligence on any of them.
Step One: Build the Map From Payments, Not Policy
Start with the ledger rather than the preferred supplier list. Extract every entity you have paid in connection with worker supply over the last twenty-four months. Then extract every entity your clients have paid where you sit in the chain, to the extent you can see it.
The gap between the payment data and the approved list is the finding. It is almost never zero. Typical causes are a worker requesting a particular umbrella, a branch operating its own arrangement, a provider rebranding, or a consultant accommodating a client's incumbent supplier without telling anyone.
Capture These Fields for Every Entity
Legal name and company number. Registered address and whether it is a UK establishment. VAT registration. Employer PAYE reference. Directors and any persons with significant control. Date of incorporation. Whether the entity is connected to you, to the client, or to any other entity in the chain.
Recently incorporated entities with a single director and a high worker count deserve attention. So do entities sharing a registered address with several other payroll businesses.
Step Two: Establish the Contractual Shape
A payment map shows who received money. It does not show who owes what to whom. For each assignment type, write down the actual chain of contracts: client to first agency, first agency to second agency, agency to umbrella, umbrella to worker.
Look specifically for three things.
Undisclosed Sub-Contracting
Whether any supplier is permitted to pass supply onward, and whether any has done so. An unknown second tier is where chain liability materialises, because you cannot audit a party you do not know exists.
Silence on Responsibility
Whether the contracts state who performs right to work checks, who operates PAYE, and to what standard. Silence will be resolved against whoever is most solvent.
Absent Evidence Rights
Whether you can compel production of underlying records within a defined period. A right to be told a check happened is not a right to see it.
Step Three: Test the Money
This is the step that finds actual non-compliance, and it is arithmetic rather than judgement. For a sample of workers, reconcile what you paid the intermediary against what the worker received and what was reported to HMRC.
Request real-time information submissions, payslips and a rate breakdown. Then check whether the assignment rate, less the stated margin, less employer National Insurance and pension, can actually produce the worker's net pay. If it cannot, the difference is being created somewhere, and the usual method is characterising part of pay as something other than earnings.
HMRC's guidance on umbrella companies operating avoidance schemes describes the pattern directly: PAYE is operated on part of the amount paid, and the remainder is treated as non-taxable. Loans, advances, annuities, grants, and generous expense or allowance structures are the recurring labels. A net pay figure that looks unusually good for the worker is the clearest signal available.
Step Four: Test the Compliance Records
Sample right to work evidence for the engagement types now in scope, not just for your own PAYE employees. For each sampled engagement, establish whether a prescribed check was completed before work began, whether the correct route was used, and whether the evidence can be retrieved today.
The frequent failure is retrieval. A check that was performed competently in 2024 but lives on a departed consultant's drive provides no statutory excuse in 2026. Test retrieval as a separate question from whether the check happened.
Check follow-up dates for time-limited permission as well. Expiry management is the most common single point of failure at volume, and it fails silently.
Step Five: Reduce the Surface Area
Audits produce findings. Findings need decisions, and there are only a few available.
- Remove providers who cannot or will not supply reconciliation data. Refusal is itself the finding.
- Consolidate to a short, contractually enforced preferred supplier list, with onward sub-contracting prohibited without consent.
- Model direct PAYE engagement for your highest-volume assignment types, which removes the umbrella category of risk entirely.
- Reprice assignments that now carry tax and immigration risk you were not previously pricing for.
- Fix the contracts, allocating the check and the payroll obligation explicitly with evidence rights attached.
Step Six: Make It Repeatable
A one-off audit ages badly. Providers change ownership, branches make local arrangements, and clients introduce incumbents. Set a cadence: quarterly payment-to-approved-list reconciliation, annual full diligence refresh on each provider, continuous monitoring of expiry dates, and a documented onboarding gate for any new intermediary.
Record the dates and the outcomes. Where liability is disputed, contemporaneous evidence of diligence is worth considerably more than a policy document nobody followed.
Frequently Asked Questions
How Far Back Should an Audit Go?
Twenty-four months is a practical starting point for payment mapping because it covers the repeat-breach window for illegal working penalties and captures provider churn. Where a scheme is suspected, the relevant period may be longer and should be scoped with advice.
What If a Provider Refuses to Give Us Data?
Treat refusal as a finding rather than an inconvenience. A compliant payroll business can produce reconciliation evidence without difficulty. Reluctance correlates strongly with the arrangements you are trying to detect.
Can We Rely on an Accreditation or Kitemark?
Accreditations are a useful filter and not a defence. They do not transfer statutory liability and they do not evidence what happened on your specific assignments. Use them to narrow the field, then verify.
Does the End Client Have to Do This Too?
Clients carry responsibility where there is no UK agency in the chain, or where the agency is offshore or connected to the umbrella, and they can be exposed on the immigration side through chain liability. Sophisticated clients have already started auditing their agencies, and evidence is becoming a commercial asset.
Who Should Own This Internally?
It needs a named owner with authority to remove suppliers. Audits that report into compliance without commercial authority tend to produce findings that are noted and not acted on.
What Good Looks Like
An agency in reasonable shape can answer five questions from records, within a day, without calling anyone: every entity in our chains, the contractual basis of each engagement type, who performs the right to work check and where the evidence sits, a reconciliation showing worker pay matches what was reported, and the date of our last diligence refresh on each provider.
Very few agencies can do that today. The ones that can will find that the same file answers an HMRC enquiry, a Fair Work Agency inspection, a Home Office visit and a client audit. That is the return on the work.
This article is general information, not tax or legal advice. Take specialist advice on your own supply chains, contracts and historic arrangements.
Sources
HMRC. PAYE Rules for Labour Supply Chains That Include Umbrella Companies From 6 April 2026.
https://www.gov.uk/guidance/paye-rules-for-labour-supply-chains-that-include-umbrella-companies-from-6-april-2026
HMRC. Employment Status Manual ESM2405: Umbrella Companies Legislation, Chapter 11 ITEPA 2003.
https://www.gov.uk/hmrc-internal-manuals/employment-status-manual/esm2405
HMRC. Responsibilities for Employment Businesses Working With Umbrella Companies.
https://www.gov.uk/guidance/responsibilities-for-employment-businesses-working-with-umbrella-companies
Fair Work Agency. About the Fair Work Agency.
https://www.gov.uk/government/organisations/fair-work-agency/about
Fair Work Agency. Fair Work Agency: Enforcement Policy Statement.
https://www.gov.uk/government/publications/fair-work-agency-enforcement-policy-statement/fair-work-agency-enforcement-statement
The Stationery Office. Border Security, Asylum and Immigration Act 2025, Section 48.
https://www.legislation.gov.uk/ukpga/2025/31/section/48
Home Office. Draft Employer's Guide to Right to Work Checks: 16 July 2026.
https://www.gov.uk/government/publications/right-to-work-checks-employers-guide/draft-employers-guide-to-right-to-work-checks-16-july-2026-accessible
The Stationery Office. The Conduct of Employment Agencies and Employment Businesses Regulations 2003.
https://www.legislation.gov.uk/uksi/2003/3319/contents
InsightCircle
