Compliance checks are generally only as effective as the evidence you can produce that you carried them out. An HMRC inspector, an HSE officer, or a Home Office enforcement team does not accept verbal assurances — they request records. If you cannot produce them, official guidance indicates penalties can be applied at the maximum rate, and any statutory excuse you might otherwise have had may no longer be available.
Not legal or tax advice
This article provides general information only and is not legal or tax advice. Rules depend on the specific facts of your situation. Always confirm your specific obligations with a qualified solicitor or accountant before relying on this guidance.
Why record-keeping is as important as the check itself
Three separate regulatory bodies can request your subcontractor compliance records: HMRC (CIS verification), the HSE (Building Safety Act competence), and the Home Office (Right to Work). Each has different trigger points, different request formats, and different penalty structures — but all three share the same starting point: produce the records.
The general principle across all three regimes is consistent: the burden of demonstrating compliance typically falls on you, not on the regulator. If HMRC believes you should have deducted tax at 20% and you paid at 0%, HMRC's published guidance indicates you would need to produce the verification number that authorised the 0% rate. Having it on file generally supports your position; without it, you may be exposed to liability — the exact outcome depends on the facts of your case and is a matter for HMRC or a qualified adviser.
"I always check" is a statement of process, not evidence of a specific check. An audit does not ask whether you have a checking process — it asks whether you carried out a specific check on a specific subcontractor on a specific date. The only answer is a dated record.
The statutory excuse principle
The concept of a 'statutory excuse' appears in both Right to Work law and CIS-related guidance. In broad terms, official guidance indicates that following the prescribed checking process and retaining the evidence can protect you from the civil penalty, even if it later emerges the worker or subcontractor was non-compliant. Without records, that protection is generally not available — but how this applies to your situation should be confirmed with a qualified adviser.
HMRC CIS — what to keep and for how long
What to retain:
- The CIS verification number for each subcontractor (the reference code HMRC issues when you verify)
- The date verification was carried out
- The deduction status confirmed (Gross 0%, Standard 20%, or Higher 30%)
- Gross payment amounts per subcontractor, per month
- Tax deducted per payment and total paid to HMRC per month
- Each monthly CIS return filed — the actual return data, not just confirmation it was submitted
Retention period: minimum three years from the end of the tax year in which the work was carried out.
What triggers an HMRC CIS audit: a return anomaly (e.g. the deduction amounts don't add up), a referral from a subcontractor or third party, or random selection. HMRC does not need a specific reason.
What happens when HMRC asks: you receive a formal request letter giving you typically four to six weeks to produce the records. If records are incomplete or absent, HMRC proceeds on the assumption that the correct rate was not applied — and assesses accordingly.
Monthly CIS returns are a separate obligation
If you make payments to subcontractors in any given month, HMRC's rules generally require a CIS return for that month, even if all your subcontractors are Gross status and no tax was deducted. HMRC's published penalty schedule for late CIS returns starts at £100 for one month late, rising to £3,000 for twelve months late (confirm current figures on gov.uk, as these can change). Missing returns are one of the most common triggers for a CIS compliance check.
The Finance Act provisions governing the Construction Industry Scheme set out these obligations in full. HMRC's published guidance is available at hmrc.gov.uk/cis.
Right to Work — what to keep and for how long
What to retain:
- A clear copy of the document checked (photo page and any relevant visa pages for a passport; both sides for a Biometric Residence Permit)
- For share codes: a printout or screenshot of the gov.uk right-to-work check result page, including the check date
- The date the check was carried out
- The name of the person who carried out the check
Retention period: for the duration of the engagement, plus two years after the engagement ends.
What triggers a Home Office Right to Work investigation: typically a referral — from the Gangmasters and Labour Abuse Authority, an anonymous complaint, or a police referral following an immigration enforcement action. Investigations are also conducted proactively in industries known to employ undocumented workers.
The statutory excuse: Home Office guidance indicates that carrying out a valid check before the start of employment or engagement, and keeping the copy and date on file, can provide a statutory excuse against a civil penalty, even if the worker later turns out not to have had the right to work. That protection is generally not available if the check happened after work started, or if the copy is missing — confirm how this applies to your situation with a qualified adviser.
The statutory excuse framework is established under the Immigration, Asylum and Nationality Act 2006.
The difference between a valid and invalid copy
The copy must be of the original document — not a photograph sent over WhatsApp or a scanned PDF emailed to you. The Home Office requires that you were physically present when the document was checked (or that the right-to-share digital service was used). A certificate signed by the subcontractor declaring they have the right to work is not a valid check.
Building Safety Act — the golden thread
The Building Safety Act 2022 introduces the concept of the "golden thread" — a complete, up-to-date digital record of information about a building from design through construction into occupation.
During the construction phase, the Principal Contractor — the role a client must appoint in writing where a project involves more than one contractor — is responsible for maintaining the golden thread. This includes the competence evidence for every subcontractor working on site: CSCS card checks, Right to Work documents, insurance confirmations, and trade registrations where applicable.
For Higher-Risk Buildings (HRBs — 18m+ or 7+ storeys, 2+ residential units): the golden thread is a legal requirement. The Building Safety Regulator will audit it at Gateway 3 (the completion gateway). Missing records = no completion certificate. Retention: for the life of the building.
For all other notifiable building work: the competence obligation under the Building Regulations etc. (Amendment) (England) Regulations 2023 applies — maintain and be able to produce the competence records for every person on site. Retention: project duration plus the standard limitation period (typically six years, per the Limitation Act 1980).
What an HSE inspection looks like: HSE Building Safety Inspectors can arrive without advance notice. They can request to see competence records on site, immediately. If the records are on paper in a folder at head office, you may not be able to produce them in time. Digital records accessible from a mobile device are the practical standard.
Not just for high-rises
The Building Safety Act's competence duty applies to all notifiable building work — not just Higher-Risk Buildings. If you're doing a notifiable extension, a loft conversion, or a commercial fit-out, the duty to demonstrate competence (and therefore to maintain competence records) applies to you.
Insurance records
What to retain: the signed Letter of Authority, the subcontractor's email to their insurer requesting confirmation, and the insurer's written reply confirming the policy details.
Retention period: project lifecycle plus six years.
Why six years: the Limitation Act 1980 establishes a six-year limitation period for contractual claims in England and Wales. A claim arising from a subcontractor's work — property damage, personal injury — can be brought up to six years after the project completes. Your insurance verification record is the evidence that you confirmed cover before work started.
What if the insurer only confirms verbally: verbal confirmations should be followed up in writing immediately. An email from you to the insurer confirming what was discussed orally, with a request for written confirmation, creates a timestamped record of the conversation. Do not rely on verbal confirmation alone.
What does an audit actually look like?
HMRC CIS: Formal request letter, four to six week response window. You submit the records electronically or by post. HMRC reviews and may ask follow-up questions. If records are missing, HMRC will raise an assessment for the unpaid tax, plus interest, plus potential penalties. Appeals are possible but require evidence — which you won't have if you don't have the records.
HSE inspection: Can be unannounced on site. Inspector requests records on the spot. If you cannot produce them immediately, they will issue a notice requiring production within a specified period. Continued inability to produce leads to enforcement notices and potential prosecution.
Home Office Right to Work: Usually triggered by an enforcement referral. Letter requests records with a typical four-week response window. Without records, the Home Office's published civil penalty rates can apply (up to £45,000 per worker for a first offence, according to current Home Office guidance — check gov.uk for the current figures).
What "not having records" results in: in all three cases, the absence of records is likely to remove any statutory protection you had and can lead to penalties being applied at or near the maximum, based on published regulator guidance. Generally, the regulator does not need to prove you were dishonest — only that you failed to comply with the checking and record-keeping obligation.
Digital vs paper records
Both are legally accepted. The practical advantage of digital is overwhelming.
Digital records: timestamped, searchable, backed up, shareable instantly on request, accessible from any device. A HMRC inspector's four-week deadline is manageable. An HSE inspector's on-the-spot request is manageable.
Paper records: vulnerable to physical loss (fire, flood, theft), deterioration over the six-year minimum retention period, and the practical difficulty of producing specific records quickly when a regulator requests them under time pressure.
What makes a digital record reliable: a system that timestamps each check at the point it was carried out, stores the evidence file alongside the metadata (who ran the check, when, what the result was), and does not allow records to be edited or deleted after the fact. Immutability matters — a record that can be changed is not reliable evidence.
Subchecked builds your audit trail automatically
Every verification timestamped and immutable. Every document stored alongside the check result. Every project's records available instantly when a regulator asks.
Reminder
This guide is general information, not legal or tax advice. Confirm your specific obligations with a qualified solicitor or accountant.