The October 2026 Right to Work changes affect more than the check completed for a new employee.
Employers may need to review which workers fall within the scheme, where liability sits in contractual chains, which digital services are being used and whether every lawful checking route is handled fairly. The revised rules are due to apply from 1st October 2026.
A structured audit can identify the gaps before revised contracts and training are rolled out.
October 2026 audit checklist
| Arrangement | Likely position under the draft guidance | Evidence to retain |
|---|---|---|
| Workforce scope | Have employees, worker contracts, individual subcontractors, platform workers and permitted substitutes been identified? | Workforce map and engagement categories |
| Out-of-scope arrangements | Can genuine independent businesses and personal service companies be distinguished from workers providing personal service? | Contract review and documented rationale |
| Contractual chains | Could the organisation face extended liability for workers employed by another party? | Supply-chain map and legal review Supplier controls |
| Supplier controls | Do contracts require prescribed checks, control further subcontracting, permit audits and allow action where illegal working is found? | Written contractual terms and audit records |
| Checking routes | Can the team correctly handle manual checks, Home Office online checks, registered-provider checks and ECS referrals? | Procedures, decision guides and test cases |
| Digital provider | Is the exact service registered and approved for Right to Work? | Current register entry and supplier assurance records |
| Employer review | Who confirms that the check relates to the person starting work and that any work restrictions are observed? | Reviewer name, date and completed check output |
| Evidence retention | Are records stored for the duration of employment and two years afterwards, then securely destroyed? | Retention policy and retrievable sample files |
| Time-limited status | Are follow-up dates captured and acted on before the statutory excuse expires? | Alerts, ownership and escalation history |
| Discrimination | Are candidates offered valid alternatives where appropriate and handled consistently across all routes? | Recruitment wording, procedures and training |
| Recruitment agencies | Is responsibility clear where agencies, employment businesses or intermediaries are involved? | Service agreements and responsibility matrix |
| Training | Do HR, recruitment, procurement and hiring managers understand the October changes? | Attendance records and updated materials |
The scope and extended liability questions should come first. Updating the onboarding form will not solve a problem caused by a contract that the HR team has never seen.
The Home Office draft guidance says worker contracts, individual subcontractors and online matching arrangements may fall within the expanded scheme. It also says extended liability can apply in some contractual chains and describes prescribed requirements around written terms, substitution controls and identity verification.
Test the process with real scenarios
A policy may look complete until someone tries to use it.
Select several representative cases and follow each one from offer to completed record. These could include:
- A British citizen using a registered digital provider
- An Irish citizen choosing a manual check
- An eVisa holder using the Home Office online service
- A person requiring an ECS referral
- A temporary worker supplied by an employment business
- An individual subcontractor
- A worker using an authorised substitute
- A supplier’s worker sitting within a longer contractual chain
Record where the process stops, where ownership becomes unclear and where staff need to make an unsupported judgement.
Check the provider output
Where a digital provider is used after October, the service must be registered and authorised for Right to Work.
The audit should also confirm what the employer receives after the check. The employer needs enough information to confirm that the result belongs to the person starting work, understand any restrictions and retain evidence in the prescribed form.
If the provider also helps with eVisas or facial matching, document which parts are completed by the service and which remain the employer’s legal responsibility.
Review the candidate experience
Fair treatment is part of the compliance review.
The October discrimination code says employers cannot treat applicants differently because of the type of check they use, their eVisa status or time-limited permission.
Digital checks may be encouraged but cannot be required in every case, and ECS should be used where applicable.
Look at the actual emails, forms and recruiter instructions candidates receive. They are more likely to reveal barriers than the formal policy.
Finish with clear ownership
Every action found during the audit needs an owner and deadline.
HR may own recruitment guidance and rechecks. Procurement may own supplier terms. Legal may need to assess contractual scope. IT and data protection teams may need to review integrations, access and retention. Senior management should know where residual risk remains before the October date.
Until October, we’re running webinar sessions that work through this checklist and explain the areas employers should prioritise before the revised rules take effect…
