← All insights Immigration

Right to work checks: getting them right

Right to work checking sits in many businesses near the bottom of the onboarding list, somewhere between the bank details and the emergency contact. What a correctly performed check actually does is create a defence for the employer, and that defence is either present when it is tested or it is absent.

The obligation falls on every employer in the United Kingdom. There is no threshold of size, and no exemption for a business that has never knowingly done anything wrong. Employing an adult who does not have permission to work exposes the business to a civil penalty even where nobody suspected a problem, and employing somebody knowing, or having reasonable cause to believe, that they lack permission is a criminal matter of an entirely different order. Penalty levels are set by government and are revised from time to time, so whatever figure a manager is carrying in their head from the last occasion they looked into it may well not be the figure that applies now.

Against that sits a defence, usually called a statutory excuse. Where the prescribed check has been carried out properly, on the correct basis for that person, before the employment begins, and the evidence retained in the required form, the employer is protected from the civil penalty even if the person turns out not to have been entitled to work. The feature that matters is that the excuse is documentary and forward-looking. It is built out of what was done at the time, and it cannot be assembled afterwards out of good intentions.

What follows is where that arrangement surprises employers, and why the businesses that get caught are rarely the ones that were being careless about immigration.

The defence can fail for somebody who was entitled to work

Employers generally assume that the risk being managed is the risk of hiring an illegal worker. That is the mischief the regime exists to address, but the exposure a well-run business actually carries is narrower and stranger than that.

Because the excuse depends on a prescribed check having been performed in a prescribed way at a prescribed point, it can be absent in respect of an employee who held unrestricted permission for the whole of their employment. The employment was lawful throughout. The protection is missing, because the process that would have created it was not followed. Whether a gap of that kind produces a penalty in any given case is a matter for the Home Office and turns on the circumstances, rather than following automatically. The point is that the business has removed its own shelter and will not discover the fact until somebody has a reason to look.

That reframes the exercise. The check does far less work as a test of an individual's honesty than as a record the employer will need to rely on later, in a conversation it did not choose the timing of.

The correct method depends on the person

Status is evidenced in different ways for different people, and the permitted routes are prescribed rather than a matter of preference. Some categories of person are verified through an online service. Others rest on specified documents examined in a specified manner. Certain arrangements allow parts of the exercise to be carried out through a certified provider. Which route is open depends on what the individual actually holds, and the routes are not interchangeable substitutes for one another.

The failure here is a quiet one. A personnel file can contain a scan, a date, a signature and a note confirming that a check was carried out, and carry no excuse whatever, because the route used was not the route available for that person. Nothing about the file looks wrong. Employers find the defect at the only moment when it counts, which is when the file is being examined by somebody with a reason to examine it.

This is also why a page such as this one does not set out the steps. The requirements are detailed, they are revised, and a check performed faithfully against a version of the guidance that has since moved on can leave a business worse off than no system at all, because it produces confidence alongside the gap.

Permission that runs out, and the person who owned the reminder

Where somebody's permission to work is time-limited, the protection the employer holds is time-limited with it. A further check is required while the existing permission still runs, and where that is missed the employer's position moves from protected to exposed without anybody having done anything at all. Timing is doing real work here, and the relevant points are set by the individual's circumstances rather than by the company's calendar.

What fails in practice is ownership rather than any misunderstanding of the law. The original check was carried out by a manager who has since moved on. The reminder lived in a personal calendar, or in somebody's recollection of a conversation at the time of hiring. Recruitment in a growing business is distributed across departments while record keeping is not, so the knowledge sits with whoever happened to be in the room. Nothing visible happens on the day the protection lapses, so nobody notices.

For an employer that also holds a sponsor licence, a lapse of this kind is rarely contained. Right to work compliance forms part of what the licence itself promises, so a defect found in that setting tends to be considered as a question about the organisation as well as a question about one employee.

Checking harder creates a different liability

The instinctive response to all of this is to be more demanding: to ask for extra documents from candidates who seem likely to need permission, to scrutinise people whose names or accents suggest they were born elsewhere, or to decline as a matter of policy to consider anybody who would require sponsorship. Each of those responses trades one exposure for another.

Equality legislation prohibits discrimination on grounds including race and nationality, and it applies at the recruitment stage rather than only once somebody is employed. Applying a more demanding process to some candidates than to others on the basis of assumed nationality is capable of being unlawful in its own right. A complaint of that kind arrives through a different door: it is brought by a person with an incentive to bring it and a forum to bring it in, rather than emerging from an inspection.

The two exposures are reconciled by consistency. The same process, applied to everybody, on the same basis, at the same stage, keeps both risks manageable at once, and it is easier to operate than a process which requires a manager to decide who deserves scrutiny.

Where the files tend to be broken already

The businesses that find a problem are often not the ones that ignored the obligation. They tend to be the ones whose workforce arrived by a route the checking process was never designed around.

• Workforces that transferred in. Where staff move across with a business or with a contract, the new employer inherits people whose original checks it did not perform and cannot vouch for. There is a window in which the position can be put right, and it is frequently spent on payroll integration instead.
• Agency, umbrella and subcontracted labour. The obligation follows whoever is actually the employer, which is not always the party the site manager assumes it is. Contracts commonly record that the supplier will handle checking, and a contractual promise by somebody else does not create the hiring business's own defence.
• Franchised and multi-site operations. Checking is delegated to whoever is on site, in roles that turn over quickly, and the standard drifts between locations without anybody at the centre being able to see it.
• Founder-era hires. The earliest employees of a growing business are taken on before anybody owns human resources, often through personal networks, and are often the ones least likely to have been checked to any standard. They are also the people most likely to still be there when the company is sold, or applies for a licence, or is asked to evidence its compliance by a customer.

Each of these produces the same outcome: a workforce in which the employer's own protection is uneven and undocumented, inside a business whose leadership believes it is compliant because it has a written policy.

What is not worth doing

None of this justifies buying an audit, a platform or a remediation project by reflex, and doing so is an easy way to spend money without improving the position.

A small and stable workforce, recruited directly, all of whom hold unrestricted permission that was evidenced correctly when they joined, presents very little to repair. Money spent establishing that again buys reassurance rather than protection. Software has a similar quality. It can organise the exercise, prompt at the right moments and hold the records tidily, and the excuse still belongs to the employer rather than to the supplier of the tool.

The point that genuinely repays care is what happens if a look through the files turns something up. Discovering a defect changes the employer's own state of knowledge, and knowledge carries legal weight in this area in a way it does not in most compliance work. Looking remains the right instinct. What it argues for is settling the shape and the sequence of any review before it begins rather than midway through. An employer part way through an internal exercise, holding a question it did not expect and no settled view on what follows from it, is in a worse position than one that thought about the order first.

This guide is general information, not legal or immigration advice. Regulated immigration advice is provided with regulated partners. Nothing here is advice until terms are agreed in writing.