Would your external workforce arrangements stand up to scrutiny?

It’s something I’ve heard plenty of times over the years, and of course it may be absolutely true. But not having had an issue isn’t necessarily the same thing as knowing that your external workforce arrangements would stand up to scrutiny if someone started asking questions.

For me, that’s what audit readiness is really about.

It isn’t about assuming that HMRC is going to turn up tomorrow, and it certainly isn’t about creating unnecessary panic around IR35. It’s about understanding whether you can explain how your organisation engages its external workforce, demonstrate how decisions have been made and produce the evidence that supports them.

Because in my experience, the problems are rarely as obvious as somebody simply ignoring the rules. They tend to sit in the gaps between the engagement the organisation thinks it has, what the paperwork says and what is actually happening in practice.

When the paperwork starts to look better than the engagement

One situation we see reasonably often is an independent contractor operating through their own Personal Service Company (PSC), where the relationship has existed for some time and the contractor starts to reshape their proposal so that it looks more like a professional services arrangement.

That isn’t inherently a problem. There are plenty of genuine consultancy and services arrangements operating through limited companies.

But you still need to look underneath the terminology.

If the individual continues to charge a day rate, the client largely determines what work needs to be done, there isn’t a clearly defined business outcome that the supplier is responsible for delivering, and the supplier isn’t taking meaningful responsibility for delivery quality or defects, you have to ask what has actually changed.

Are you genuinely buying a service, or have you simply changed the way you are describing the contractor?

It is an important distinction, because changing the language in a contract doesn’t necessarily change the substance of the engagement.

A Statement of Work doesn’t automatically mean you’re buying an outcome

We see a similar issue with Statements of Work.

A business needs additional capability, perhaps in site management, project management, systems integration or another specialist area. Rather than bringing in another contractor, the requirement is packaged into a Statement of Work.

Again, there is nothing inherently wrong with that. The question is what sits underneath it.

If the individual is effectively providing additional capacity to the client’s operation, the client continues to determine priorities, the work is charged on a time basis and the client retains responsibility for the overall outcome, it becomes harder to see where the supplier-owned service really is.

A genuine outcome-led arrangement should mean something. There should be clarity around what is being delivered, where responsibility for that delivery sits and what happens if the expected outcome isn’t achieved.

Simply putting a requirement into an SOW doesn’t automatically create those conditions.

That’s why one of the questions I often come back to is a very simple one:

What are you actually buying?

Sometimes the answer is genuinely a service or defined outcome. Sometimes it is specialist capacity that would be better recognised and governed as such.

Neither answer is automatically wrong. The important thing is knowing which one you have.

The engagement you assessed may not be the engagement you have today

There is another complication that I think gets overlooked.

Perhaps the original engagement was assessed properly. The contract reflected the intended arrangement, the appropriate checks were completed and there was a perfectly reasonable basis for the decision made at the time.

Then the work starts.

Twelve months later, the scope has expanded. The contractor is working with different managers. The business has started directing activities that weren’t originally envisaged. The individual has become more integrated into the organisation or has started taking on responsibilities that weren’t part of the original engagement.

Nobody necessarily sat down and decided to change the nature of the relationship.

It just evolved.

That’s why ongoing assurance matters. An assessment made at the start of an engagement only tells you so much if nobody ever comes back to look at whether the working practices still reflect it.

Could you evidence the story?

This is where audit readiness starts to become much bigger than reviewing individual contracts.

If somebody began scrutinising your external workforce arrangements, how easily could your organisation answer some fairly fundamental questions?

Could you identify the relevant external workforce population, including individuals who might be sitting within supplier or SOW arrangements?

Are your different worker and engagement types clearly defined, and are those definitions applied consistently across HR, Procurement, Finance and the business?

Could you explain how classification and employment-status decisions have been made and produce the evidence supporting them?

Who is accountable for those decisions?

What happens when an engagement changes?

When are determinations reassessed?

How do you know whether the contract and the day-to-day working relationship still reflect each other?

And what happens when somebody disagrees with a decision or when an engagement doesn’t fit neatly into the standard process?

Individually, a questionable contract may be a case to investigate. But if the organisation cannot answer those questions consistently across its external workforce, that can point to something much more systemic.

Start with the organisation, not thousands of individual assessments

This becomes particularly important in larger organisations.

If you have a sizeable external workforce, manually reassessing every individual engagement probably isn’t the most sensible place to start.

Start by understanding whether the organisation has the capability to manage those engagements properly.

Do you know the population?

Are your definitions clear?

Are responsibilities understood?

Are the right controls in place?

Is evidence retained?

Does reassessment actually happen?

Can you identify where risk is concentrated and therefore where deeper investigation is warranted?

Technology can absolutely play a role in supporting classification, assessment, record keeping and ongoing monitoring at scale. But technology doesn’t remove the need for good governance around it.

Sometimes what initially presents as an IR35 or compliance issue is actually a symptom of something broader: unclear ownership, inconsistent engagement routes, poor workforce visibility, weak processes or a disconnect between Procurement, HR, Finance and the parts of the business actually using external workers.

Those are different problems, and they need different solutions.

So, how confident are you that you’re audit-ready?

Being audit-ready doesn’t mean trying to predict every question you might ever be asked. It means being confident that you understand your external workforce, that your decisions have been made consistently and thoughtfully, and that the evidence and controls supporting those decisions actually exist.

That’s the thinking behind RedWizard’s External Workforce Audit Readiness Review.

The review looks at areas including workforce visibility, governance and accountability, classification controls, evidence and record keeping, working-practice assurance and a risk-based sample of actual engagements. The aim is to understand where the material gaps sit and what should happen next.

It isn’t a full-population IR35 assessment, nor is it designed to replace specialist tax or legal advice.

Sometimes the outcome may be a relatively straightforward control or governance fix. In other cases, a deeper assessment of part of the external workforce may be appropriate. And where the issues point to wider weaknesses in the organisation’s external workforce capability, it may make sense to step back and understand those root causes before treating the individual symptoms.

The important thing is knowing where you stand.

Because the best time to find the gap between the contract, the classification and what is actually happening in practice is before you’re having to explain it under external scrutiny.