The compliance review always seems to arrive on a messy Tuesday. There are two fileboxes on the floor, a SharePoint folder nobody trusts, and one hiring manager insisting the passport scan in email is “good enough”. It isn't, and for right to work checks for employers, that gap between decent intentions and defensible process is where the risk sits.
UK employers need more than a photocopy and a hopeful sign-off. They need a check that proves the person can legally do the job offered, completed in line with the Home Office process so the business can rely on a statutory excuse if anything is challenged later. The consequence of getting it wrong is not theoretical, because the maximum civil penalty rose to £60,000 per illegal worker in February 2024 and the regime is applied per worker Home Office employer awareness and compliance guidance.
The practical outcome is simple. A compliant check supports lawful hiring, gives you demonstrable due diligence on every starter, and leaves an audit trail that survives scrutiny from the Home Office, auditors, clients, and partners. A loose process does the opposite, especially where documents are scattered across inboxes, desktop folders, and personal drives. Licensed employers also need to think about sponsor risk, because weak immigration controls can put wider workforce arrangements under pressure.
Table of Contents
- What Right to Work Checks Actually Mean for UK Employers
- The UK Right to Work Policy Timeline You Need to Track
- Running a Compliant Check in Three Auditable Stages
- Evidence Capture and Storage That Withstands an Audit
- Managing Expiries and Repeat Checks Over Time
- Handling Contractors, Agency Workers and Contingent Labour
- Building a Right to Work Habit Inside Your HR Team
What Right to Work Checks Actually Mean for UK Employers
A right to work check is the employer's proof that the person you are hiring is allowed to do the role on the day employment starts, and that you completed the prescribed process before work began. If the check is done correctly, the Home Office says it can give the employer a civil penalty defence even if the worker later turns out to be ineligible Home Office employer awareness and compliance guidance.
What a good check actually proves
A proper check proves you used the right route for the worker. That may be original documents for a manual check, a Home Office share code for an online check, or a certified digital identity route where that applies. It also proves the person in front of you is the same person named on the document or digital result.
It must also leave a record that survives review. A dated copy or note, the name of the checker, and the outcome all need to sit in a place an auditor can reach without chasing emails or desktop folders.
Practical rule: if you cannot show what you checked, when you checked it, and which route you used, you do not have a defensible right to work file.
A passport scan in an inbox does not help if nobody checked it properly, tied it to the start date, or stored it in a system the HR team can trust. The right to work checks employer guide says the employer must confirm documents are genuine, belong to the person presenting them, and permit the work offered. That is why I treat the check as a workflow, not a document chase inside SharePoint, Microsoft 365, or Dynamics 365.
The risk sits in each worker file. For an SME, one weak onboarding record is already a problem, and several point to a process failure rather than an isolated miss. The Home Office employer awareness study found that 80% of employers had heard of at least one penalty for non-compliance, while 59% recalled a fine and 57% recalled criminal conviction with possible imprisonment and an unlimited fine Home Office employer awareness and compliance guidance. Awareness is common, but the discipline to keep evidence tight is where many teams still fall short.
The UK Right to Work Policy Timeline You Need to Track
A right to work check only holds up if the route matches the worker and the rule in force on that date. HR teams get into trouble when they apply last year's process to a hire made under this year's guidance. The government confirmed that legislative changes allowing certified digital identity service providers to support right to work identity checks took effect on 6 April 2022 digital identity certification guidance.
What changed and when
From 1 October 2022, employers could use digital identity checks for British and Irish citizens with valid passports, while manual checks for Biometric Residence Cards, Biometric Residence Permits and Frontier Worker Permits were no longer permitted. That date still matters because it separates current practice from methods that no longer support a compliant file digital identity certification guidance.
The Home Office updated its employer guidance again on 26 June 2025 to reflect current rules and to reinforce that checks must be completed before employment begins, with statutory excuse depending on the prescribed process being followed exactly. For HR teams, that means policy libraries and onboarding templates need version control, not loose “latest guidance” notes.
The biggest operational mistake is letting old practice survive in local habits. One manager may still think a physical BRP can be copied and filed manually, while another team may be using online checks for everyone. Neither approach is safe unless it matches the route allowed for that worker and the current guidance.
The practical question is always the same. Which document set is still authoritative, which online share code route is required, and which legacy evidence should be archived rather than reused for a new hire? If your HR team cannot answer that quickly, the process is too loose.
Running a Compliant Check in Three Auditable Stages
A compliant check is easiest to run when the workflow forces order. In a Microsoft 365 setup, it should sit inside HR operations as a tracked event, with fields, timestamps, reviewer details, and document control, not as a loose task in someone's inbox.
Stage one, verify identity and entitlement
Start with the route that applies to the worker. That may be a manual check against the Home Office acceptable documents list, a Home Office online share code check, or, where permitted, a live digital identity route. The worker must be present for the check, either face to face or by live video under the applicable process check job applicant right to work.
Stage two, capture what was checked
Record the document type, the share code or reference, the date, the checker's name, and the result. If the check raised a question, note that too. The Home Office also expects the employer to confirm the document is genuine, belongs to the person, and allows the work being offered. Where digital identity is used, keep the certification route and supporting evidence together with the record, as set out in digital identity certification guidance.
Stage three, store and index the evidence
Microsoft 365 discipline matters here. The evidence belongs in the worker's HR record, not in a personal mailbox. A portal upload with an immutable timestamp is far safer than an email forward, because email can be deleted, misfiled, or separated from the hiring record. For teams running HubDrive HR, a right-to-work solution for HubDrive HR keeps the check, the evidence, and the expiry data inside one structured environment.
A clean audit trail is less about volume of paperwork and more about whether the record can be reconstructed by someone who wasn't in the room.
The failures are familiar. Photocopies get treated as evidence without the live check, follow-up questions are skipped, and the only record lives in someone's Outlook archive. That works until the first audit, then it falls apart quickly.
Evidence Capture and Storage That Withstands an Audit
Audit-proof evidence starts when the candidate accepts the offer, not when HR gets around to filing a packet. If the record is going to survive scrutiny, it needs a naming convention, a document location, and metadata that tells the story without a long explanation.
How to structure the record
A practical Microsoft approach is a dedicated SharePoint library with folders or metadata keyed to the employee ID, role, and check date. In Dynamics 365, the right to work record should carry the check method, reviewer, date, and outcome so the file can be found from the employee's core record, not only from a document library. That means if someone searches the person's name six months later, the evidence appears in seconds.
When you capture the evidence, keep the route visible. A share code screenshot, a scanned document, or an IDVT reference should be stored with the same record as the dated check outcome. If the document had expiry markings or caveats, note them in plain language so the next reviewer doesn't have to guess.
The main reason I prefer portal upload to email forwarding is simple. A portal forces the checker to complete the form before closure, while email creates a parallel system that no one audits properly. The more copies a file has, the less confidence you have in the one that matters.
What the record should show
- Evidence type: passport scan, share code result, or digital verification reference.
- Check date: the exact day the right to work check was completed.
- Reviewer: the named HR or hiring manager responsible.
- Outcome: passed, follow-up needed, or rejected.
- Location: the system of record, not a desktop folder.
For a Microsoft-centric team, a document centre approach can keep this tidy inside the same governance model as the rest of HR. A useful reference point is the HR document centre approach used by HR Management 365, because the practical challenge is rarely storage capacity, it is consistency.
The audit test is blunt. If a caseworker asked for the file tomorrow, could you show the evidence, the date, and the route without asking three different people to search their inboxes?
Managing Expiries and Repeat Checks Over Time
The first check is the easy part. The risk starts when a visa end date, permission change, or role move turns a clean file into an active compliance task. Teams that treat right to work as an onboarding-only step miss the point where a repeat check becomes necessary.
Building expiry reminders into the workflow
Your HR system should raise reminders before expiry and send them to the right owner automatically. In a Microsoft stack, that can sit behind Dynamics 365 records and Power Automate prompts, so line managers are nudged early and HR can see which cases still need action. A structured alert cadence keeps chasing out of inboxes and places it where it belongs, inside the workflow.
| Right to Work Expiry Alert Cadence | Trigger | Owner | Action |
|---|---|---|---|
| Early alert | Expiry approaching | HR | Review evidence and prepare follow-up |
| Mid-cycle alert | No response yet | Line manager | Chasing and status update |
| Final alert | Deadline close | HR and manager | Escalate and complete repeat check |
If you need a process reference for staff records and supporting evidence, a central personnel file model like the one described at staff administration and digital personnel files keeps the record close to the employee lifecycle rather than buried in a separate folder system.
Who owns the action
HR owns the control. The employee owns providing updated evidence on time. The sponsoring manager or line manager owns escalation when the case blocks work allocation, a promotion, or a transfer. That split sounds obvious until someone assumes the worker's manager has already chased the renewal and nobody has.
Named accountability in practice matters because repeat checks fail at handover points. A renewal can sit with HR, be waiting on the employee, or need a manager to intervene. The file should show which of those states applies, and who last touched it, so the trail survives an audit without guesswork.
Repeat checking also matters when the job changes. A secondment, redeployment, or promotion can move someone into a new arrangement that needs a fresh review of status and entitlement. If the role changed, do not rely on a stale file just because the person is already in the building.
Handling Contractors, Agency Workers and Contingent Labour
Direct hires are usually the easy part. Contingent labour, agency supply, umbrella companies, and layered contracting chains are where accountability gets blurred, and that is where right to work failures tend to surface.
A typical case starts with a senior contractor brought in through an agency. The agency says the worker is compliant, the onboarding pack looks complete, and the project begins. Later, the contractor's visa turns out to be invalid, and the client learns that supplier assurance is not the same thing as holding a defensible right to work record for its own arrangement.
The June 2025 guidance, together with the further update anticipated from 1 October 2026, shows the regime broadening beyond the simplest employee model updated employer guidance PDF. Specialist commentary also notes that responsibility still sits with the employer that has the direct contractual relationship, but many organisations still struggle to establish who must do the check where agencies or layered contracting chains sit between the client and the worker freemovement October 2026 analysis.
The safer approach is to ask for more than a supplier assurance pack. The end client should require evidence of the actual check route used, the date it was completed, and the result that was recorded. If the worker sits in a vendor record in Dynamics 365, that record should hold the same evidence links and review status as a direct hire file.
Practical rule: if the client cannot see the underlying check trail, it is relying on trust, not control.
That is why I would not leave contingent labour in a separate spreadsheet owned by procurement. The record belongs in a governed vendor or contractor file, with the evidence attached and expiry reminders set up just like permanent staff. The legal risk does not disappear because the pay packet comes from a different entity.
Building a Right to Work Habit Inside Your HR Team
Good compliance is boring in the right way. The team knows who checks what, the system shows what is missing, and the audit lead can sample files without a scavenger hunt. That habit only sticks when controls sit inside weekly work, not in a policy PDF nobody opens.
The operating rhythm
A weekly exception report should land in the HR stand-up so incomplete files are visible early. A monthly expiring-documents dashboard should go to line managers, because they are the people most likely to know when someone is changing role or leaving on leave. A quarterly spot-check of stored evidence against retention labels keeps SharePoint honest, and an annual policy refresh keeps your templates aligned to the latest Home Office position.
Defined accountability roles
- RTW owner: runs the day-to-day process and chases missing files.
- HRIS steward: configures expiry triggers in Dynamics 365 Human Resources.
- Audit lead: samples records before a Home Office visit or internal review.
- Line manager: confirms working arrangements and escalates missing evidence.
If your onboarding uses Power Automate, add a short checklist that blocks ticket closure until the passport, visa, or share code evidence is attached. That control prevents the most common problem I see, the hire being marked complete while the file is still half-finished.
Training matters too, but it has to be scenario-led. Managers need to explain why a manual document check was lawful on the date it happened, or why the online share code route was the correct route for that worker. If they can only repeat the policy title, they do not yet understand the risk.
The same discipline should cover contractors and agency staff. If the worker sits in a vendor record, the record needs the check trail, the review status, and the evidence links in one governed place. That is the version that survives an audit, because it shows who checked, what was checked, and when the evidence was stored.
If you want right to work checks for employers to live inside one governed Microsoft environment, HR Management 365 centralises evidence, expiry tracking, reminders, and audit history in the same place your HR team already works. Visit HR Management 365 to see how a compliant workflow can sit inside Microsoft 365 and Dynamics 365 without adding another disconnected system.
