Promotional material

Internal audit process — periodic reviews (part 13)

Updated 15 December 2023

Read Purpose, scope and background (part 1) of these guidelines, if you have not already.

You should read these guidelines alongside existing off-payroll working guidance. They are not designed to be used in isolation, or to create an end-to-end process for organisations to comply with the rules.

Your organisation should apply the guidelines to reflect the complexity and scale of your own off-payroll working engagements. Use these guidelines to help make informed decisions, based on individual circumstances.

Your organisation should carry out regular audits of your systems and processes that are in place to operate the off-payroll working rules. This audit should look at the processes from end to end.

Most organisations subject to the off-payroll working rules will also be within HMRC’s Senior Accounting Officer (SAO) provisions. 

Your organisation should consider how your responsibilities under the off-payroll working rules interact with:

• your systems and processes for complying with the SAO rules
• your SAO reporting requirements

Read the HMRC internal manual on Senior Accounting Officer guidance for more information.

You’ll need to decide how often you conduct these audits, and how detailed they are. When you make this decision, some of the things you’ll need to consider are:

• the size and complexity of your organisational structure
• the number of off-payroll working engagements
• where your organisation sits in the contractual chain

This list is not exhaustive.

For example, a medium-sized, single location organisation engages a small number of workers, who are not employees. This includes workers engaged through their own intermediaries. This means they may have a straightforward, less frequent audit process. 

On the other hand, a medium or large-sized, multi-location organisation will likely:

• have a larger number of workers who are not employees (including workers engaged through their own intermediaries)
• contract with several agencies to supply these workers

Because of this, they may have a more detailed and frequent audit process, as the risk of error is higher.

You’ll need to decide whether an audit is internal, external, or a mixture of both.

What to include in the audit

When auditing your systems and processes for operating the off-payroll working rules, there are different factors to consider, depending on which party you are in the labour supply chain.

As a client

As part of the audit process, you should include:  

• the process for identifying the workers who work through their own intermediaries, that you need to carry out status determinations for
• the flow of information passed through your organisation, to identify any gaps in your processes
• the accuracy of the status determination and any subsequent status determination statements you produce
• decisions on whether managed service contracts include a supply of services, and whether they are fully contracted out
• your disagreement process
• your process to pass on a status determination statement to the worker and the next qualifying person in the labour supply chain

As a deemed employer

As a deemed employer, you should include:

• arrangements for getting status determination statements from clients, or the party above you in the labour supply chain
• the process to calculate the chain, and deemed direct payments
• the flow of information to those responsible for operating PAYE
• the operation of PAYE and requirements for reporting benefits, and subsequent payments

As an agency in the supply chain

If you’re an agency in the labour supply chain, but not the client or the deemed employer, you should include:

• your system for receiving the status determination statements, from the party above you in the labour supply chain
• the system you use to pass the status determination statement to the next qualifying person in the labour supply chain

Periodic reviews

Periodic reviews can help prevent:

• any deficiencies in your systems and processes
• unintentional delays
• overlooked status determination statements
• errors in making determinations

These checks will help to avoid circumstances where an organisation finds itself being the deemed employer, and responsible for operating PAYE.

They will also allow you to identify improvements that you could make. These could lead to more efficient systems and processes, making your organisation less prone to error.

Example 1

This is an example of a PAYE audit process by a client, who is also the deemed employer.

A medium-sized organisation engages several hundred off-payroll workers, who are determined to be inside IR35 (deemed employees). The organisation is the deemed employer, as it contracts directly with the workers’ own intermediaries.

The organisation carries out an annual audit of its systems and processes for operating the off-payroll working rules. It also carries out audits of its PAYE systems and processes, to check that it is complying with its PAYE obligations under the off-payroll working rules. These PAYE audits take place at month 3 and month 9, with a year-end review at month 12 of the tax year. This allows them to make in-year adjustments.

The organisation’s previous PAYE audits led to improvements to its processes. This included:

• a new approach for making sure deputies are suitably trained, and able to step in, during any absence
• an increased number of review points, to check for accuracy

This resulted in a reduction of errors. They corrected any errors they found, as in-year adjustments on the Real Time Information (RTI) system.

As part of its PAYE audit process, the organisation randomly selects a percentage of its off-payroll working engagements that fall inside the rules, for a specific quarter. The audit follow each payment through the relevant process, from beginning to end.

The internal auditors check each stage of the process. They speak to staff involved, to gauge their level of knowledge, and obtain feedback on the process.

The auditors find the organisation’s process is clearly set out. Staff are knowledgeable and know what information they should gather, record and store in the initial stages. The payroll department’s processes and staff knowledge are robust. The sampled chain payments flow through the systems effectively to the payroll department, except for one.

The organisation conducts a review to establish the reasons for the error. The error was made by a staff member whose role is to review the inputs to the system. This involves checking that the status determinations where the off-payroll working rules apply, are recorded correctly. The staff member had to leave work unexpectedly, and did not finalise their checks, or arrange for their deputy to continue the work. This went undetected, and the payment was not correctly identified as ‘off-payroll working rules apply’.

This is immediately identified as a high-risk error, due to the PAYE implications. The organisation conducts a further, more detailed review of the relevant stage where the error occurred, to establish if there are any similar errors. This review identifies one further error, made by the same person on the same day.

The audit recommends introducing an automated check, to flag payments that have not been marked on the system as being checked. The organisation implements this immediately. They quickly upskill their staff on the new process. This addresses the issue that caused the error, by preventing the next stage from happening until this step is taken.

The error is identified within 2 weeks of the mistake being made, and the organisation makes an in-year adjustment to its Real Time Information return.

Example 2

This is an example of a client organisation effectively identifying and resolving issues with its systems, as a result of regular audits.

An organisation became medium-sized for the purposes of the off-payroll working rules in April 2022. It recognised the benefits of carrying out annual audits for its off-payroll working systems and processes, due to the regularity of new off-payroll working engagements.

Its first audit identifies that it had not clearly set out training requirements for any new staff with responsibility for operating the off-payroll working rules. 

The audit also identified that the organisation did not sufficiently check status determinations, to make sure the right decisions were made. This had resulted in several incorrect status determination statements.

They rectified the lack of training for new staff, by designing a structured training pathway. This included links to the relevant training products, and was accessible to all staff. It was rolled out to relevant staff, and managers received additional awareness sessions, so they could support new staff.

The organisation also implemented secondary checks for the status determination process, and increased the level of checks for new staff, until they were competent in their roles.

The initial errors led to an underpayment of tax, National Insurance contributions and Apprenticeship Levy. The organisation made a disclosure to HMRC, and settled the liabilities. The organisation explained:

• what had led to the error
• their internal audit process
• that they were making specific improvements to their systems and processes

HMRC concluded these were careless inaccuracies. HMRC agreed suspension conditions with the organisation, to help avoid future inaccuracies.

The organisation’s next internal audit was carried out 6 months later. This concluded that the changes they’d made had addressed the gaps in their processes. They found no similar errors. 

At the end of the suspension period, the organisation satisfied HMRC that they’d met the penalty suspension conditions. Due to this, HMRC cancelled their penalty.

Improving their internal auditing processes has reduced the organisation’s risk of making errors.

The next section of the guidelines is Next steps — correcting errors, guidance and legislation (part 14).