If you run a UK agency that uses contractors, HMRC's IR35 rules are probably the single biggest compliance risk on your books. Not corporation tax. Not VAT. Not payroll errors. IR35.
HMRC has been actively targeting the agency sector for years now. They know agencies are heavy users of limited company contractors. They know the rules changed in 2021 to put the responsibility on you, not the contractor. And they know many agency founders still haven't done a proper audit of their contractor engagements for IR35 compliance.
This article walks you through exactly how to run that audit. Before HMRC decides to run one for you.
Why Your Agency Needs to Audit Contractor Engagements for IR35 Compliance
The off-payroll working rules (commonly called IR35) shifted liability from the contractor to the client and fee-paying agency in April 2021 for medium and large organisations. Your agency counts if it meets two of these three criteria: annual turnover over £10.2 million, balance sheet over £5.1 million, or more than 50 employees.
Most agencies with 10+ people and £1m+ revenue will be medium or large. Many smaller agencies are too but don't realise it. If you're caught, you are responsible for determining the contractor's employment status and issuing a Status Determination Statement (SDS) before the engagement starts. You are also liable for any unpaid tax and National Insurance if HMRC later decides the determination was wrong.
The liability can be enormous. HMRC can go back six years. The tax bill includes unpaid income tax, employee NI, employer NI, and interest. Plus penalties of up to 30% of the tax due, or more if they decide it was deliberate.
A proper audit now is cheap insurance against that outcome.
Step 1: List Every Contractor Engagement You Currently Have
Start with the basics. You cannot audit what you have not listed.
Pull every contractor your agency has engaged in the last six years. Include:
- Limited company contractors (PSCs)
- Umbrella company contractors
- Freelancers working through their own limited company
- Contractors who started before April 2021 and are still working with you
For each engagement, record the contractor's name, their limited company name, the start date, the end date (if applicable), the role they filled, and the rate they were paid. If you use a system like Xero or FreeAgent for your contractor payments, you can export this data directly. If you are still using spreadsheets, now is the time to get organised.
Most agencies I work with find contractors they had forgotten about. A web designer who did a three-month project in 2019. A copywriter who worked through an umbrella company for six months in 2020. A developer who started as a full-time contractor in 2018 and is still on your books today.
All of them need to be reviewed.
Step 2: Review the Status Determination Statements (SDS)
For every contractor engagement starting after April 2021, you should have issued a Status Determination Statement before the work began. The SDS must state whether the engagement is inside or outside IR35 and give the reasons for that decision.
If you cannot find an SDS for a contractor who started after April 2021, that is a red flag. HMRC will treat that as a failure to comply, regardless of whether the determination itself was correct.
For contractors who started before April 2021 and are still working with you, you should have reassessed their status when the rules changed. If you did not, you need to do it now.
What a proper SDS looks like:
- Names of the client, agency, and contractor
- The start date of the engagement
- A clear statement: inside IR35 or outside IR35
- The reasons for the decision, referencing the specific employment status tests
- Evidence considered (contract terms, working practices, responses to CEST questions)
- Date issued
If your SDSs are generic one-liners, they will not hold up under scrutiny. HMRC wants to see that you actually considered the facts, not that you copied a template from the internet.
Step 3: Assess Each Engagement Against the Employment Status Tests
This is where most agencies fall down. They rely on the contract terms alone. HMRC looks at the actual working practices, not just what is written in the contract.
The key tests are:
- Substitution: Can the contractor send someone else to do the work? If the contract says yes but in practice you would never allow it, HMRC will look at the practice, not the contract.
- Control: Who decides what work is done, when it is done, and how it is done? If your project manager tells the contractor exactly what to do and how to do it, that points to employment.
- Mutuality of obligation: Is the agency obliged to offer work, and is the contractor obliged to accept it? Regular, ongoing work with no right to refuse points to employment.
- Financial risk: Does the contractor bear any financial risk? Do they have to rectify mistakes at their own cost? Do they provide their own equipment?
- Part and parcel of the organisation: Is the contractor treated like an employee? Do they attend team meetings, use a company email address, have a line manager, work set hours?
For each contractor, score them against these tests based on what actually happens day to day, not what the contract says. If the reality points to employment, the engagement is inside IR35, regardless of what your contract says.
Step 4: Use the CEST Tool but Understand Its Limits
HMRC's Check Employment Status for Tax (CEST) tool is free and gives you a determination that HMRC will stand by if you answer the questions accurately. That is the official line.
The reality is more nuanced. CEST works well for straightforward cases. A contractor who works full-time, uses your equipment, takes direction from your project manager, and has been with you for two years will get an inside IR35 result. That is correct.
But CEST struggles with complex arrangements. If your contractor works through a separate limited company, provides their own laptop, works from home three days a week, and has multiple clients, CEST can produce inconsistent results depending on how you answer the questions.
Use CEST as part of your audit, not as the whole audit. Run each engagement through the tool. Document the questions you answered and the result you got. If CEST says outside IR35, that gives you some protection. But if the working reality clearly points to inside IR35, CEST will not save you from a challenge.
For borderline cases, consider getting a professional IR35 review from an accountant or employment solicitor who specialises in this area. Our ICAEW qualified team at Agency Founder Finance runs these reviews regularly for agency clients. The cost is small compared to the potential liability.
Step 5: Check Your Contract Terms Against Working Practices
This is where you find the gaps. Pull the actual contract for each contractor. Then compare it to how the relationship actually works.
Common mismatches:
- Contract says the contractor can substitute, but in practice you have never allowed it and would not allow it
- Contract says the contractor controls their own hours, but your project manager sets a 9-to-6 schedule
- Contract says the contractor provides their own equipment, but you issued them a company laptop and phone
- Contract says the contractor can work for other clients, but your agreement requires 40 hours per week exclusively for you
Where you find mismatches, you have two options. Change the working practices to match the contract, or change the contract to match the working practices. Either way, the contract and reality must align. If they do not, HMRC will treat the engagement as inside IR35 and hold you liable for the tax.
Step 6: Identify Engagements That Should Be Inside IR35
After your assessment, you will have a list of contractors who are clearly inside IR35. These are the ones where the working reality looks like employment.
For these contractors, you need to do three things:
- Issue a corrected SDS stating the engagement is inside IR35
- Start operating PAYE and deducting income tax, employee NI, and employer NI from their payments
- Pay employer NI at 13.8% on top of the gross fee
If the contractor has been working with you for months or years and you have been paying them outside IR35, you have a historical liability. You need to calculate the unpaid tax and NI and agree a settlement with HMRC. This is where you need professional help. Do not try to calculate this yourself. The numbers are complex and the penalties can be significant.
We have helped several agency clients through this process. The key is to approach HMRC proactively, before they come to you. Voluntary disclosure usually results in lower penalties than waiting for a compliance check.
Step 7: Document Everything for Your Audit Trail
If HMRC opens a compliance check on your agency, they will ask for evidence. They want to see that you took reasonable care in making your determinations. A paper trail is your best defence.
For each contractor, keep:
- The SDS with the determination and reasons
- The contract signed by both parties
- Any CEST results or professional IR35 review reports
- Notes on the working practices you considered
- Correspondence with the contractor about their status
- Records of any changes to the engagement over time
Store these in a central location. A shared folder in Google Drive or Dropbox works. Make sure your team knows where they are and how to add new ones. If you change accountants, hand these over as part of the transition.
Step 8: Set Up Ongoing Compliance Processes
An audit is a one-off exercise. But IR35 compliance is ongoing. Every new contractor engagement needs a proper determination before the work starts.
Build this into your onboarding process. When a project manager wants to bring on a contractor, they should complete a status determination form before the contractor starts. The form should ask the key questions about substitution, control, mutuality of obligation, and financial risk. The result should be reviewed by someone who understands IR35, ideally your accountant or a senior team member.
For agencies that use contractors regularly, we recommend a quarterly review of all active engagements. Circumstances change. A contractor who started outside IR35 may have drifted inside over time. A six-month project that has now run for two years is almost certainly inside IR35. Regular reviews catch these changes before they become a problem.
What Happens If HMRC Opens a Compliance Check
If HMRC decides to investigate your agency's contractor engagements, they will typically start with a letter asking for information. They want to see your SDSs, your contracts, and your working practice notes. They may ask to speak to your contractors.
If you have done the audit we have described here, you can respond confidently. You have the documentation. You have the evidence. You have taken reasonable care.
If you have not done the audit, you will be scrambling. You will be trying to find contracts that may not exist. You will be guessing at working practices that no one documented. You will be hoping HMRC does not dig too deep.
HMRC can issue a tax bill for up to six years of unpaid tax, plus interest and penalties. For a mid-sized agency with 10 contractors working inside IR35 that should have been outside, the bill can easily hit six figures.
Do not wait for the letter. Run your audit now.
Next Steps for Your Agency
If you are reading this and thinking "I should probably check this," you are right. Start with step one. List your contractors. Then work through the steps in order. If you get stuck, get help.
Our ICAEW qualified team at Agency Founder Finance works exclusively with agency founders. We run IR35 compliance audits, review SDSs, and help with voluntary disclosures when needed. If your contractor mix has changed in the last 12 months, or if you have never done a proper IR35 review, get in touch. A one-hour review now can save you tens of thousands of pounds later.
For more on managing contractors in your agency, read our guide on contractors and IR35. If you are thinking about your agency structure, our incorporation and structure articles cover holding companies and exit planning. And if you need a full-service agency accountant who understands your business, see how we work with agencies like yours.